Privacy
Last updated 7 November 2026
Who we are
Craggy runs craggy.io and its sites (models.craggy.io, data.craggy.io, repos.craggy.io and support.craggy.io). We decide how your personal data is used, so we are its controller under UK data protection law. Contact us about anything on this page at hello@craggy.io.
What we collect
When you visit. We use Google Analytics to count visits and see which pages are used. It sets cookies on craggy.io and records your device, browser, approximate location and the pages you view. It doesn't give us your name or email.
When you sign in. You sign in with GitHub, Google or Apple. The provider tells us your email address, an ID for your account with them, and the profile details they share, such as your name and picture. Apple lets you hide your email behind a relay address. We keep a record of your account, when you signed in, and which Craggy services you use. We don't receive or store your password.
The sign-in cookie. When you sign in, we set a cookie called craggy_session on craggy.io so that one sign-in works on every craggy.io site. It holds your sign-in tokens, nothing else, and lasts up to 30 days or until you sign out. It's needed for sign-in to work, so it's set without asking.
When you contact us. If you use the form at support.craggy.io/contact, we store your name, email address, message, its topic and the craggy.io page you came from, and email them to our inbox (hosted by IONOS) so we can reply. If you're signed in, the form fills in your name and email for you; you can change them before sending. Messages aren't linked to your account.
Saved models. If you save a model to your Craggy account in Craggy Modelling (models.craggy.io), we store the model, its title and its subject with your account so you can open it on any device. They're kept in London until you delete them, or your account, and nobody else can see them.
Why we use it
- To give you an account and keep you signed in. This is needed to provide the service you asked for.
- To answer you when you contact us. This is our legitimate interest in replying to the people who write to us.
- To keep accounts secure and stop abuse, for example by keeping sign-in records. This is our legitimate interest in running a safe service.
- To understand how the sites are used, through Google Analytics.
We don't sell your data, and we don't use it for advertising.
Who else handles it
- Supabase hosts accounts, sign-in and messages sent through the contact form, in London (UK).
- IONOS hosts our email, including the copy of each contact form message sent to our inbox.
- Google runs Google Analytics and hosts this website (Firebase Hosting).
- GitHub, Google and Apple handle sign-in when you choose them, under their own privacy policies.
Some of these companies may process data outside the UK. When they do, they use safeguards recognised under UK law, such as the UK's international data transfer agreement or adequacy regulations.
How long we keep it
We keep your account until you ask us to delete it. When we delete an account we erase its personal data; we keep only records the law requires. We delete contact form messages 12 months after they arrive; replies stay in our inbox for as long as we need them to deal with what you asked. Google Analytics keeps its data for 14 months.
Your rights
You can ask for a copy of your data, ask us to correct it, delete it or stop using it, and object to how we use it. Email hello@craggy.io. If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.
Changes
If we change this page, we'll update the date at the top.