Your music files stay on your devices. MilkCrate never uploads them.
Syncing between your own devices on your home Wi-Fi never touches our server.
If you make an account and use MilkCrate Cloud, our server keeps what it needs to sync: playlists, favorites, and recently played.
No ads, no tracking, and we don't sell or share your data.
Who we are
MilkCrate is made by Fullancia, LLC, a Maryland company. "We" and "us" in this policy mean Fullancia, LLC. It covers the MilkCrate apps for macOS, iPhone and Android, and milkcratemusic.com.
What stays on your devices
MilkCrate reads your music files, their tags and their artwork to build your library. That library lives on your devices. When your computer copies music to your phone, or your phone streams from your computer, the two talk to each other directly over your local network, encrypted, without our server.
The apps ask for these permissions, and use them only for this:
Music and media files: to find and play the music on the device.
Camera: to scan the code that pairs your phone with your computer. The image is read on the device and not saved or sent anywhere.
Local network: to find your computer, speakers and AirPlay or Sonos devices at home.
Notifications: for the playback controls and the progress of a sync.
Your account
You don't need an account to play music or sync over Wi-Fi. If you make one, we store:
Your name, your @handle and your email address.
Your password, as a one-way hash. We can't read it.
A profile photo, if you add one. It's stored in Amazon S3 and anyone with its link can see it.
When you signed up and your member number.
We email you only to confirm your address and to reset your password.
MilkCrate Cloud
When you're signed in, MilkCrate Cloud keeps your devices in step when they're not on the same network. To do that our server stores:
Listening history: the title, artist and album of songs you play, when, and on which device. We keep your most recent 5,000 plays.
Recently played songs, albums, artists and playlists.
Playback: your current queue and position, so you can pick up on another device.
Playlists and favorites: the changes you make, including playlist names, song details and a small cover image for songs you add or favorite.
Device names, such as "Pixel 10 Pro", while a device is connected.
This data is encrypted between your devices and our server, but it isn't end-to-end encrypted, so our server can read it. We look at it only to run MilkCrate Cloud and fix problems with it.
Sharing music
When you share a song, an album or an artist, we make a public page with its title, artist and cover, and links to it on streaming services. The page doesn't show who shared it. If you have a public profile, people who open your link while signed in to our website see your handle in their Shared with me list. Anyone with the link can open it, and search engines are asked not to list it.
If you report a wrong link on a share page, we store the report and a one-way hash of your IP address to limit abuse. We don't store the IP address itself.
We count how many times our web pages are opened, how many share links are made and which streaming buttons are tapped, as daily totals on our own server. When you open a page, we note the country it came from, as reported by our network provider, and add it to a count. We don't use cookies for this and don't store your IP address or anything that identifies you or your device.
Profiles
You can have a profile at milkcratemusic.com/@yourhandle with your name, photo, handle and location. A profile made on our website is public; one made in an app is private until you turn it on. You can change either in Edit profile.
Your wishlist shows on your profile only if you turn that on. Shared with me lists the songs, albums and artists people sent you, saved when you open their link while signed in. Only you can see it.
If someone reports a profile, we keep the report, the reporter's account if they were signed in, and a one-way hash of their IP address.
Services we use
We use a few companies to run MilkCrate. Each gets only what it needs:
Railway hosts our server and database.
Cloudflare sits in front of our website. It handles your connection and tells our server which country a visit comes from.
Amazon Web Services stores profile photos and app downloads.
Resend sends our emails, so it gets your email address.
Apple (iTunes Search), Deezer, MusicBrainz and Tidal help us match songs and find artwork. We send song and album titles, artists and codes, never your account details. The apps also ask Deezer for artist photos and Apple for album covers by artist and album name.
Google Fonts serves the fonts on our web pages, so your browser contacts Google when you visit.
What we don't do
No ads, and no data sold or shared for advertising.
No tracking pixels, third-party analytics or crash reporting in the apps or on the website.
No cookies on our public web pages, except one that keeps you signed in if you sign in on our website.
Payments
MilkCrate Cloud is free during the beta and we don't take payments yet. Before we do, we'll update this policy to say who processes them and what they receive.
Keeping and deleting your data
We keep your account and Cloud data while your account exists. You can remove your profile photo and playlists in the apps at any time.
To delete your account and everything stored with it, open Settings in the MilkCrate iPhone app and tap Delete Account, or email [email protected] from the address on your account and we'll delete it within 30 days. Songs you shared stay on their public pages.
You can also ask us for a copy of your data or to correct it, wherever you live. We don't discriminate against anyone for asking.
Security
Everything between the apps and our server is encrypted in transit. Passwords are hashed and sign-in links expire. No system is perfectly secure, and if something happens that affects your data, we'll tell you.
Children
MilkCrate isn't meant for children under 13, and we don't knowingly collect their data. If you think a child has made an account, email us and we'll delete it.
Changes
When this policy changes, we'll update the date at the top. If a change affects how we use data you've already given us, we'll tell you in the apps or by email first.
Profiles
You can have a profile at milkcratemusic.com/@yourhandle with your name, photo, handle and location. A profile made on our website is public; one made in an app is private until you turn it on. You can change either in Edit profile.
Your wishlist shows on your profile only if you turn that on. Shared with me lists the songs, albums and artists people sent you, saved when you open their link while signed in. Only you can see it.
If someone reports a profile, we keep the report, the reporter's account if they were signed in, and a one-way hash of their IP address.