Privacy Policy
Last updated: 4 October 2026
In short: we keep what is needed to run your stories: the settings you choose, your messages and the story so far. If you sign in, we also keep your email. We don't sell your data and we don't use advertising or analytics trackers. Your messages go to our AI provider so it can write the replies. You can delete your account and stories at any time.
1. Who is responsible
The controller of your personal data is Sirtemed LTD, Lordou Vyronos 61, Lumiel Building, 4th floor, 6023 Larnaca, Cyprus, company registration number HE 368447 ("we", "us"). You can reach us through the contact form, or by email at hello@crushly.com.
2. What we collect and why
| What | Why | Legal basis (GDPR) |
|---|---|---|
| Player id: a random id your browser creates and keeps in its local storage | To recognise your stories when you come back | Contract, Art. 6(1)(b) |
| Story data: the name you play under, your gender, who you're into, heat level, language and character, your messages, the story text, the characters you've met, what was shown to you, your plan and message counts | To write and continue your story, and to apply your plan | Contract, Art. 6(1)(b); for sensitive data, your explicit consent, Art. 9(2)(a) (see section 3) |
| Account (only if you sign in): your email address, when you signed in, your sign-in sessions and your plan. Sign-in codes and session tokens are stored only as one-way hashes. | To let you sign in with a code and keep your progress on every device | Contract, Art. 6(1)(b) |
| Usage statistics per story: the story version and settings, the number and length of your messages, timings, chapters reached, pictures shown or opened, and the running cost. These statistics do not contain the text of your messages. | To find out which stories work and to improve them | Legitimate interest, Art. 6(1)(f) |
| Security data: your IP address, used in counters that limit how many sign-in codes, new stories and feedback messages one network can send; the Cloudflare Turnstile bot check, which looks at browser and device signals | To stop abuse, bots and fraud | Legitimate interest, Art. 6(1)(f) |
| Feedback you send: your message, the email you give (optional), your player and story id, the page, language and browser | To answer you and fix what you report | Legitimate interest, Art. 6(1)(f) |
| Technical logs: errors and request details kept by our host | To keep the service running and fix problems | Legitimate interest, Art. 6(1)(f) |
We don't ask for your real name, and we don't collect payment card details. When paid plans open, payments will be handled by a payment provider, and this policy will name it.
3. Sensitive information
Who you're into and what you write in a story can reveal your sexual orientation or sex life. Under the GDPR this is a special category of data. We process it only to run your stories, and only with the explicit consent you give before you start ("By continuing you agree…"). You can withdraw that consent at any time by deleting your account, or by asking us to delete your data. Stories can't be played without it.
4. Who else processes your data
We use these providers. Each one acts on our instructions under its own data-processing terms:
- Cloudflare, Inc. hosts the site and stores the data (Workers, Durable Objects, D1, R2). It also runs the Turnstile bot check, sends sign-in codes to your email address, sends us notifications (such as the feedback you send), and keeps technical logs.
- xAI (Grok API) writes the story replies. With each message it receives your story settings, the recent conversation and the story's memory. It does not receive your email.
These providers are based in the United States. Transfers rely on the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses, as each provider offers. We don't sell your data or share it for advertising.
5. How long we keep it
- Stories and account: as long as your account (or, without an account, your player id) exists. When you delete your account in the app, its stories, characters, plan and sign-in sessions are deleted straight away.
- Without an account: your stories are tied to the player id in your browser. If you clear your browser data, you lose access to them. To have them deleted, send us a request from the same browser through the contact form, which includes your player id.
- Statistics: when you delete your account, they are separated from you and kept only in anonymous form.
- Sign-in codes expire after 10 minutes. Sessions expire after 180 days. IP counters are deleted after about a day.
- Feedback is kept as long as we need it to handle your message and improve the service. If you delete your account, your email is removed from it.
6. Your rights
You have the right to access your data, to correct it, to have it deleted, to restrict or object to its processing, to receive it in a portable form, and to withdraw consent at any time. Contact us through the contact form. You can also complain to a supervisory authority: in Cyprus, the Commissioner for Personal Data Protection (Iasonos 1, 1082 Nicosia, dataprotection.gov.cy), or the authority in the country where you live.
7. Cookies and browser storage
- One cookie,
crushly_session, set only when you sign in. It keeps you signed in (up to 180 days) and is strictly necessary. - Local storage in your browser keeps your player id, your age confirmation, your story settings and which story you're in.
- Cloudflare Turnstile may run a short check in your browser to tell people from bots.
There are no advertising, analytics or social media trackers, so there is nothing to consent to beyond this.
8. Adults only
Crushly is only for people aged 18 or older. We don't knowingly collect data from anyone younger. If we find out that a minor has used the service, we delete their data.
9. Changes
If we change this policy, we'll update the date at the top. If the change is important, we'll also tell you in the app.