Privacy Policy

Crate Systems makes Crate Mail, a Gmail client for the Mac; Cory, an assistant that runs on your Mac and that you message in iMessage; Crate Music, a Mac app and a website at music.trycrate.net for keeping and sending your music; and share links at share.trycrate.net, for sending music, video, and documents. This policy covers those and this website, trycrate.net, including its waitlist. It says what each one collects, where it is kept, who else receives it, and how you can see or remove it.

The short version. In Crate Mail, your mail is synced from Google to your Mac and kept there. Crate Systems runs no mail server and receives no copy of your mailbox. What leaves your Mac goes to Google (to fetch and send your mail), to Anthropic through our server, which passes it on without keeping it (for Cory, the assistant built into Crate Mail), to Composio (for connectors you choose to connect), and to a sender’s own address when you press Unsubscribe (section 11). We hold your Crate account and, if you joined it, your place on the waitlist.

Music and share links are different. What you upload to Crate Music or send as a share link is stored by us, because we are what plays it to the people you send it to. A share link records when it is opened and played, and the person who sent it can see that. Sections 7 to 9 have the detail.

1. 1. Who we are
2. 2. This website and the waitlist
3. 3. Crate Mail: what stays on your Mac
4. 4. Google user data
5. 5. Cory in Crate Mail
6. 6. Connectors
7. 7. Cory on your Mac and in iMessage
8. 8. Crate Music
9. 9. Share links
10. 10. Your Crate account
11. 11. Other requests Crate Mail makes
12. 12. Who receives what
13. 13. How long things are kept
14. 14. Your choices and rights
15. 15. Security
16. 16. Children
17. 17. Changes and contact

1. Who we are

Crate Systems operates from California, United States. It is the controller of your Crate account and the waitlist, and of the processing it arranges for you: sending the parts of your mail that section 5 lists to Anthropic for Cory, and the connector requests in section 6. The mail stored on your Mac is under your control; we hold no copy of it. For a share link, the person who sent it decides what is shared and with whom, and we store the file to provide the link for them. We are the controller of the records described in section 9 that we keep about a link: who opened it, watermarked downloads and checks, and invoice payments. Write to hello@trycrate.net about anything here; the address is read by a person and we answer within one month (within 45 days where California law gives you that period).

2. This website and the waitlist

If you join the waitlist, we store the email address you give, your answer to “What do you use now?” and any text you typed after choosing “Something else”, which of the two forms on the page you used, the page that referred you if your browser sent one, when you first and last submitted, and how many times. The answer is optional.

When you join, an email with those details is sent to the founder’s inbox through Resend, our email provider, so a new signup is seen the same day. We send you one email, when Crate Mail opens, and nothing else from the list, except notice of a change to this policy that affects the waitlist (section 17).

www.trycrate.net runs no analytics, no advertising, and no tracking pixels, and sets no tracking or advertising cookies. Share links work differently; section 9 says how. Our host, Vercel, keeps standard request logs (IP address, browser, page, and time) for a short rolling period to operate and protect the site. If saving a waitlist signup or sending its alert fails, the error logged there includes the email address concerned.

Cookies. The only cookies www.trycrate.net uses are strictly necessary ones: if you have signed in to a Crate account in this browser, Clerk’s session cookies for trycrate.net are present and are read to tell whether you are signed in; and a page used only by our own staff sets a cookie that keeps it unlocked. The cookies share.trycrate.net sets are described in section 9. Strictly necessary cookies do not need your consent, so we do not show a cookie banner.

3. Crate Mail: what stays on your Mac

Crate Mail talks to Google directly from your Mac. Your mail is fetched from Gmail and kept on your machine; it does not pass through any server of ours.

• Your Google sign-in (the access and refresh tokens and the address they belong to) is stored in the macOS keychain, one item for each Google account you connect. It is never sent to us.
• Recent mail is cached in the app’s local storage so the inbox opens instantly: the newest hundred threads, as text. That cache is not separately encrypted; it is protected by your Mac account and, if you use it, FileVault.
• Older mail is kept in a second store on the same Mac, in the browser engine’s own database, so that searching and filing can reach back through your mailbox without fetching it from Google again. It holds the message list and text, not the formatted bodies, which are fetched when you open a message. It is protected the same way the cache above is, it never leaves your Mac, and it is deleted when you disconnect the mailbox or sign in with a different Crate account.
• What you make in the app (drafts, views, snippets, writing style, to-dos, sender history, the calendar events it has fetched) is kept in the same local storage.
• Senders. If you open Senders and press Scan, Crate Mail asks Gmail for the headers of up to 1,500 messages from the last 90 days (not Sent, Chats, Drafts, Trash, or Spam): who each is from, its unsubscribe headers, its signature headers, its Gmail labels and date, and the results of the checks Gmail ran on who sent it. It does not fetch the messages themselves. The list it makes from them (each sender’s name and address, how much they sent and how much of it you opened, the latest date, and their unsubscribe options) is kept on your Mac, one per account, and is deleted when you remove that account.
• Sign-in codes. When mail that arrived in the last ten minutes holds a one-time sign-in code, Crate Mail finds it on your Mac, in mail it has already synced, and shows it at the top of the screen. Nothing extra is fetched or sent to do this. If you press Copy, the code is put on your Mac’s clipboard, where other apps can read it as they can anything you copy. You can turn this off in Settings.
• Attachments you save go to your Downloads folder.
• Mac Contacts are read on your Mac, only if you turn that on, to complete addresses. They are not sent anywhere.
• Keys you add yourself, such as a Stripe key for invoice cards or your own Anthropic key for Cory, are stored in the keychain.

Removing a Google account in Settings revokes its access at Google, deletes its keychain item, and deletes that account’s mail from your Mac (the recent cache and the older mail) and its Senders list. Everything else you made in the app (the list above, such as drafts, views, snippets, and to-dos) stays on the Mac. Signing in to Crate Mail with a different Crate account deletes the mail, what you made, and the Senders lists. Deleting the application does not remove keychain items or local storage by itself, as with most Mac apps: remove the account first, or delete the entries named crate-mail in Keychain Access.

Crate Mail keeps no log of your mail. A diagnostic log exists only if you create the file ~/.crate-mail-debug; it then records which operations ran and the structure of messages, including attachment names, but never message text.

4. Google user data

Crate Mail signs in to Google with its own OAuth client, in your browser, and asks for these permissions:

On the Lite plan one Google account can be connected at a time; on Pro you can connect several. Each one is signed in separately, with the permissions above, and what this policy says about your mail applies to each. Search sends the words you type to Gmail’s search each time, alongside a search of the mail already on your Mac. If a later feature needs a permission not listed here, you will be asked for it and this page will name it first.

Limited Use. Crate Mail’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• Google user data is used only to provide the features of Crate Mail you use.
• It is transferred to others only as needed to provide those features: text to Anthropic for Cory (section 5), and the identifier of an item a message refers to, such as a pull request number, to Composio and the connected service when you open that message (section 6); and, when you press Unsubscribe, one request to the address the sender put in their own message (section 11). Otherwise only to comply with the law, or as part of a merger or acquisition with notice to you.
• It is never used for advertising, and never sold.
• It is not used to develop, improve, or train generalized AI or machine-learning models, by us or by Anthropic.
• No person at Crate Systems reads it. None of it is stored on our systems, so there is nothing for us to read.

You can withdraw Crate Mail’s access at any time at myaccount.google.com/permissions.

5. Cory in Crate Mail

Cory is the assistant inside Crate Mail. It is part of the app, and it runs whenever you are signed in to your Crate account, or whenever a key of your own is saved in Settings; there is no setting that turns it off. Crate Mail sends text to Anthropic, which runs the model, and gets text back. Unless a key of your own is saved, the request goes through our server, which checks that you are signed in, counts it against your plan’s allowance, and passes it on to Anthropic’s API; it does not keep the text. Some of that happens because you asked; some happens on its own:

• Sorting new mail into views written as a sentence, including the Important view Crate Mail starts with. As mail arrives, the view’s sentence, any senders you have moved in or out of that view by hand, and for each new thread the sender’s name and address, the subject, and the first 120 characters, at most 60 threads at a time.
• Suggested replies. When you open a thread from a person, its subject, up to 2,000 characters of the latest message, and the writing style you set.
• Making a view. To show what a view would hold, its sentence and the same sender-and-subject lines for up to 60 of your recent threads. When you set up views the first time you open Crate Mail, also the sentence alone (to name the view), and those lines for up to 250 threads from the last 90 days.
• Drafting, when you ask. From the reply box: the subject, what you have written so far, the recipients’ names (or addresses, where there is no name), your instruction, the previous draft if you are asking again, and your writing style. From the command menu: the subject, up to 2,000 characters of the latest message, your instruction, and your writing style.

Anthropic processes this to return a response. Under Anthropic’s commercial terms, inputs and outputs of its API are not used to train its models. If a key of your own is saved in Settings (possible only in a build without a built-in key, or kept from an earlier version), Cory uses it instead, and the text goes to Anthropic under your own account and its terms with you. Nothing Cory in Crate Mail sends or receives is stored on our systems. The AI usage policy has the detail.

6. Connectors

You can connect other services (GitHub, Linear, PagerDuty, Stripe, Vercel, Todoist, Zoom, Google Drive, Trello, and others) so that mail from them shows a card with the item’s current state. Connecting is optional and done one service at a time, by signing in to that service.

• Composio holds the sign-in for a connected service and carries the requests to it. Your connections are held under your own identifier there and are not visible to anyone else.
• When you open a thread, a card asks the service for the item the mail is about. The request carries the item’s identifier (a repository and pull request number, an incident id, an invoice id), not the message.
• When you press an action on a card (acknowledge an incident, approve a pull request, mark an issue done, comment), that action is sent to the service. Acknowledging, approving, resolving, and marking done are offered only on mail verified as coming from that service. Commenting, where a service offers it (GitHub, Linear, Trello), is available whoever the mail is from, and posts only what you type, to the item the card names.
• A Stripe key you add yourself is used from your Mac, directly with Stripe. Previewing an invoice or checkout page fetches that page when you ask.

Composio records that a request was made, under its own privacy terms; it is not given your mail. Disconnecting a service in Crate Mail removes the connection at Composio, and you can also revoke it in that service’s own settings.

7. Cory on your Mac and in iMessage

Cory is also an app of its own. It runs on your Mac, reads the Messages conversations there to answer the messages addressed to it, and works with files and connected services on that Mac when you ask. Those messages are read on your Mac; iMessage itself does not pass through our servers. Some replies may be made on your Mac; when Cory uses a model in the cloud, the request and the context it needs go to Anthropic, as the AI usage policy describes. What we hold for Cory:

• Your Crate account (section 10), and for each Mac signed in to it, the name it gave and when it was last used. A Mac’s sign-in stops working after 90 days without use, and it has to sign in again.
• Chats you type in the Cory window on your Mac, with their text, so they survive reinstalling the app. Messages you send Cory in iMessage are not among them.
• A record of each reply: when it happened, how long it took, which model answered, tokens, and cost. Never the text of a message.
• Connected apps. Which apps each Mac has switched on. Requests to them pass through our server and through Composio in transit, as in section 6.
• Finding an email address. On paid Cory plans, Cory can look up a person’s work email address with Hunter.io. The name and company domain you asked about are sent from your Mac to Hunter.

8. Crate Music

Crate Music keeps the tracks and files you upload, their artwork, and your library’s details with us, so you can reach them from the Mac app and from music.trycrate.net and send them to people. Files are stored with Cloudflare R2 and the details in our database. When you upload audio, our audio worker on Fly.io downloads it, makes a streaming preview, measures its loudness and waveform, and then deletes its temporary copy.

If you let Crate Music read your contacts, it turns each email address into a scrambled code on your Mac and sends only those codes to check which of your contacts are on Crate. We don’t keep the codes or your address book.

If you or a member of your workspace connects an AI assistant to Crate Music, it can read and change what that connection allows. Crate Music never sends it audio or any other file, only links that open in Crate and need your sign-in. Text and details it may read, such as titles, credits, splits, notes, comments, lyrics, messages, and email addresses, go to that assistant’s provider under the provider’s own terms. A connection can be paused or removed at any time, and we keep a log of its requests for 90 days.

When you’re signed in, the Crate Music app tells us which features you use, such as adding a track, making a crate, sharing, or exporting, and reports errors, so we can see what works and fix what doesn’t. These usage events go to PostHog, in the United States, under a code made from your account, never your name or email address. They never include your music, file names, titles, lyrics, messages, or search text, and we don’t record your screen. You can turn this off in Settings, under Privacy. Where the law asks for consent first, it starts off.

Deleting a track or file moves it to Recently Deleted. Unless you restore it, it is permanently deleted 14 days later: the original, its previews, its artwork, and its waveform data.

9. Share links

A share link on share.trycrate.net lets the people you choose play, view, or download what you sent. If you received one, this is what we record when you use it, where you have allowed it (see “Your choice”, below):

• each time the link is opened, and when a track or video is played, how far it got, and whether it finished, with the play position;
• your device and browser, as the user-agent string your browser sends;
• a keyed hash of your IP address (an HMAC), which cannot be turned back into the address without a secret only we hold;
• the rough place the link was opened from (city, region and country), worked out from your IP address when you open it. We do not keep the address itself or anything more precise;
• how the link is played (plays, skips, replays and how far), whether you come back to it, the app or site it was opened from, the kind of device and browser, and your time zone and language;
• your email address, when the sender requires one to open the link or sent the link to you.

Your choice. In the European Economic Area, the United Kingdom, Switzerland, Brazil, India, South Korea, and Quebec, or when we cannot tell where you are from your IP address, the share page asks first and records the listening details above only if you choose “Allow all”. Elsewhere it records them from when you open the link, says so under the player, and stops when you choose “Turn off” there. If your browser sends a Global Privacy Control signal, we treat it as Turn off. Without your OK, the sender sees only how many times the link was opened, not who opened it or where from. Your choice applies to that link and stays in your browser until you clear its data.

The sender sees this: who opened the link, roughly where from, and who listened and how far. When a link is opened, the sender is sent a “link opened” email. Share emails we send on a sender’s behalf contain no tracking image: an open is recorded only when you open the share page itself, not when you open the email.

Codes by email. A sender can lock a link to the email addresses they chose. To open it, you type your email address and we send a six-digit code to it. We keep the code only as a hash, for ten minutes, and count wrong attempts so we can pause the link for that address after too many. We do not tell anyone whether an address was allowed.

Agreeing to the terms, and news from Crate. When a link asks for your email address, you tick a box to agree to our Terms and this policy before it opens, and we record that you agreed, to which version, and when. A second box, which stays unticked unless you tick it, asks whether you want news and offers from Crate. That list is Crate’s, not the sender’s: the sender cannot see your choice or email that list. We keep your address for news only when you tick that box, and only once the link has confirmed the address is yours, by a code we email to it or by your signed-in Crate account. An address typed into the box and not confirmed is not kept for news. If you tick it, we keep your address and when you chose, and every news email has an unsubscribe link that opens a page where you confirm. We keep the address for 90 days after you chose, or for as long as you have a Crate account, until you unsubscribe. When you unsubscribe, we keep the address only to make sure it is not added again. We rely on your consent for this, and you can withdraw it at any time (section 14).

Asking for a link. When a link has ended, been stopped, or reached its download limit, or is private, you can ask the sender for a new one or for access. We pass the sender what you typed (a name, an email address, and a note, each only if you give it) and which link you asked about. If you ask from an address that does not lead to a link, we send nothing to anyone.

When you are signed in to Crate. If you open a link someone copied from Crate Music while you are signed in to a Crate account, the sender learns it was you, once: the link appears in a conversation between the two of you in Crate Music Messages, marked “Sent externally”, and the sender sees when you first open or play it there. If you are not signed in, the share page remembers the link in your browser (see Cookies, below) so that it can appear in your Messages if you then sign in or create an account; we store nothing about you on our servers until you do. You can delete the conversation at any time, and it is not created if either of you has blocked the other.

Watermarked downloads. A sender can turn on watermarking for a share link. Where they have, each file downloaded from that link carries an inaudible identifier linked to that share link, so that if a copy turns up elsewhere the sender can trace it to the link it was downloaded from. Watermarking applies only to downloads; what you play in the browser is not marked. A marked copy is made when you download it and is deleted from our storage within about 24 hours. To check a copy, the sender (or someone who manages their Crate Music account with them) uploads it to us. If it carries a mark, we tell them which of their links it most likely came from, how confident the match is, and what we record for that link: the track and version, the name and email address it was sent to or opened with, if any, when it was first opened, and whether more than one person opened it. A match shows which link a copy was downloaded from, not who passed it on.

Invoices. A share link can carry an invoice. The invoice holds what the sender put on it, such as the name, email address, and postal address of the person billed, and the items billed. If you pay one, you pay on a page run by Stripe (Stripe Checkout). Your card details are handled by Stripe; we do not receive or store card numbers. We record that the invoice was paid, the amount, Stripe’s reference for the payment, and any later refund or dispute, and email a receipt to the invoice’s billing email address and to the sender.

On a document share, you can ask Cory about the document. The document’s text and your question are sent to Anthropic to answer it (see the AI usage policy).

Cookies. share.trycrate.net sets these strictly necessary cookies: when you unlock a link with a password or an email address, a signed cookie keeps that link unlocked in your browser until it expires; when a sender has made a link that opens only once, the browser that opens it first receives a signed cookie, and the link then opens only in that browser; when you open a link copied from Crate Music without being signed in, a cookie holds that link for up to 90 days so it can appear in your Messages when you sign in, and is removed once it has been used; and if a sender signs in to manage their shares, Clerk’s session cookies keep them signed in. These are needed to give you what you asked to open, so they do not need your consent. One more cookie, namedcrate_an_ followed by the link’s code, remembers your choice about listening reports on that link (see “Your choice”, above); the page also keeps that choice, and whether it has already counted your visit, in your browser’s local storage. There are no advertising cookies.

Share emails do not yet have an unsubscribe link. To stop receiving share emails from a sender, write to hello@trycrate.net and we will stop them. Each sender can send at most 300 share emails a day. We keep the records above, and watermark downloads, on the basis of the sender’s and our legitimate interests (section 14). You can object to that by writing to the same address.

10. Your Crate account

Crate Mail, Cory, and Crate Music sign you in to a Crate account through Clerk, our identity provider, so they can tell which plan you hold. The apps sign in through your browser, using PKCE, so a sign-in code caught on its way back to the app cannot be used by anyone else. The account holds your name, username, email address, profile picture if you add one, sign-in records, and plan. It holds nothing about your mail. Crate Mail keeps its Clerk session in the keychain. Crate Mail and Cory plans are billed through Clerk, which uses Stripe as its payment processor. Crate Music plans are sold through Stripe Managed Payments, which handles the payment, tax, and receipts as the merchant of record. Your payment details are handled by Stripe; we do not receive or store card numbers.

To delete your Crate account, write to hello@trycrate.net from its email address. We remove it, and what we hold for it under this policy, within 30 days of your request, and from backups within a reasonable period after that. If you start a free trial, we keep a scrambled version of your email address after you delete your account, so the same address can’t start a second trial. It can’t be turned back into your address.

11. Other requests Crate Mail makes

• Updates. About ten seconds after launch the app asks our release host whether a newer version exists. The request carries the version you run and ordinary network details, including your IP address. Updates install only when you choose.
• Images in mail. Like most mail apps, Crate Mail shows images in HTML mail by loading them from the sender’s servers. That can tell a sender you opened a message, from roughly where, and when. Images in mail that Gmail has put in Spam are not loaded unless you choose to show them. You can stop images loading in Settings, and show them for one message at a time.
• Unsubscribing. Senders lists the unsubscribe options a sender put in their mail. Nothing is done until you press a button. Where a sender offers one-click unsubscribe, and Gmail’s checks show the offer came from the sender’s own domain, pressing Unsubscribe makes your Mac send one HTTPS request directly to the web address they gave. It goes only to an address on the public internet and carries no cookies. It tells that sender your IP address, that the request came from Crate Mail, and that you asked to unsubscribe. Where a sender offers an email address instead, Crate Mail writes the unsubscribe email as a draft, and it is sent only if you send it. Where they offer only a web page, it opens in your browser.
• Service logos for connector cards load from Composio.
• No analytics. Crate Mail sends no usage analytics and no crash reports.

12. Who receives what

International transfers. We are based in the United States, and information we are responsible for is processed in the United States and by the providers listed above, in the countries where they operate. If you are in the European Economic Area or the United Kingdom, this means your information is transferred outside it. For each provider, we rely on the EU-U.S. Data Privacy Framework (and, for the UK, its UK Extension) where that provider is certified under it, and otherwise on the Standard Contractual Clauses approved by the European Commission (with the UK’s addendum to them, for the UK). You can ask us at hello@trycrate.net which safeguard applies to a provider.

We do not sell or rent personal information, and we do not share it for advertising. We disclose it to others only as this policy describes, to comply with law, or in a merger or acquisition, with notice to you.

13. How long things are kept

• Crate Music usage events: up to 12 months, then deleted.
• On your Mac: until you remove the account, delete the item, or delete the app’s data.
• Waitlist: until we send the launch email, then deleted within 90 days unless you have made a Crate account; sooner if you ask.
• Crate account: while the account exists, and deleted within 30 days of your asking, except what we must keep by law. Copies in backups are removed within a reasonable period after that.
• Cory’s synced chats and reply records: while the account exists. When you delete a chat, its text is removed; its title and the reply records are kept while the account exists.
• A Mac’s Cory sign-in: until you sign that Mac out, or 90 days after it was last used.
• Crate Music and shared files: until you delete them, then 14 days in Recently Deleted, then permanently deleted with their previews, artwork, and waveform data.
• Share access records (section 9): while the share exists, and up to 12 months after it is revoked or expires.
• Watermarked copies made for a download: deleted from our storage within about 24 hours of being made.
• News from Crate, chosen on a share page (section 9): 90 days from the choice, or for as long as you have a Crate account, until you unsubscribe. After you unsubscribe, the address is kept only so it is not added again.
• Invoice payment records (section 9): kept with the invoice while the share that carries it exists.
• Rate-limit records: request counts for share links, about a day; per-account request counts on our own database, a few days.
• Monthly counts of AI requests: while the account exists.
• Anthropic, Composio, and Fly.io keep what they receive only for the limited period their terms with us allow, for operating and securing their service.

14. Your choices and rights

You can ask us for a copy of what we hold about you, to correct it, or to delete it, by writing to hello@trycrate.net from the address concerned. We will not treat you differently for using these rights. Most of what Crate Mail touches is on your own Mac, where you can delete it yourself at any time.

If you are in the European Economic Area or the United Kingdom, the GDPR or the UK GDPR gives you these rights over the personal information we hold about you:

• to have access to it and receive a copy;
• to have it corrected if it is wrong or incomplete (rectification);
• to have it deleted (erasure);
• to have our use of it restricted;
• to receive information you gave us in a structured, machine-readable form, or have it sent to another provider (portability);
• to object to our use of it where we rely on legitimate interests, including the share link records and watermarking in section 9;
• to withdraw your consent at any time where we rely on consent, without affecting what we did before you withdrew it;
• to complain to a data protection supervisory authority, in particular in the country where you live or work or where you think the law was broken. In the UK, that is the Information Commissioner’s Office.

To use any of these rights, write to hello@trycrate.net. We may ask you to confirm that the request comes from you, usually by replying from the email address concerned. We answer within one month; where the law allows more time for a complex request, we will tell you within that month. If you live elsewhere, for example in California, local law may give you similar rights, and you can use them the same way. Some of these rights are limited by law; if we cannot do what you ask, we will say why. We do not make decisions that have legal or similarly significant effects on you based solely on automated processing.

Why we may use your information. The law requires a basis for each use of personal information. These are ours:

Where we rely on legitimate interests, you can object as described above, and we will stop unless the law allows us to continue.

15. Security

Secrets are kept in the macOS keychain, requests travel over HTTPS, release builds are signed and notarized by Apple, and our own systems hold as little as this policy lists. Apps sign in through your browser with PKCE, and a Mac’s Cory sign-in expires after 90 days without use. A share link that needs a password or an email address is unlocked with a signed cookie that expires, and password attempts on each share are limited. People you share music with are streamed a preview, not your original file, unless you allow downloads, and downloads can carry a watermark (section 9). No system is perfectly secure; if a breach affected information we hold, we would tell you and the relevant authorities as the law requires. Report a security problem to hello@trycrate.net.

16. Children

Our products and the waitlist are not for anyone under 16, and we do not knowingly collect information from them. If you believe a child has joined, write to us and we will delete it.

17. Changes and contact

If this policy changes, the date at the top changes with it. If a change widens what is collected or who receives it, or changes how long the waitlist is kept, we will say so in the app and, if we have your email address, by email before it takes effect. Questions: hello@trycrate.net. Legal notices: legal@trycrate.net.