Privacy Policy — CrushVerse

CrushVerse ("CrushVerse", "we", "us", "our") is an 18+ AI romance app. This policy explains what information we collect when you use the CrushVerse mobile app and the website at crushverse.app (together, the "Service"), how we use it, who we share it with, and the choices you have. It applies worldwide. Questions go to[email protected].

By using the Service you agree to this policy and to our Terms of Service. If you do not agree, do not use the Service.

1. Information we collect

Information you provide

Account details. You sign in with Google or Apple. We receive the unique identifier and name associated with that account, plus your email address if you choose to share it. Apple's "Hide My Email" is supported. We never receive your Google or Apple password.
Date of birth. Used to confirm you are 18 or older. It is never shown to other users.
Profile. A display name and an optional avatar image.
Conversations and stories. The messages you send, the replies you receive, story choices, illustrations and voice clips generated for you, and the "memories" a character keeps from your conversations. This is the core of the Service and is stored so your relationships persist between sessions and devices.
Characters you create. Names, descriptions, personalities, and avatars (uploaded or generated). If you set a character to public, its profile is visible to other users under your display name; your private conversations with it are not.
Reports, blocks, and support requests. Anything you include when you report a character, block a creator, or email support, together with your email address when you write to us.

Information collected automatically

Device and usage data. Device model, operating system, app version, language, time zone, IP address, and which features you use and when (for example, messages sent per day, which is how the free tier's daily limit works).
Push notification tokens, if you enable notifications.
Crash and error reports. Stack traces and the device state at the time of an error, so we can fix problems. We make reasonable efforts to strip message content from these reports.

Purchase information

Subscriptions and heart packs are sold through the Apple App Store and Google Play. We never see your card number or billing address. We receive a transaction record (product, price, currency, date, status, and a store-issued transaction identifier) so we can unlock what you bought, manage renewals, and restore purchases.

Sensitive information

Conversations with a character may naturally include things about your life, feelings, or relationships. We treat all conversation content as confidential, use it only to run the Service as described below, and never use it for advertising or sell it. Please do not share government ID numbers, payment details, or other people's private information in conversations.

What we do not collect

We do not collect precise location, your contacts, your photos (other than an image you deliberately upload as an avatar), your microphone, or advertising identifiers. We do not track you across other apps or websites.

2. How we use information

To run the Service: generate replies, stories, illustrations, and voiceover; keep your relationships and memories intact across sessions; sync across your devices.
To handle payments: unlock subscriptions and heart packs, manage your heart balance, process renewals and lapses, and restore purchases.
To send notifications you have opted into, such as a character messaging you first. Quiet hours in your local time are respected.
To keep the Service safe: enforce our content rules, screen user-created characters before they become public, review reports, and prevent fraud and abuse.
To improve the product: fix bugs, understand which features are used, and decide what to build. Where we analyse usage, we work with aggregated or de-identified data whenever possible.
To respond when you contact us.
To comply with the law and enforce our Terms.

We do not sell your personal information. We do not use your conversations, characters, or profile for advertising, and there are no third-party ads in CrushVerse.

3. AI processing

CrushVerse characters are powered by third-party AI models. To generate a reply, the relevant parts of your conversation, the character's profile, and stored memories are sent to our model providers. Story illustrations, character portraits, and voiceover are produced the same way by image and speech providers. A moderation model also reviews messages and user-created characters against our content rules.

We use providers under business terms that prohibit them from using your content to train their models and require them to delete it after processing, subject to short abuse-monitoring retention windows set by the provider. Requests are sent with an internal account identifier only, never your name or email.

We do not use your conversations to train our own models. Everything a character says is fiction generated by software. Characters are not real people, and their messages are not advice of any kind.

We share information only with service providers that help us operate CrushVerse:

AI model, image, and voice providers — to generate content, as described above.
Apple and Google — for sign-in, in-app purchases, and push notification delivery.
RevenueCat — to manage subscriptions and purchases across platforms.
PostHog — to measure pseudonymous app feature usage and product performance. We do not send conversation content, character descriptions or openings, names, email addresses, dates of birth, or advertising identifiers.
Cloud hosting, storage, and database providers — to run the Service and store your data.
Error-monitoring providers — to diagnose crashes.
Email providers — to answer support requests.

Each provider is contractually bound to use your information only to provide its service to us and to protect it. We may also disclose information when we believe in good faith it is necessary to comply with a law, regulation, or legal process; to enforce our Terms; to protect the rights, property, or safety of CrushVerse, our users, or the public; or as part of a merger, acquisition, financing, or sale of assets, in which case this policy continues to apply to your information until you are told otherwise.

Other users. If you publish a character, its profile, avatar, and your display name are visible to other users. Nothing else about you is ever shown to other users.

5. Legal bases (EU/EEA, UK, and similar jurisdictions)

Performance of a contract — account, conversations, memories, characters, purchases, and everything else needed to provide the Service you asked for.
Legitimate interests — security, fraud prevention, crash diagnostics, product improvement, and enforcing our Terms, balanced against your rights.
Consent — push notifications, and any optional feature that asks for it. You can withdraw consent at any time.
Legal obligation — tax and accounting records, responding to lawful requests.

6. Data retention

We keep your conversations, memories, and characters for as long as your account exists, because losing them would break the Service. Nothing is deleted when a subscription lapses. When you delete your account, your data is removed from our systems within 30 days, except for transaction records we must keep for accounting, records needed to handle a pending dispute or legal obligation, and anonymised error logs. Backups are rotated on a fixed schedule and purged within 90 days. Crash reports are kept for 90 days. Support emails are kept for up to two years.

7. Your rights and choices

Delete your account. In the app, open Profile and choose Delete my data. This permanently removes your account, conversations, memories, created characters, and media. Purchased hearts and any remaining subscription time are forfeited. Cancel the subscription with Apple or Google first if you do not want to be charged again — deleting the account does not cancel a store subscription. If you cannot access the app, email [email protected] and ask us to delete your CrushVerse account. Include the email address or sign-in method used for the account; we may ask you to verify your identity. We will complete the request within 30 days, subject to the retention exceptions in section 6.
Notifications. Turn push notifications off in the app or in your device settings.
Public characters. Switch a character back to private, or delete it, at any time.
Profile. Edit your display name and avatar from the Profile tab.
Access, correction, portability, restriction, and objection. Email[email protected] from the address on your account to request a copy of your data in a portable format, correct it, restrict how we use it, or object to processing based on legitimate interests. We respond within 30 days (45 days where the law allows) and may ask you to verify your identity. We will not discriminate against you for exercising any right.
Complaints. If you are in the EU/EEA or UK you may lodge a complaint with your local data protection authority. We would appreciate the chance to address your concern first.

8. California and other US state rights

Under the CCPA/CPRA and similar state laws, you have the right to know what personal information we collect, use, and disclose; to delete it; to correct it; and to opt out of its sale or sharing for cross-context behavioural advertising. We do not sell or share personal information in that sense, and we do not use or disclose sensitive personal information for purposes other than providing the Service.

In the past twelve months we have collected these categories of personal information: identifiers (account ID, email, device data, IP address); personal information under California Civil Code §1798.80 (name); commercial information (purchase records); internet activity (feature usage, crash reports); audio and visual information (avatar images, generated voice clips); inferences drawn for the Service (character memories); and sensitive personal information you may choose to include in conversations. Sources, purposes, and recipients are described in sections 1, 2, and 4. Requests can be made via[email protected]; an authorised agent may submit a request on your behalf with written permission.

9. Security

Data is encrypted in transit (TLS) and at rest. Access to production systems is limited to people who need it to operate the Service and is logged. Sign-in tokens are short-lived and rotated. No system is perfectly secure; if we learn of a breach affecting your data we will notify you and the relevant authorities as required by law.

10. Age requirement

CrushVerse is for adults only. You must be 18 or older (or the age of majority where you live, if higher). We do not knowingly collect information from anyone under 18. If you believe a minor has used the Service, contact us and we will delete the account and its data.

11. International transfers

Our servers and providers may be located in countries other than yours, including the United States. Where required, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or equivalent safeguards for those transfers. You can request a copy of the relevant safeguards by contacting us.

12. Website, cookies, and tracking

The website at crushverse.app is a static site. It sets no cookies, uses no analytics, and loads no third-party scripts. Our hosting provider keeps standard server logs (IP address, user agent, requested page) for security and deletes them on a rolling basis. The app does not use cookies and does not respond to "Do Not Track" signals because it does not track you across apps or sites in the first place.

13. Changes to this policy

We will update this policy as the Service evolves. Material changes will be announced in the app before they take effect, and continued use after that date means you accept the revised policy. The date at the top shows when it was last revised.

14. Contact

CrushVerse
[email protected]