Privacy Policy
Last updated 25 September 2026
Crush is run by Thinking Fish Ltd (United Kingdom), the controller of your personal information. Questions or requests: support@crushdating.app, or in the app under Settings, Privacy & data.
What we collect and why
| Information | Why |
|---|---|
| Phone number | To sign you in with a one-time code. It is kept only in our sign-in system; our other records hold a one-way code and the last four digits. |
| Date of birth | Crush is for adults 18+. If you're under 18 we close the account straight away. |
| Photos and your verification selfie | Your profile. Photos are taken in the app's camera and checked against your selfie. |
| Face scan (biometric) | To confirm you're a real person, 18 or older, and that every photo is you. See "Face verification" below. |
| Approximate location | To show people near you. We store only an area about 1 km across, never your exact position, and show others a rounded distance. |
| Position, who you want to meet, what you're looking for | To match you. This is special-category data (sex life and sexuality) and is never shown on your profile. |
| Matches, messages and chat photos | To deliver your conversations. |
| Reports and blocks | To keep members safe. |
| Device push token | To send the notifications you've switched on. |
Legal bases
We process information about your sex life and sexuality, and your face scan, only with your explicit consent, which you give on the "Your privacy" screen when you join (UK GDPR Article 9(2)(a)). Everything else is processed to provide the service you asked for, to keep members safe, and to meet legal obligations. Product analytics and news and offers are optional, off by default and only used if you switch them on.
Face verification
Your selfie becomes your first profile photo. We also turn it into a private face scan (a set of measurements, not a photo) to confirm you're real and 18 or older, and to check that every photo you take is you. The scan is never shown, sold or shared. We do not keep a collection of face templates, and we delete face data within 30 days of your account closing.
The live face check runs on Amazon Web Services in Ireland (the service isn't offered in London); everything else is stored in London.
A person reviews every profile
Every new profile is approved or declined by a member of our team, not by an automated system. If we decline yours you can ask for a second review within 7 days, which goes to a different reviewer.
Who sees what
Other members see your first name, age (unless you hide it), photos, a rounded distance and your area. They never see your phone number, date of birth, exact location, position, preferences or what you're looking for. Our staff see only what they need for their role, and every staff action is recorded in an audit log.
We use Amazon Web Services (hosting, storage, face checks, text messages) as our processor. We don't sell your information or share it for advertising, and Crush contains no advertising or tracking code.
How long we keep it
- Your account: until you delete it. Deleting in the app removes your profile, photos, likes, matches, blocks and sign-in immediately; backup copies age out within 30 days.
- Face data: deleted within 30 days of your account closing.
- Waiting list: your number is kept only to text you once at launch, and deleted after 12 months at most.
- Reports and consent records: kept as evidence when an account is deleted, where the law requires or allows it.
- Staff audit log: 6 years.
Your rights
You can access and download your data, correct it, withdraw consent, limit how we use sensitive information, and delete your account at any time — all from Settings, Privacy & data in the app. Withdrawing a required consent closes your account. We respond to requests within 30 days (45 days for US residents). You can also complain to the UK Information Commissioner's Office (ico.org.uk).
Notice for US residents
We don't sell or share your personal information for cross-context advertising. Depending on your state (including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and others) you can ask to know, access, correct or delete your data, and limit how we use sensitive information. Face data is handled as described under "Face verification" above; Washington residents' consumer health data policy and our biometric data policy are being finalised with counsel before Crush opens in the US.
Changes
If we change how we use your information we'll tell you in the app, and ask again where consent is needed.