Overview
Crush is a college connection app for current students. The app uses Apple sign-in, .edu verification, profile photos, prompts, one school-local Daily Drop at 8:30 PM, in-app chat, and safety tools. This policy explains what we collect, how we use it, and the choices you have.
Information we collect
- Account and school information, including your app user ID, first name, date of birth and age, school, .edu verification status, student level, graduation year, major, gender, interested-in preferences, intent, Drop preference, and account settings.
- Profile content you provide, including photos, prompts, interests, and other profile details shown only through authorized app experiences.
- Daily Drop and chat activity, including match outcomes, Meet or Pass actions, chat messages, unread counts, and safety actions such as block, report, and unmatch.
- Device and notification data, including APNs tokens, notification preferences, app version, and basic diagnostics used to operate the service.
- Website campus interest, including the school name you request and, if you choose to provide it, your email address.
- Safety and moderation data, including photo safety classifications, the limited primary-photo suitability result described below, text moderation signals, reports, rate-limit events, and admin audit logs.
How we use information
- To authenticate accounts, verify school eligibility, hydrate the app, and operate Daily Drops at each school’s local 8:30 PM reveal time.
- To match students using eligibility, compatibility, activity, prompt, profile, safety, and quality signals while enforcing blocks, reports, cooldowns, and other boundaries.
- To deliver in-app chat, push notifications, foreground banners, and exact routing to Daily or chat threads.
- To understand which campuses are interested in Crush and, if you provide an email, notify you about availability at the school you requested.
- To review photos and user-visible text, enforce rate limits, investigate reports, prevent abuse, and improve reliability.
AI and matching signals
Crush may use private profile, prompt, and activity signals to rank compatible candidates. Profile text can be sent to OpenAI to generate matching tags and a numerical representation of that text. Missing AI signals do not prevent an otherwise eligible student from participating in a Daily Drop.
With your permission, Crush also sends up to three approved profile photos to OpenAI to generate broad activity, setting, and composition tags, such as outdoors or graduation, for matching. Photo analysis runs separately from profile-text analysis. Crush does not use facial features, face geometry, biometric identifiers, attractiveness, or protected or sensitive traits inferred from photos to rank students. The primary-photo suitability check described below is a profile requirement, not a compatibility score.
Permission from an older app version that covered only photo safety and the primary-photo check does not authorize photo-context matching. Those accounts can still participate using non-photo matching signals. Accepting updated permission does not retroactively authorize older photo-derived signals.
Photo review and face data
Before a photo action that requires permission, Crush explains that selected photos are sent to OpenAI for safety, the primary-photo check, and matching based on activities and settings shown. The app asks for agreement before proceeding. If you choose Not now, dismiss the disclosure, or the permission cannot be saved, that action does not proceed.
Photo review identifies potentially unsafe or prohibited image content and, for the primary profile photo, determines whether exactly one person is visible with a clear and unobstructed face. This helps keep photos safe and makes the primary photo useful to other students. The separately permissioned photo-context matching use is described in AI and Matching Signals above.
Crush does not use this review to identify you, recognize you across photos, compare your face with another person, authenticate you, infer protected or sensitive traits, create a face embedding or biometric template, target advertising, perform analytics, or rank compatibility between students.
OpenAI acts as a service provider for these checks and, with matching permission, photo-context analysis. Crush stores the original photo and a private thumbnail in private Supabase Storage. For review, Crush retains the image-safety result and a limited primary-photo decision such as clear face, one person required, or face not clear. Matching tags, the source-photo references, and the permission version used for them are stored separately in the private database. Crush does not retain face geometry, landmarks, a face count, a face embedding, or a biometric identifier.
OpenAI says API content is not used for model training by default. Crush disables Responses API storage for primary-photo checks and matching analysis. OpenAI documents no application-state retention for its Moderation and Embeddings endpoints. Separate abuse-monitoring logs may retain content for up to 30 days, or longer when legally required; suspected child sexual abuse images may be kept for manual review. Storage disabled does not mean zero retention. See OpenAI’s data controls.
Deleting a profile photo removes its original, thumbnail, and review result, and clears the photo-context tags stored on your profile. Any later photo-context refresh uses remaining approved photos and still requires matching permission. Account deletion removes profile photos, their review results, and your stored matching signals. Past Drop and interaction records, and limited non-image safety or audit records, may be retained for service operation, abuse investigations, legal obligations, or user protection. Deleting data from Crush does not override OpenAI’s retention described above.
How we share information
We do not sell personal data. We share data as needed to operate Crush with infrastructure, authentication, storage, notification, email, moderation, and safety providers such as Supabase, Apple, APNs, and OpenAI. OpenAI receives profile text for matching analysis and user-visible text for moderation. It receives selected photos for safety and primary-photo review, and approved photos for photo-context matching when you have given that permission. See Photo Review and Face Data for the boundaries, storage, and retention of photo processing.
Other users can see the profile information and photos that are revealed to them through authorized app surfaces such as Daily Spotlight, match sheets, and chat. Chat participants can see messages in their shared thread.
Notifications
Crush may send notifications for Daily Drops, chat unlocks, and messages if you enable them. Message notification previews do not include message text. You can manage notification preferences in the app and in iOS Settings.
Retention and deletion
We keep account, profile, Drop, chat, and safety records while your account is active and as needed for safety, abuse prevention, auditing, and service operation. Historical poll records submitted before Polls were discontinued may remain until they are deleted under these same practices. You can request deletion from the app where available or by contacting hello@crushso.com. Some operational records may be retained for a limited period where needed to prevent abuse, enforce cooldowns, investigate reports, or comply with legal obligations.
We keep website campus-interest requests while we evaluate or support availability at the requested school. You can ask us to remove your request or email address by contacting hello@crushso.com.
Security
Crush uses authentication, row-level access controls, private storage, signed media URLs, encrypted transport, rate limits, moderation, and audit logging to protect the service. No system can be guaranteed perfectly secure, but we design the app so private school, photo, chat, and notification data are not publicly accessible.
Children
Crush is for current college students who are at least 18 years old. We do not knowingly collect information from minors.
Changes and contact
We may update this policy as Crush changes. The updated date will reflect the latest version. Contact hello@crushso.com with questions, privacy requests, or complaints.