Legal

Privacy Policy

        Your privacy matters. Cribfull is designed with privacy at its core — including Ghost Mode, Face ID lock, end-to-end encrypted direct messages, and in-app controls for data access and deletion. This policy explains what data we collect, why we collect it, and how you control it.
      

1. Who We Are

Cribfull ("we," "our," or "us") is a mobile application for discovering and attending nightlife and social events, available on iOS. Privacy contact: privacy@cribfull.com.

2. Information We Collect

2.1 Information You Provide

Account information: Name, email address or phone number, username, and date of birth (verified through our age gate at sign-up). Profile photo is optional and can be added during or after sign-up.
Event data: Information about events you create, including title, description, location, date, and attendee settings.
Communications: Support requests you send us.
Payment information: When you tip a host, payment is processed by our third-party payment provider. We do not store your full card details.

2.2 Information Collected Automatically

Location data: With your permission, we collect your location to show nearby events and enable geofence check-ins (150 m radius). You can disable this in device Settings.
Device information: Device type, OS version, unique identifiers, and crash reports.
Usage data: Features you use, events you view or RSVP to — used to improve the experience.
Log data: IP address, timestamps, and activity logs for security and debugging.

2.3 Ghost Mode

When Ghost Mode is enabled, your profile is hidden from other users while browsing. Ghost Mode affects your visibility to other users, not data collection by Cribfull.

2.4 End-to-End Encrypted Direct Messages

        Direct messages between users are protected by end-to-end encryption using Curve25519 key agreement and ChaCha20-Poly1305 (ChaChaPoly) authenticated encryption via Apple's CryptoKit framework. Cribfull's servers store only opaque ciphertext. We cannot read, access, or decrypt your messages under any circumstances. Encryption keys are generated on-device and stored in iCloud Keychain. Only you and your recipient can decrypt your messages.
      

If you choose to report a message using the in-app Report tool, you explicitly consent to sharing the decrypted content of that specific message with our moderation team. We will never read messages you have not explicitly reported.

2.5 Block Lists

When you block a user, we store that relationship server-side to enforce the block across all your devices. Blocked user IDs are synced with your account.

3. How We Use Your Information

To provide and operate the Cribfull app and its features
To enable event discovery, RSVP, and check-in functionality
To generate and deliver Apple Wallet passes
To process host tips via our payment provider
To send you notifications about events you've RSVPed to (with your consent)
To enforce user blocks and protect users from unwanted contact
To review moderation reports submitted with user consent
To detect and prevent fraud, abuse, and violations of our Community Guidelines
To improve app performance, fix bugs, and develop new features
To comply with legal obligations

4. Sharing Your Information

We do not sell your personal information. We may share your data with:

Apple Inc.: For Wallet passes, Face ID authentication, iCloud Keychain sync, and App Store operations.
Payment processors: For processing host tips (PCI-DSS compliant).
Analytics providers: Aggregate, anonymized usage data only.
Cloud infrastructure: Servers and storage used to operate Cribfull.
Legal authorities: When required by law, court order, or to protect user safety.
Business transfers: In the event of a merger or acquisition, with prior notice to users.

5. Location Data

Used to show events near you and enable geofence check-ins (150 m radius)
Only accessed when the app is in use ("While Using the App") — no background location
You can revoke location permission at any time in iPhone Settings → Privacy & Security → Location Services

6. Data Retention

We retain your data for as long as your account is active. If you delete your account, personal data is deleted within 30 days, except transaction records retained for legal compliance (up to 7 years).

7. Your Rights

Depending on your location, you may have the following rights:

Access: Request a copy of the data we hold about you — directly in the app via Profile → Privacy → Request My Data.
Correction: Edit your profile directly in the app at any time.
Deletion: Delete your account and personal data — directly in the app via Profile → Privacy → Delete Account.
Portability: Receive your data in a portable format (included in data export).
Objection / Withdrawal: Revoke location and notification consent via device Settings.

You can also email privacy@cribfull.com or visit our Data & Privacy Center.

8. Children's Privacy

Cribfull is intended for users 13 years of age or older. We verify age at sign-up via a date-of-birth entry. We do not knowingly collect personal data from individuals under 13. If you believe a child under 13 has created an account, contact privacy@cribfull.com.

9. Security

We implement industry-standard security measures including TLS encryption in transit, secure storage, access controls, and end-to-end encryption for all direct messages. Face ID is handled entirely by Apple's Secure Enclave — Cribfull never receives your biometric data. No system is completely secure; please use a strong password and keep your device locked.

10. Third-Party Services

Cribfull may integrate with third-party services (e.g., Apple Maps). These services have their own privacy policies and we are not responsible for their practices.

11. Changes to This Policy

We will notify you of significant changes through the app or by email. The "Last updated" date at the top always reflects the most recent version.

12. Contact Us

Privacy: privacy@cribfull.com
Support: support@cribfull.com
In-app: Profile → Privacy → Request My Data
Data Center: Data & Privacy Center