Privacy Policy

Crushly is operated by [LEGAL ENTITY NAME], registered at [REGISTERED ADDRESS], India. For this policy, Crushly and [LEGAL ENTITY NAME] are the same thing — “we”, “us” and “our” all mean the same person, which is the operator of this app.

We are the data fiduciary for the personal data described in this policy. Our contact details are in section 15.

We collect in four broad groups: what you give us, what the app generates while you use it, what we need to keep the app safe, and what is needed to take a payment.

Account details you give us

Name, username, profile photo

Your display name, a unique handle, and the picture you upload. Your photo is the single biggest thing other members see.

Email address

Used to sign in, to send your confirmation link, password resets and account notices. We do not use it for marketing.

Mobile number

Collected at sign-up so we can reach you about your account and keep the platform usable on feature phones. It is never shown to other members.

Password

We store only a slow one-way hash of your password. Nobody at Crushly can read your password or reset it without the reset link we email you.

Date of birth, gender, city, education, interests

Used to show your age on your profile and to filter Discover so the right people find you. Date of birth is also how we check that you are 18 or older.

What you are here for

Friendship, dating, or both. This drives the Discover filters for everyone else.

Bio, prompt answers and gallery photos

The parts of your profile you fill in later. Your bio and prompt answers are automatically masked for free plans when they contain contact details.

Conversations and content you create

Chat messages

The text, images and voice notes you send, plus when they were sent, whether they were read, and whether the other person is typing. These belong to you and to the person you are talking to.

Friend requests

The request itself, the intro note you attach, and who accepted, declined or cancelled it.

Date plans

Who you are meeting, where, when, your notes, and the trusted contact you name — their name and, if you enter it, their phone number. This is a private organiser; see section 5.

Notifications

A record that a request, acceptance or message happened, so the app can show you an unread badge. It does not carry the message text.

Safety and moderation data

Reports you file

Who you reported, the reason, and any detail you typed. Only the moderation team sees these.

Blocks

Who you blocked and when. Other members are never told who blocked them.

Verification selfies

A live selfie you take in the app to prove the profile photo is yours. Our moderation team compares it with your profile photo. It is never shown to other members and never shown publicly.

Last seen and online status

When you were last active, so people can see if you are around. You can turn this off in Settings.

Help requests

The subject and body of a message you send us from the Help page, and our reply.

Internal logs

Records of actions taken by staff (for example, approving a verification or suspending an account) and automated alerts about problems the system noticed, such as a blocked sign-up attempt. These are used for accountability and to investigate abuse.

Payment records

What you bought

The plan, the base price, the GST, the convenience charge, the total, the date, the expiry, and the payment reference returned by the gateway.

What we never receive

Your card number, CVV, UPI PIN or net banking password. Those go straight from your device to the payment gateway and never touch our servers.

Technical data

We keep the time your account was created and last updated, and we use short-lived counters to slow down automated abuse. When a sign-up attempt is blocked, the network address the attempt came from is recorded in an internal security log.

• We do not collect your GPS or precise location. Crushly has no location feature, and your city is a name you type in, not a position we track.
• We do not collect your contacts, call logs or address book.
• We do not run advertising trackers, analytics trackers or pixels. There is no third-party advertising or profiling SDK on this app.
• We do not sell, rent or trade your data. Not to advertisers, not to data brokers, not to anyone.
• We do not use your photos, chats or profile to train a model of our own.
• We do not read your message history to advertise to you, because we do not advertise to you at all.

• The person you are chatting with. If you send a message, the other member of that conversation can read it. That is the whole point of a chat app.
• Razorpay, our payment gateway, which processes plan payments. It receives the amount, the order reference and the plan name.
• Our language model provider, but only for conversations with AI companions. See section 11.
• Our email provider, which delivers sign-up confirmations, password resets, verification decisions and our replies to your help requests.
• WhatsApp, but only if you choose the WhatsApp share button on a date plan. Your phone sends that message — we do not.
• Our staff and moderators, but only what they need to do their job. See section 6.
• Law enforcement, courts and regulators, where we are legally required to. We will tell you, unless we are forbidden to.

A small team runs the moderation console. Here is exactly what they can and cannot see, because a safety feature you cannot audit is not a safety feature.

For a serious investigation, a staff member can sign in as you — a one-time, ten-minute, fully audited session. This is recorded in our internal audit log, and the session is marked so that it does not change your online status or leave a trace in your activity. We use it to reproduce a bug or to see what a reported account actually looks like. If you ask us, we will tell you whether it was used and when.

If you delete your account, everything in the first row goes with it — your profile, your chats, your photos, your date plans and your plan history — except the invoice rows we are legally required to keep, which are kept without your profile attached.

Under the Digital Personal Data Protection Act, 2023 you have the right to:

• Know what we hold about you, and get a copy of it.
• Correct anything that is wrong or incomplete.
• Ask us to erase your data when we no longer have a reason to keep it.
• Withdraw consent, where consent is what we relied on to process your data.
• Nominate someone to exercise your rights if you cannot.
• Grievance with us and receive a response.

To get a copy or a correction: most of it is already yours to edit in the app — Profile for your details and photos, Settings for your privacy switches and blocked list, and the Plans page for your invoices. For anything else, write to legal@crushly.cloud and we will send you what we hold within 30 days.

To erase: use Settings → Danger zone → Delete my account. It is immediate and self-service; you do not need to email anyone.

To nominate someone: write to grievance@crushly.cloud from the email address on your account.

We do not charge for exercising a right, we do not make you jump through hoops, and we will not penalise you for asking. If we decline a request, we will tell you why and how to complain further.

Crushly uses one session cookie to keep you signed in, and stores a few preferences in your own browser. We use no advertising or analytics cookies, which is why you are not asked to dismiss a cookie banner. The full list is in the Cookie Policy.

• Passwords are hashed with a slow algorithm and never stored or logged in plain text.
• Password reset and email confirmation links are stored only as a one-way hash, so a copy of our database cannot be used to take over an account.
• All traffic is encrypted in transit.
• Sign-ups, logins and messaging are rate limited to slow down automated abuse.
• Uploads are re-encoded and resized on receipt, and only image and audio types are accepted.
• Access to the moderation console is restricted to accounts with a staff role, and every staff action is written to an audit log.
• Message content is not exposed to staff in the normal course of work.

No system is perfect. If you think your account has been compromised, change your password from Settings, then tell us at support@crushly.cloud.

Some accounts on Crushly are AI companions. When you send a message to one, the following happens:

• The recent messages in that conversation — up to the last 16, including your own — are sent to the language model provider we use to generate the reply.
• We send the companion’s own character details (name, city, persona, tone) so the reply stays in character. We do not send your profile fields, your email, your phone number, your date of birth or your photos.
• Images and voice notes are not sent to the model provider.
• The generated reply is stored as a normal message in the conversation, so it appears in your chat history exactly like any other message.

That means anything you type to a companion can be processed by that provider. Please do not type anything into a companion chat that you would not want processed by a third party — bank details, OTPs, identity documents, passwords or intimate images. The AI Companion Disclosure explains how the companions themselves behave.

Most processing happens on servers in India. Two things can leave the country:

• AI companion replies, which go to whichever language model provider is configured — that provider may process data outside India.
• Payment processing and transactional email, where the gateway or email provider may operate outside India.

Where your data is processed outside India, it is done under the provider’s own data-protection commitments. If you want to know which provider is currently configured, ask us and we will tell you.

Crushly is for adults aged 18 and over. We ask for your date of birth at sign-up, and we check the verification selfie against your profile photo. We do not knowingly allow anyone under 18 to use the Service, and we delete accounts that we learn belong to a minor along with the data in them.

We do not knowingly collect the personal data of anyone under 18. If you believe a minor has created an account, tell us at safety@crushly.cloud and we will remove it.

We may update this policy as the app changes. If we make a material change we will notify you in the app and by email. The date at the top always reflects the current version, and continuing to use the Service after a change means you accept the updated policy.

The Grievance Redressal Officer for Crushly can be reached at grievance@crushly.cloud. Complaints are acknowledged within 48 hours and resolved within 15 days.

For anything that is not a formal complaint, use the contact page. For an emergency, call 112 first — we are not the police.