Cribbit Systems Inc.
Privacy Policy
Effective Date: September 4, 2026
Cribbit Systems Inc. ("Cribbit", "we", "us", or "our") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, store, and protect personal information when you use the Cribbit app at cribbit.app to design, order, and receive custom foam inserts.
By creating an account or providing information to us, you agree to the practices described in this Privacy Policy.
1. Who We Are
Cribbit Systems Inc. is a business based in British Columbia, Canada.
If you have questions about this Privacy Policy or want to make a privacy request, you can contact our Privacy Officer at privacy@cribbit.app.
Our intended customers are in Canada and the United States. The app is reachable from elsewhere, and we do not verify where you live.
2. Information We Collect
We collect only the information we need to operate the app, build your insert, fulfill your orders, and run our business.
Account information
- your email address, verified through our identity provider
- your sign-in and session information
Design information
- the drawer photo you upload, and the straightened version generated from it
- your drawer dimensions
- the tool outlines our software detects, and any edits you make to them
- your layouts, previews, and the manufacturing files produced from them
Order information
- contact name and your verified email address
- delivery address: street, city, province or state, country, postal or ZIP code
- optional second address line, company name, and phone number
- prices, dates, order status, and the approved design and manufacturing files
Service reliability information
When something in the app fails, we automatically record that it failed, which step it failed at, and which software release was running. These reports do not contain your photos, designs, error text, IP address, web address, or any identifier for your browser or device.
No report identifies you. Some record which design was affected, so that we can repair it, and those are deleted when that design is deleted. The rest are not connected to anything of yours.
We do not use analytics or advertising trackers.
3. How We Use Information
- to sign you in and keep your work attached to your account
- to process your photo, detect tool outlines, and build your insert
- to save, restore, and recover your designs
- to review, invoice, manufacture, and deliver your orders
- to send order confirmations, invoices, and service notices
- to keep the app working, secure, and recoverable
- to send marketing emails, if you subscribe to our mailing list
- to protect our business, the app, and our customers from fraud, misuse, or security issues
- to comply with legal, accounting, tax, and regulatory requirements
4. Your Photos and Designs
Your photo and the design built from it are used to produce your insert, and to generate the layout, preview, and production files behind it.
We do not use your photos or designs to train or improve our software unless you separately opt in, as described in Section 5.
5. Optional Model Improvement Contributions
Cribbit detects the tools in your drawer photo automatically. We may ask whether you would share one example to help improve that. If you agree, we keep a separate copy of that example. This policy calls that copy a contribution, and it is the same thing the app's Data & privacy page calls a model improvement contribution.
How we ask. We may show an optional request, with your photo displayed behind it so you can see exactly what would be shared. You must click Contribute and confirm you are authorized to share what it contains. Declining changes nothing about your design, price, order, or service, and we ask about a given insert design only once.
What a contribution contains. The cropped drawer photo, the tool outlines detected in it, and the technical settings used to produce them. Not your name, email address, delivery address, original upload, or manufacturing files.
How it may be used. To develop, train, test, and improve our image-processing models and related features, including object detection and automatic tool alignment.
It is pseudonymous, not anonymous. Contributions are stored separately from your designs, under random identifiers that are not your sign-in ID. We keep a protected internal link to your account so that we can delete your contributions on request.
Deleting the source does not delete the contribution. A contribution outlives the insert design it came from.
Withdrawing consent. Under Manage account > Data & privacy:
- Show contribution requests controls whether we ask. Turning it off does not delete anything already shared.
- Delete all contributions covers everything shared as of the moment you confirm. Those become unusable immediately and are permanently deleted within 30 days. Anything shared afterwards is separate.
Withdrawal applies going forward. Deleting your contributions removes the files and excludes them from any future training. However, a model that has already been trained using a sample cannot be made to unlearn it — that influence cannot be isolated and reversed.
We may also review and remove a contribution at any time, and we delete every contribution no later than five years after it was made.
6. Mailing List and Marketing Emails
Our mailing list is optional and is never a condition of using Cribbit. We send nothing unless you ask to join, either from the one-time offer after you sign up or from Email me about new features under Manage account > Data & privacy.
The list carries new features, product launches, and occasional promotions. Order confirmations and invoices are not part of it and are sent regardless.
You can unsubscribe at any time by clicking the unsubscribe link in any email, turning the setting off, or contacting privacy@cribbit.app. Deleting your account removes you from the list.
We use MailerLite to manage mailing list subscriptions. Canadian anti-spam law requires us to be able to show that someone asked to receive commercial email, so we keep a record of when you joined or left and the wording you agreed to. That record contains your account identifier, not your email address.
7. Payments and Invoicing
We do not take payment through the app. Invoices are issued and paid through QuickBooks. We store an invoice reference number so that we can match an invoice to an order.
We do not collect or store your payment card details.
8. Cookies and Browser Storage
Our identity provider uses a session cookie to keep you signed in. We use your browser's local storage for interface preferences and to cache your work so the editor stays responsive.
We do not use advertising or analytics cookies. Your consents, preferences, and deletion requests are recorded on our servers, so clearing your browser does not change any of them.
9. When We Share Information
We do not sell your personal information.
We share personal information with trusted service providers that help us operate our business, and only for what we have asked them to do:
- Clerk — sign-in and identity
- Netlify — website hosting
- Railway — application hosting, database, and file storage
- Cloudflare R2 — private file storage
- Modal — processing your drawer photo to detect tool outlines
- Resend — order and service email
- MailerLite — mailing list management
- QuickBooks — invoicing and accounting
- UptimeRobot — website availability monitoring
We may also disclose personal information:
- when required or permitted by law
- to respond to legal requests or enforceable government demands
- to protect our rights, customers, or business
- as part of a business transaction such as a reorganization, sale, or financing, where permitted by law
10. Where We Process Information
Cribbit is based in Canada. Our service providers may store or process personal information in Canada, the United States, or other jurisdictions in which they or their own suppliers operate.
As a result, personal information may be subject to the laws of the jurisdictions in which it is stored or processed, and may be accessible to courts, law enforcement, or regulators in those places.
11. Retention of Information
We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, or as otherwise required by law.
Our general retention approach is:
- active designs and account information: until you delete them or close your account
- designs in Recently Deleted: 30 days, then permanently deleted
- submitted orders: 8 years from the date of submission, as business and tax records
- the drawer photo and the saved design behind a submitted order: 2 years from submission, so that we can answer warranty, dispute, and repeat-order questions
- cancelled orders that were never invoiced: 90 days after cancellation
- service reliability reports: 90 days, and up to 180 days for a small category
- model improvement contributions: up to 5 years, and sooner if you delete them or close your account
- mailing list consent records: while your account exists, plus 3 years afterwards
- the record that an account deletion happened: 90 days after that deletion finishes
The 8-year order period starts at submission and does not move; a later correction or replacement does not extend it.
We may retain certain information longer where required for legal, tax, accounting, dispute-resolution, fraud-prevention, or recordkeeping purposes.
12. Account Deletion
You can delete your account at any time under Manage account > Data & privacy.
If you cannot reach that screen — for example, you no longer have the Cribbit app installed — email privacy@cribbit.app from the address you signed up with and ask us to delete your account. We may need to verify your identity before we act on the request. This route is available to anyone, with or without the app.
Deleted immediately: your designs and photos, your draft cart, your model improvement contributions, your preferences, and service reliability reports tied to your designs — followed by your sign-in identity.
Three things are retained, and you should be aware of all three before you delete:
- Submitted and cancelled orders remain for the 8-year period above, no longer linked to your account. We are required to invoice, ship, and account for orders we have received, and those records need the name and address on them. The drawer photo and the saved design attached to an order also remain, on their own 2-year schedule.
- The mailing list consent record described in Section 6 remains for 3 years. Your email address is not part of that record and is erased from MailerLite.
- A record that the deletion happened remains for 90 days after it finishes. It names your sign-in identifier, and it exists so that restoring a database backup cannot quietly bring the deleted account back. Nothing else in it identifies you, and it is deleted automatically at the end of that period.
An order already in progress is not cancelled or delayed. It proceeds through review, invoicing, manufacturing, and delivery using the details you provided when you submitted it. After your account is deleted you can no longer view that order in the app; contact orders@cribbit.app, quoting your order reference.
13. Security
We use reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, loss, misuse, or disclosure. These include private storage that is not publicly reachable, ownership checks on every request, encrypted connections, and automatic deletion schedules.
However, no method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security. Please do not upload or share content that is highly sensitive, confidential, or outside your authority to share.
14. Your Choices and Rights
Depending on applicable law, you may have the right to request that we:
- explain what personal information we hold about you and how it has been used
- correct inaccurate or outdated personal information
- delete personal information, subject to legal and operational retention requirements
- withdraw consent where our processing is based on consent
To make a request, email privacy@cribbit.app. We may need to verify your identity before responding to certain requests.
If you are not satisfied with our response, you may also contact the Office of the Information and Privacy Commissioner for British Columbia.
15. Children's Privacy
Cribbit is intended for adults. You must be at least the age of majority where you live to create an account or place an order, as set out in Section 3 of our Terms & Conditions.
We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact privacy@cribbit.app and we will delete it.
16. Third-Party Links and Services
The app and our website may contain links to third-party websites or services. We are not responsible for the privacy practices, content, or security of those third parties. We encourage you to review their privacy policies before providing information to them.
17. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to our business, the app, our service providers, legal requirements, or privacy practices.
When we make changes, we will post the updated Privacy Policy and update the Effective Date above.