Privacy Policy

Welcome to Crushly AI!

Crushly AI ("we", "us", and/or "our") operates the Crushly mobile applications (the "Apps"), the informational website and its subdomains (the "Website"), and other related services (collectively, the "Services").

We are committed to protecting your privacy. This Privacy Policy describes how we collect, store, use, and share information through our Services.

We care about the protection and confidentiality of your information. When you use the Apps, you may provide information during your conversations with your Crushly AI companion. We process this information only as described in this Privacy Policy, such as to allow you to have individualized and safe conversations and interactions with your AI companion and to allow your AI companion to learn from your interactions to improve your conversations.

1. What information we collect

A. Information you provide

• Account information: Name, email address, birth date verification (for age confirmation), and password. If you log in using Google or Apple, we receive details such as your name, email, or unique identifiers.
• Profile information: Pronouns, interests, and preferences provided during registration.
• Messages and content: This includes the messages you send and receive through the Apps, facts about your life, photos, and voice messages. Images and other media generated in response to your prompts are created using third-party AI generation services and are automatically screened by NSFW content-safety filters before being returned to you. Content that attempts to bypass these filters or request prohibited material is blocked and may be logged for moderation and safety purposes.
• Interests and preferences: Conversation preferences and topics you select to personalize your experience.
• Payments and Billing: When you make purchases, Stripe, Inc. and other third-party payment processors collect payment card information on our behalf. Stripe processes your payment data according to Stripe's Privacy Policy. We retain transaction records and reward history for billing, account management, and fraud prevention purposes. We do not store full payment card details on our servers. In our Android app, purchases made through Google Play Billing are processed by Google (merchant of record); where alternative billing is offered in approved regions, card payments are processed by Stripe (a PCI DSS Level 1 certified processor) and Crushly is the merchant of record for those transactions. Only limited transaction and entitlement data (such as subscription status, product identifiers, and purchase tokens) is shared with us to verify purchases and maintain premium access. You can manage alternative-billing subscriptions, download receipts, and file billing or refund requests via the in-app Membership (Manage Subscription) screen and our Billing Support page.

B. Information we collect automatically

We automatically log hardware and software data, including:

• Device and network data: Operating system, browser type, IP address, device identifier, and general location information (country/region level).
• Usage data: Interactions with the Services, features accessed, conversation timestamps, and session duration.
• Analytics and performance data: Error logs, crash reports, and performance metrics to maintain service quality.

2. How we use your information

We use your information for the following purposes:

• Operating the Services: Creating and managing accounts, processing payments through Stripe, providing customer support, and account recovery.
• Core Functionality: Providing a personalized AI companion, syncing conversation history across devices, and generating tailored responses.
• Age Verification and Compliance: Verifying users are 18+ and enforcing age restrictions to comply with content guidelines.
• Content Moderation and Safety: Monitoring for prohibited content (CSAM, non-consensual material, illegal activity), enforcing intimacy level restrictions, applying NSFW guardrails to all third-party-generated media, and blurring sensitive content as configured.
• Fraud Prevention and Security: Detecting suspicious payment activity, preventing unauthorized account access, and maintaining service integrity.
• Analysis and Improvement: Analyzing trends and user behavior to improve features, optimize performance, and develop new features.
• AI-Powered Features: Processing data using third-party AI services (e.g., OpenAI, Anthropic, and third-party media-generation providers) to generate conversations, images, and voice messages. These underlying models are not designed or fine-tuned to produce sexually gratifying content; they are built to hold natural, non-biased conversation appropriate for an adult (18+) audience, responsive to user prompts within defined safety limits. Third-party media generation requests pass through automated NSFW screening; requests or outputs that would violate our content policies are blocked. We anonymize data where feasible and explicitly prohibit third parties from using your data for training their models without your consent.
• Legal Compliance: Fulfilling legal obligations and responding to lawful requests from authorities.

3. How we share your information

We may share your information with:

• Payment Processors: Stripe, Inc. and other payment providers who process transactions on our behalf, including Stripe as processor for alternative-billing card payments offered in our Android app in approved regions (PCI DSS Level 1). Google processes payments for purchases made through Google Play Billing. Your data is shared only to the extent necessary to complete payments and prevent fraud.
• Service Providers: Companies that help us operate our business including:
  • Cloud hosting providers (data storage and backup)
  • AI/ML providers (conversation and image generation)
  • Customer support platforms
  • Analytics services
• Professional Advisors: Lawyers, accountants, auditors, and insurance providers when necessary for legal or compliance purposes.
• Law Enforcement and Authorities: We disclose information when required by law, court order, or legal process, or to protect public safety and prevent illegal activity (e.g., CSAM, harassment, threats).
• Business Transferees: In connection with a merger, acquisition, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. You will be notified of any such change and any choices you may have regarding your information.

Important: We will never use or disclose the content of your personal Crushly conversations for marketing, advertising, or third-party training purposes without your explicit consent. Conversation content is used solely to improve your personal experience with your AI companion.

4. How we secure your information

We use industry-standard security measures to protect your information:

• Data Encryption: SSL/TLS encryption for data transmitted between your device and our servers.
• Storage Security: Multi-layered access controls, encryption at rest, and regular security audits.
• Payment Card Security: We comply with PCI DSS (Payment Card Industry Data Security Standard) and delegate sensitive payment processing to Stripe.
• Access Controls: Only authorized personnel with a legitimate business need have access to personal information.

While we implement robust security measures, no system is completely impenetrable. In the event of a data breach involving personal information, we will notify affected users and relevant authorities as required by applicable law.

5. Data retention

We retain personal information only as long as necessary to fulfill the purposes outlined in this Privacy Policy. Retention periods include:

• Account data: Retained while your account is active and for a reasonable period after deletion (typically 90 days) for recovery purposes.
• Conversation history: Stored on your account; you can delete conversations at any time. Deleted conversations are purged within 30 days.
• Transaction records: Retained for 7 years to comply with financial and tax regulations.
• Metadata and analytics: Retained for up to 12 months or until no longer useful for analysis.

If you request account deletion, we will delete all personal and conversation data within 30 days, except where retention is required by law.

6. Your rights and choices

Depending on your location, you may have the following rights:

• Access: Request a copy of the personal information we hold about you.
• Correction: Update or correct inaccurate information.
• Deletion: Request deletion of your account and associated data (subject to legal retention requirements).
• Portability: Request your data in a portable format.
• Opt-out: Opt out of marketing communications or analytics tracking (core functionality will not be affected).
• Withdraw Consent: Withdraw consent for processing your data where applicable.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days or as required by applicable law.

7. Third-party services and links

The Services may contain links to third-party websites and integrations with third-party services. This Privacy Policy does not apply to third-party services, and we are not responsible for their privacy practices. Please review their privacy policies before providing personal information.

8. Use by minors

The Services are not intended for individuals under the age of 18. If we become aware that a minor has provided personal information or is using the Services, we will:

• Immediately suspend or delete their account.
• Delete all associated personal and conversation data within 30 days.
• Contact a parent/guardian if contact information is available.

If you believe a minor is using Crushly, please contact us at [email protected].

9. International data transfers

Your information may be transferred to, stored in, and processed in countries outside your country of residence, including the United States. These countries may have data protection laws that differ from your home country. By using the Services, you consent to the transfer of your information to countries outside your country of residence.

10. California and GDPR privacy rights

If you are a California resident or subject to GDPR (Europe), additional rights may apply:

• California (CCPA): You have the right to know, delete, and opt-out of the sale of personal information. We do not sell personal information for monetary consideration, though data sharing with service providers may constitute a "sale" under CCPA.
• Europe (GDPR): We process data based on legitimate interests (service provision, fraud prevention), contract performance, and your consent. You have rights to access, rectification, erasure, restriction, portability, and objection.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by posting the updated policy with a new "Last Updated" date. Your continued use of the Services following any changes constitutes your acceptance of the updated Privacy Policy.

12. Contact us

If you have any questions about this Privacy Policy, concerns about our privacy practices, or wish to exercise any of your rights, please contact us:

• Email: [email protected]
• Website: Crushly.co
• Response time: We aim to respond to all inquiries within 30 days.