v0.5.0 — Subscriptions, Trial Gating, and Privacy Infrastructure

New

• Subscriptions are live. Cratewise is $2/month or $20/year per household, processed via Paddle. The checkout flow defaults to the annual plan with a toggle to monthly. Existing trial households are not immediately affected — see trial gating below.
• Trial gating is now enforced: a 30-day window applies to new accounts, with a soft cap on AI-assisted identification (configurable, default 150 lookups). The app stays usable once you hit the cap; it just stops doing AI identification until you’re on a paid plan.
• Account deletion is now GDPR-compliant end-to-end — deletion requests actually remove your data, not just flag it.
• Full account data export is available (not just your collection and spins CSVs) — covers GDPR portability requirements.
• A public subprocessor list is now maintained at its own page, separate from the privacy policy.
• Manual entry is now presented as a deliberate privacy choice in the UI, not only as a fallback when AI identification fails.

Improved

• The subscription flow correctly passes your household ID to Paddle at checkout, preventing duplicate customer records for households that cancel and resubscribe.
• Paddle products and prices are now managed via API rather than manually in the dashboard, so price changes are repeatable without dashboard access being a bottleneck.
• Admins can designate households as comped directly from the admin surface.
• Database backups now run every 6 hours (previously every 24 hours), effective before subscriptions went live.
• The privacy policy’s international-transfers clause now covers Google/OAuth specifically.
• The live privacy policy at cratewise.app/privacy reflects the current policy text.

Fixed

• Two vulnerable dependencies affecting both hosts have been updated: one in the HTTP server layer, one in image processing.
• The /api/info endpoint now correctly rejects PUT, DELETE, and PATCH requests with 401s — behavior confirmed intentional.