Privacy Policy

This Privacy Policy explains how JunkyCraft (“JunkyCraft”, “we”, “us”) collects, uses and protects your personal data when you use our website and mobile apps (together, the “Service”). JunkyCraft is operated by Aqua Fusion Media Ltd (company number 06770058), of The Old Barn, Anchorage Lane, Sprotbrough, Doncaster, England, DN5 8DT, which is the data controller for the purposes of UK data protection law.

JunkyCraft is a parent-facing service: accounts are held and managed by adults (parents and guardians), and it is not directed at children. You must be 18 or over to create an account.

Information we collect

Information you give us:

• Account details — your name and email address, and a password (which we store only as a securely hashed value, never in plain text).
• Child profiles you create — a first name (or nickname) and age for each child, and an optional colour. We use these solely to match projects to the right age. Please avoid entering any more information about a child than this.
• Content you submit — project ratings, and any messages you send us through the contact/support feature.

Information we collect automatically:

• Usage and device data — basic log information such as pages or screens viewed, actions taken, app version, device type and general diagnostics, to run and improve the Service.
• Approximate location — we infer your country/region from your IP address and browser language to show the right currency and regional wording. We do not track precise location.
• Cookies and similar technologies — see our Cookie Policy.
• Push notification tokens — if you enable notifications in the app, a device token so we can send them. You can turn this off at any time in your device settings.

Payment information:

• Subscriptions bought on our website are processed by Stripe; subscriptions bought in the app are processed by Apple or Google (managed via RevenueCat). We do not receive or store your full card details — only your subscription status and the identifiers needed to manage it.

Children’s data

Because JunkyCraft is designed for parents, we do not knowingly allow children to create their own accounts, and we do not market to children. The only information relating to a child that we hold is the limited profile data (first name/nickname and age) that a parent chooses to add to match activities to their child. If you believe a child has provided us with personal data without parental involvement, contact us and we will delete it.

How we use your data, and our legal bases

• To provide the Service and your subscription — create your account, show and filter projects, remember your preferences and process payments (legal basis: performance of our contract with you).
• To support you — respond to messages and enquiries (legitimate interests, and/or contract).
• To keep the Service secure and working — prevent abuse, debug, and improve features (legitimate interests).
• Optional analytics and any marketing — only with your consent, which you can withdraw at any time.
• To meet legal obligations — e.g. tax, accounting and responding to lawful requests.

Who we share it with

We do not sell your personal data. We share it only with the service providers who help us run JunkyCraft, under contracts that require them to protect it:

• Google Cloud (Cloud Run) — application hosting.
• Neon — our database (hosted in the UK).
• Amazon Web Services — media storage/delivery (S3 & CloudFront) and transactional email (SES).
• Stripe — website payments.
• Apple, Google and RevenueCat — in-app purchases and subscription management.
• Firebase Cloud Messaging (Google) — push notifications, if you enable them.

We may also disclose data if required by law, or to establish, exercise or defend legal claims.

International transfers

Some of our providers process data outside the UK (for example in the US or EU). Where they do, we rely on appropriate safeguards such as the UK International Data Transfer Agreement / Addendum or an adequacy decision, so your data receives an equivalent level of protection.

How long we keep it

We keep your account data for as long as your account is active, and for a reasonable period afterwards to meet legal, accounting and dispute-handling needs. Support messages are kept while relevant to your query and our records. You can ask us to delete your account and associated data at any time (see your rights below).

Your rights

Under UK data protection law you have the right to:

• access a copy of your personal data;
• correct inaccurate data;
• have your data erased;
• restrict or object to certain processing;
• data portability;
• withdraw consent (where we rely on it) at any time.

To exercise any of these, email us at support@junkycraft.com. You also have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk, though we’d appreciate the chance to help first. Our ICO registration number is ZB007340.

Security

We protect your data with measures including encryption in transit (HTTPS), hashing of passwords, access controls, and reputable infrastructure providers. No method of transmission or storage is completely secure, but we work to protect your information and review our measures regularly.

Changes to this policy

We may update this policy from time to time. When we make material changes we will update the “Last updated” date and, where appropriate, notify you.

Contact us

Questions about this policy or your data? Email support@junkycraft.com or write to us at The Old Barn, Anchorage Lane, Sprotbrough, Doncaster, England, DN5 8DT.