Privacy Policy

Last updated: 19 October 2026

This policy explains what we collect, why we are allowed to, how long we keep it, and what you can make us do about it. It is written to be read rather than survived.

1. Who is responsible

The data controller is QUESTICK LTD (registration no. HE 499784), Voukourestiou 25, Neptune House, 1st Floor, Office 11, Zakaki, 3045 Limassol, Cyprus, trading as CrushNights. To exercise any right below, or if you are unhappy with how we have handled your data, write to privacy@crushnights.com.

2. What we collect

• Account data — your email address, held by our authentication provider, and your age confirmation with the time and IP address it came from.
• Conversations — the messages you exchange with a companion, any photo you choose to send, and the facts and memories she keeps so she can remember you.
• Payment records — what you bought, when, and for how much. Card details are handled entirely by our payment processor; we never see or store them.
• Technical data — IP address, browser, timezone, and notification endpoints if you turn on push.
• Error diagnostics — an exception, stack trace, broad route shape and runtime details when the service breaks. We configure this to exclude names, email addresses, cookies, headers, query strings, request and response bodies, chat text and Sentry session replays.
• Optional analytics and masked replay — after you accept, a pseudonymous browser identifier, broad page category and a small set of product actions such as starting a checkout or sending a message. We also collect a masked reconstruction of page structure, navigation, clicks, pointer movement and scrolling. All visible text and form values are masked; images, video, audio, canvas and embedded frames are blocked; and we do not capture console logs, network requests, camera, microphone, voice messages, chat text, photos or private media.
• Google Analytics (optional) — after you accept, Google Analytics receives the broad page category, the site or campaign that sent you here, device and browser details, an approximate location derived from your IP address, and the fact that you signed up or added funds (with the amount). Google advertising features and ad personalisation are switched off.
• Where you came from — with analytics consent, when you sign up we store on your account the page you first landed on, the domain of the site that sent you, and any campaign (UTM) tags in that first link, to measure which sources bring customers.

3. The sensitive part, stated plainly

Conversations here are romantic and may be sexual. Under the GDPR, information about a person's sex life or sexual preferences is “special category” data and gets stronger protection than ordinary personal data. We treat your conversations, and the preferences a companion remembers, as exactly that.

Memory is on by default, and you can switch it off at any time under Privacy in your account. So that you know exactly what that means: while it is on, your companion keeps track of what you tell her — your name, what you like, things you have talked about — so she can bring them up later.

Switching it off deletes what she already remembered, not just what she would remember next. She will still talk to you; she simply starts fresh each time. You can switch it back on whenever you want.

Our staff can read conversations. A small number of authorised staff review chats, including messages and photos, to moderate content, keep the service safe and legal, improve how companions reply, and handle reports and complaints. They see these conversations only for those purposes and are bound to keep them confidential.

4. Why we are allowed to hold each thing

• To provide the service — performance of our contract with you.
• Conversations and memory — performance of our contract with you, so she can be the companion you came for. Memory is a setting you control; see above.
• Age confirmation, AI disclosures, crisis referrals — legal obligations we are under.
• Checking uploaded images for illegal content — a legal obligation, and the substantial public interest in protecting children.
• Payment and accounting records — our contract, and company law.
• Optional analytics and masked replay — in the EU, EEA, UK and Switzerland, your consent, given on this page and refusable without consequence; elsewhere, our legitimate interest in knowing which pages work, with the notice shown on your first visit and a one-click opt-out below.
• Error diagnostics — our legitimate interest in keeping the service reliable and secure. The deliberately limited diagnostic record is not used for marketing.

5. Who else sees it

We do not sell your personal data, we do not share it for advertising, and we do not use your conversations to train anyone else's models. We do use service providers who process data on our behalf and under contract: an authentication provider, AI model providers who generate a companion's replies and screen uploaded images, a voice provider, a video-avatar provider, object storage, hosting, a payment processor, Sentry for limited error diagnostics, and PostHog and Google Analytics for analytics and masked session replay only after you accept.

Some are outside the European Economic Area. Where that is so, the transfer is made under an approved safeguard such as the European Commission's Standard Contractual Clauses. Ask us and we will tell you which providers we use and on what basis.

6. Photos

You cannot send photos in chat. Any photo you sent before this was switched off stays visible only to you, inside your own conversation, until you delete it or it expires under the periods below. A message refused under our content rules is not stored.

7. Video and camera

If you share your camera on a video call, that stream is used for the live call only and is not recorded or stored by us. Sharing is optional and asked for each time.

8. How long we keep it

• Conversations, messages and photos — 24 months after you last use the chat.
• Remembered facts and memories — deleted with the conversation they came from.
• Safety findings (fingerprint only, never an image) — up to 5 years.
• Payment and accounting records — 6 years, as company law requires.
• Error diagnostics — up to 30 days.
• Optional analytics events — up to 12 months (14 months in Google Analytics).
• Masked session replays — up to 30 days.

These limits are enforced automatically, not by hand.

9. Your rights

• Get a copy of everything we hold — download it from your account as a machine-readable file.
• Delete your account — this destroys your conversations, messages, photos, remembered facts, memories and entitlements.
• Switch off memory, which also deletes what she already remembered.
• Correct anything inaccurate, or ask us to restrict or object to processing.
• Complain to a data protection authority — for us that is the Office of the Commissioner for Personal Data Protection in Cyprus, or the authority where you live.

What survives a deletion, and why. We keep your payment and accounting records, because company law requires it and the GDPR permits us to keep what we must. We also keep the record that you confirmed your age, and the record of what you consented to — those exist to prove we met obligations and are not ours to erase. Everything else goes, and we tell you exactly what was destroyed.

10. Cookies

Some cookies we cannot do without: signing you in, remembering your 18+ confirmation, and remembering your analytics choice itself. Those are set without asking, because the site does not work otherwise.

Optional cookies — analytics and masked session replay — work differently depending on where you are. In the EU, EEA, UK and Switzerland they are off unless you switch them on below, and nothing is sent before you do. Everywhere else they are on from your first visit, as the notice when you enter the site says, and you can switch them off below at any time.

If you arrive through a partner's referral link and optional storage is on for you, we set one more cookie, cn_ref, holding that partner's code and nothing else, for 30 days, so they can be credited if you sign up. We also count the visit, using a one-way keyed hash of your IP address and browser type rather than either one itself. See the affiliate terms.

You can change that choice for this device at any time:

11. Security

Your photos and a companion's private media are never served from public links; every request is authorised individually. Traffic is encrypted in transit, access to systems is restricted, and we keep backups.

12. Children

CrushNights is strictly for adults and we do not knowingly collect data from anyone under 18. If you believe a minor has an account, tell us at privacy@crushnights.com and we will close it and delete the data.

13. Changes

If we change how we use your data we will update this page, and where the change is material we will ask again rather than assume.