Crushtape Privacy Policy

Last revised: September 16, 2026

We run Crushtape. Rather than recite abstractions, this policy does one job: it lays out for you, point by point, the circumstances in which your information comes within our reach as you use Crushtape, the reasons that contact is unavoidable, the way we hold that information once it is with us, and the moment we release it. Nine sections unfold in that order; read them straight through, or turn only to the part that concerns you. Crushtape is published by DevByDesign, while the legal entity ShineOn Window Cleaning LLC carries operating and compliance responsibility.

One statement belongs at the outset: Crushtape is built for adults. Our services are not directed to minors, and anyone under the age of 18 sits outside the scope we keep open.

1. Who we are, and what this policy reaches

The Crushtape mobile client and the web features built alongside it form the complete subject matter of this policy, and every act of personal data processing occurring within those products is carried out by us under its terms. Five baselines are observed throughout that processing — lawfulness, legitimacy, necessity, transparency and security — and information unrelated to a concrete feature is never sought from you.

Services operated independently by third parties fall outside this policy. Where you follow a link out of this app, or call up a feature supplied by a third party, that party handles the information involved under its own privacy notice, and it is worth reading that notice before you use the feature. Should any part of this policy be unacceptable to you, please do not register and do not keep using Crushtape.

2. What information we gather

Four categories of information make up the minimum set on which Crushtape depends.

Account information — during registration, sign-in and profile completion, the following is handed to us directly by you:

• your email address, which serves as the credential for signing in and recovering the account;
• nickname, avatar and self-introduction text;
• date of birth, used only to verify that you have reached adult age;
• gender and region, used to calculate content recommendations and display range;
• any further profile details you add or edit later.

Device and technical information — reported automatically by the client while it runs, in order to fit different handset models and to locate faults:

• screen resolution and pixel density;
• GPU renderer model and support for graphics APIs;
• battery level and charging state;
• system language, regional settings and time zone;
• app version, installation source channel and first installation time.

Usage and activity information — your operations inside the app leave records, which are used to reconstruct what went wrong and to improve the product:

• session start time, duration and opening frequency;
• the content you viewed and how much of it played through;
• counts of interactions such as likes, saves and shares;
• reports you filed and reports filed against you;
• crash and non-responsive logs, together with abnormal termination stack traces.

Payment and transaction information — when you buy a membership benefit or virtual item, charging and settlement are completed independently by the official Google Play Billing channel. All that comes back to us are necessary receipts such as the order number, transaction status and purchased item; card numbers, payment passwords and payment verification codes neither pass through us nor could be retained by us.

3. What the information is used for

Information serves the five purposes listed below and nothing beyond them.

• Operating the features: registration, sign-in, profile display, content recommendation and instant messaging are kept running by this purpose;
• Improving the service: playback stutter, feature popularity and experience gaps are located through activity data and fault records, and product iteration follows from there;
• Security protection: spam, bulk registration, account theft and content violations are identified under this purpose, and community order is maintained accordingly;
• Customer support: your enquiries, complaints, appeals and report tickets are answered under this purpose;
• Legal compliance: obligations set by applicable law and regulatory requirements are discharged here, and investigations conducted according to law are cooperated with.

Should information ever need to be used in a new scenario beyond these five purposes, your separate consent will be sought beforehand.

4. Who else receives your information

Your personal information is never sold by us, never rented out, and never traded in any other form. To keep app features working, Crushtape integrates third-party SDKs / services, among them AppsFlyer (installation source attribution), Branch (deep links and referral tracking), Firebase Remote Config (feature configuration delivery and staged rollout), Amplitude (product behaviour analytics) and Google AdMob (advertising display); analytics tools and messaging push services also fall within that scope. Advertising, analytics and push — these three categories of processing — are all carried out through the third-party SDKs / services named above. Each partner handles information only to the extent its own function requires, and each is bound by its own privacy policy.

Your information is disclosed outside our organisation only in the circumstances below:

• you have separately consented to that sharing or given express authorisation;
• information within the minimum range necessary is delivered to entrusted partners so that payment, push and analytics can function, and those partners must assume equivalent confidentiality duties;
• a court, judicial body or regulator issues a compulsory disclosure requirement under law;
• sharing is genuinely necessary to protect the personal safety of users, the security of the platform, or an important public interest;
• a merger, acquisition, reorganisation or transfer of assets takes place, in which case information moves with the relevant business and the recipient must continue applying protections no weaker than those in this policy.

5. How we safeguard the information

Safeguarding happens at four points:

• In transit — TLS/SSL encryption is enabled across the entire path, leaving as little room as possible for interception or tampering along the way;
• At rest — sensitive fields in stored data are uniformly encrypted with the AES-256 algorithm, with keys held separately rather than mixed in with business data;
• On access — permissions are assigned by role (RBAC), so the data any team member may read is confined to the minimum needed for that person's own work;
• In audit — every data read leaves a log, logs are sampled on a regular schedule, and abnormal access raises an alert immediately.

Beyond those four points, a security assessment and a penetration test are each conducted at least once a year; personal information protection training is held for all team members on a regular basis; and a dedicated contingency plan exists for data security incidents, so that an anomaly can quickly be located, contained and reported. Retention follows one rule: information is kept only for as long as achieving the service purpose genuinely requires. Once that period expires, or once the law no longer requires retention, the information is deleted, anonymised or de-identified.

6. What you may require of us

Five rights may be exercised at any time under law, through the in-app settings entry or by writing to our support mailbox:

• Access — your account profile and the processing records associated with it can be retrieved and checked at any time;
• Correction — where a record is inaccurate or incomplete, you may ask us to correct or supplement it;
• Erasure — you may ask us to erase your personal information, or start a deletion through the Crushtape account deletion portal;
• Withdrawal of consent — consent previously given for a particular processing activity can be withdrawn at any time, without affecting processing already completed;
• Obtaining a copy — a copy of your personal information in a structured format will be provided on request.

Beyond these five, enquiries, objections and complaints concerning personal information processing are equally welcome. Once identity verification is complete, we will reply within a reasonable period.

7. Why minors are outside our scope

Crushtape is a social and content-sharing platform for adults, and minors fall outside its scope. Age verification sits inside the registration flow, where date of birth is a required field and any entry below the age of 18 fails validation. Should information belonging to a minor nevertheless enter our systems — through a false age entry, a fraudulent registration, or some other cause we did not anticipate — the information will be removed once the matter is confirmed, and the account concerned will be stopped from further use of this app. The complete mechanism governing child safety is set out in the Crushtape Child Safety Standards.

8. When this policy changes

Adjustments to product features, changes in the service model, or new requirements arising from law and regulation will bring corresponding revisions to this policy. A new version is published in the in-app notice area or on the official website, and the date at the top is refreshed at the same time. Where a revision touches rights that matter to you, we will tell you before it takes effect by pop-up, in-app notice or another sufficiently prominent means; where genuinely necessary, your consent will be sought again.

9. How to reach us

Questions, opinions or complaints about this policy, the way we process personal information, or the exercise of your rights may be raised through the channels below, and we will reply within a reasonable period: