What Krate collects, in plain words.

Apps you run

Krate apps run in a permission sandbox. An app can only touch what you granted on its consent screen, and the list you approve is the whole list. App data stays on your computer unless the app declares a network or shared capability and you approve it.

Anonymous usage counting

The Krate tool counts how many people use it, without learning who they are. What is sent: a random id generated on your machine, the Krate version, the operating system name, and which of a fixed set of actions happened (make, open, publish). What is never sent: app names, prompts, file paths, usernames, email, location, or any hardware identifier. The id is random bytes in a file; deleting the file makes your install a new anonymous one. The first run prints one line explaining this. Our server also notes whether the event came from a home or office connection or from a cloud network, using the network owner's name that Cloudflare provides, so test machines are not counted as people; the address itself is not kept. Turn it off permanently with KRATE_NO_USAGE=1.

The website

krate.tech pages send one small event when a page opens: the page path and the name of the site you came from (just its name, such as google.com, never the full address). Clicking a download link sends the same kind of event with the system you picked. Our server adds the country your connection is in, which Cloudflare tells it, and a daily visitor code: a one-way scramble of your connection and browser mixed with a secret that changes every day. It lets us count people instead of page loads. It cannot be turned back into an address, and it cannot link your visits across days. The address itself is never kept. No cookies, nothing stored on your device, and no third-party analytics. Search crawlers and link previews are counted apart from people.

Your account, if you sign in

Signing in (with GitHub, Google or an email link) stores the name, email address and picture that provider gives us, and the apps you publish, because published apps are credited to their publisher and support replies need somewhere to go. Nothing else about your account is read or stored. Each sign-in step is counted as started, finished or failed on our side, without recording who you are, so we can see when signing in breaks. Shared-store data (an app feature you opt into per app) is synced through krate.tech and readable by anyone holding that store's invite code, which the consent screen says before you approve it.

Questions

Open an issue at github.com/incyashraj/krate, the same place the code that this page describes lives.