Privacy Policy

Last updated: 31 July 2026

This policy explains what we collect, why we are allowed to, how long we keep it, and what you can make us do about it. It is written to be read rather than survived.

1. Who is responsible

The data controller is [Company name, registration number, registered address], trading as CrushNights. To exercise any right below, or if you are unhappy with how we have handled your data, write to [email protected].

2. What we collect

• Account data — your email address, held by our authentication provider, and your age confirmation with the time and IP address it came from.
• Conversations — the messages you exchange with a companion, any photo you choose to send, and the facts and memories she keeps so she can remember you.
• Payment records — what you bought, when, and for how much. Card details are handled entirely by our payment processor; we never see or store them.
• Technical data — IP address, browser, timezone, and notification endpoints if you turn on push.
• Error diagnostics — an exception, stack trace, broad route shape and runtime details when the service breaks. We configure this to exclude names, email addresses, cookies, headers, query strings, request and response bodies, chat text and Sentry session replays.
• Optional analytics and masked replay — after you accept, a pseudonymous browser identifier, broad page category and a small set of product actions such as starting a checkout or sending a message. We also collect a masked reconstruction of page structure, navigation, clicks, pointer movement and scrolling. All visible text and form values are masked; images, video, audio, canvas and embedded frames are blocked; and we do not capture console logs, network requests, camera, microphone, voice messages, chat text, photos or private media.

3. The sensitive part, stated plainly

Conversations here are romantic and may be sexual. Under the GDPR, information about a person's sex life or sexual preferences is “special category” data and gets stronger protection than ordinary personal data. We treat your conversations, and the preferences a companion remembers, as exactly that.

Memory is on by default, and you can switch it off at any time under Privacy in your account. So that you know exactly what that means: while it is on, your companion keeps track of what you tell her — your name, what you like, things you have talked about — so she can bring them up later.

Switching it off deletes what she already remembered, not just what she would remember next. She will still talk to you; she simply starts fresh each time. You can switch it back on whenever you want.

4. Why we are allowed to hold each thing

• To provide the service — performance of our contract with you.
• Conversations and memory — performance of our contract with you, so she can be the companion you came for. Memory is a setting you control; see above.
• Age confirmation, AI disclosures, crisis referrals — legal obligations we are under.
• Checking uploaded images for illegal content — a legal obligation, and the substantial public interest in protecting children.
• Payment and accounting records — our contract, and company law.
• Optional analytics and masked replay — your consent, given through the cookie banner and refusable without consequence.
• Error diagnostics — our legitimate interest in keeping the service reliable and secure. The deliberately limited diagnostic record is not used for marketing.

5. Who else sees it

We do not sell your personal data, we do not share it for advertising, and we do not use your conversations to train anyone else's models. We do use service providers who process data on our behalf and under contract: an authentication provider, AI model providers who generate a companion's replies and screen uploaded images, a voice provider, a video-avatar provider, object storage, hosting, a payment processor, Sentry for limited error diagnostics, and PostHog for analytics and masked session replay only after you accept.

Some are outside the European Economic Area. Where that is so, the transfer is made under an approved safeguard such as the European Commission's Standard Contractual Clauses. Ask us and we will tell you which providers we use and on what basis.

6. Photos you send

Any photo you send in chat is checked by an automated safety classifier before it is stored. If it is refused, the image is not kept — we record only a one-way fingerprint so the same file cannot be sent again. Where a check indicates possible child sexual abuse material we are obliged to act, and we will, including reporting it where the law requires.

7. Video and camera

If you share your camera on a video call, that stream is used for the live call only and is not recorded or stored by us. Sharing is optional and asked for each time.

8. How long we keep it

• Conversations, messages and photos — 24 months after you last use the chat.
• Remembered facts and memories — deleted with the conversation they came from.
• Safety findings (fingerprint only, never an image) — up to 5 years.
• Payment and accounting records — 6 years, as company law requires.
• Error diagnostics — up to 30 days.
• Optional analytics events — up to 12 months.
• Masked session replays — up to 30 days.

These limits are enforced automatically, not by hand.

9. Your rights

• Get a copy of everything we hold — download it from your account as a machine-readable file.
• Delete your account — this destroys your conversations, messages, photos, remembered facts, memories and entitlements.
• Switch off memory, which also deletes what she already remembered.
• Correct anything inaccurate, or ask us to restrict or object to processing.
• Complain to a data protection authority — for us that is the Office of the Commissioner for Personal Data Protection in Cyprus, or the authority where you live.

What survives a deletion, and why. We keep your payment and accounting records, because company law requires it and the GDPR permits us to keep what we must. We also keep the record that you confirmed your age, and the record of what you consented to — those exist to prove we met obligations and are not ours to erase. Everything else goes, and we tell you exactly what was destroyed.

10. Cookies

Some cookies we cannot do without: signing you in, remembering your 18+ confirmation, and remembering your answer to the cookie banner itself. Those are set without asking, because the site does not work otherwise.

Anything optional — analytics and masked session replay — is stored only if you accept, and nothing is sent before you do. Refusing is one click, in the same place and the same size as accepting.

You can change that choice for this device at any time:

11. Security

Your photos and a companion's private media are never served from public links; every request is authorised individually. Traffic is encrypted in transit, access to systems is restricted, and we keep backups.

12. Children

CrushNights is strictly for adults and we do not knowingly collect data from anyone under 18. If you believe a minor has an account, tell us at [email protected] and we will close it and delete the data.

13. Changes

If we change how we use your data we will update this page, and where the change is material we will ask again rather than assume.