Who is responsible
CrowX is run by CrowX, the controller of your personal data. Send questions and requests to destek@crowx.space.
What we collect
- Account: email address, password (only in hashed form), username, age and avatar.
- Location: your city and country, if you allow it. Exact coordinates are not stored - only the city and country names and the country code.
- Location changes: later on, your location is only updated from your phone’s GPS. To stop fake locations, the country your request comes from is found from its IP address, and each change is recorded with that country.
- Tokens: your balance and every token movement (weekly reward, purchase, spend, refund). For purchases the store’s order number is kept; we never see card details.
- Interests: the topics you pick.
- Security: the IP addresses you sign in from.
- Device: your phone make, model and system version (for example Galaxy S24+, Android 15). Not the name you gave your phone.
- Usage steps: when you signed up, first searched for a match, were first matched, wrote your first message and finished your first 30-minute chat, and the days you opened the app. Your messages and who you talked with are not in these records.
- Feedback: what you send from Settings, with the app version, phone model, system version and language.
- Talking again: that you said you would talk again after a chat, and your asks (to whom, when, the answer); kept as long as the chat is, asks deleted after a day.
- Your answer to the question of the day: shown, with your username and profile, to the person you match with that day (if they answered too) and to those who answer the same way or nearly. Answers with contact details are not shown.
- Crown gifts: from whom to whom, how much and when; the one who gets a gift sees who sent it.
- Community safety: reports you file and reports about you, people you block, ratings after a chat, and when you accepted the community rules.
Messages
Chats are temporary. Messages and voice notes pass through our server to reach the other person. So you can look back at a chat, they are kept for 1 day after it ends - 3 days if either of you adds it to favourites - and then deleted for good. The one exception is a report: when someone reports a chat, its latest messages are attached to the report for review, and the reported person’s voice notes are kept until the report is settled, 30 days at most. A word someone teaches you in a chat is kept in your passport, with their nickname and country, until you remove it. A chat you both choose to keep is kept until one of you ends it, or neither of you writes for a day; then it is deleted for both. A thank-you note left after a good chat shows in the passport of the one it is for, with the nickname and country of the one who left it; it is kept until they hide it or either account is deleted.
Checks such as the contact-info warning and profanity masking run on your phone; your messages are not sent anywhere for them. When you translate a message, that happens on your phone too: the message is not sent anywhere.
Why we use it
- To create your account and match you with someone who shares your interests (performance of our contract).
- To prevent harassment, spam and banned accounts coming back, and to review reports (legitimate interest and legal obligation).
- For aggregate statistics, such as how many users come from which country and city (legitimate interest).
- To see where the app is hard to use, and to read your feedback (legitimate interest).
We do not use your data for advertising and we do not sell it.
What others see
The person you are matched with sees your username, avatar, age, city and country, and interests. No user ever sees your email or IP address. Reports are reviewed only by authorised moderators.
Service providers
- Supabase: accounts, database and servers. Data is stored on servers in Frankfurt, Germany (EU), which may mean it is transferred outside your country.
- OpenStreetMap Nominatim and geocode.maps.co: your phone location is sent once to turn it into a city name.
- DiceBear: avatar images.
- Google Play: token purchases. Google handles the payment; we confirm a purchase is real by asking Google.
- ipapi.co / ipinfo.io: when you update your location, your IP address is sent to find which country the request comes from.
- Sentry: error reports when the app crashes. A report holds the error itself, your phone model, system version and account id - never your messages, email address or a screenshot.
- Firebase Crashlytics (Google): error reports when the app crashes, with the error itself, your phone model, system version and account id - never your messages.
- Google ML Kit: translating a message happens on your phone; only the language pack is downloaded from Google, your messages are never sent.
- Google Play: if you installed the app from an invite link, Google Play passes the invite code in the link to the app, and it is given for your account.
How long we keep it
- Account data: until you delete your account. Your account and profile are permanently deleted 24 hours after you ask.
- IP addresses and device details: deleted 90 days after they were last used.
- The days you opened the app: deleted after 120 days.
- Reports: kept after an account is deleted, for the safety of the community.
- The email address of an account closed for breaking the rules is kept, so it cannot be used to sign up again.
Your rights
Under GDPR and Turkish law (KVKK article 11) you can access your data, ask for it to be corrected or deleted, object to its use, and take it with you. You can delete your account from Settings at any time. For anything else write to destek@crowx.space; we answer within 30 days. You may also complain to your data protection authority.
Age limit
CrowX is for people aged 18 and over only. We delete accounts we learn belong to someone under 18.
Changes
If we change this policy we update the date above, and announce important changes in the app.