Privacy Policy | CRÜ

1. Who this policy applies to

CRÜ is an Australian queer social app operated by CRUSPACE PTY LTD. This Privacy Policy applies to CRÜ's website, mobile app, community features, messaging, Happenings, organiser tools, support channels and related services (the Service).

This policy explains how we handle information. Our Terms govern use of the Service, our Community Guidelines & Safety Rules set enforceable behaviour standards, and our Community Principles describe the culture we are trying to build.

2. Information we collect

We collect information that is reasonably needed to provide, secure, moderate and improve CRÜ. The information collected depends on what you use and what you choose to provide.

• Account and authentication information, such as email address, username, account identifiers and sign-in records.
• Profile information you choose to provide, such as display name, profile photo, bio, prompts, interests, connection context and optional identity or community context.
• Content and interactions, including posts, comments, photos, messages, chat activity, saves, follows, replies, reactions, soft responses and other actions within the Service.
• Safety, moderation and support information, including reports, blocks, support messages, enforcement records and information you provide when asking us for help.
• Happening and organiser information, including listing details, organiser details, links, images, accessibility or safety context, broad location information, saves and private interest signals where available.
• Technical and security information, such as device, browser, app environment, IP address, request metadata, request IDs, security signals and rate-limit information.
• Analytics and reliability information, which may include an anonymous browser identifier, session identifier, page path and query, referrer, campaign parameters, event metadata, app/build information, error information and performance diagnostics.
• Push-notification information where notifications are enabled, such as a random installation identifier, push-provider token, platform, app/build environment, permission state and delivery ticket or receipt information.

3. Sensitive and private relevance information

CRÜ is built for queer community connection. Information a member chooses to share may include sensitive context such as sexuality, gender identity, pronouns, relationship context, community belonging, safety needs, accessibility needs, event interests or social comfort.

Where the product offers separate visibility choices, information can be shown on a profile, kept private while helping relevance, or excluded from relevance. Private relevance preferences and internal trust, moderation or safety signals are not intended to be public profile information.

CRÜ does not require members to publicly define their identity in order to belong. Optional identity detail should be used as context rather than as a public score or a hard identity category.

4. How we use information

• Create, authenticate and manage accounts.
• Operate profiles, feeds, forums, posts, comments, messaging, Happenings and other product features.
• Order and personalise relevant content, people, conversations or Happenings using profile context, private preferences, activity, broad location context and safety signals where appropriate.
• Provide reporting, blocking, moderation, abuse prevention and platform-integrity controls.
• Send service or push notifications that a member is eligible to receive and has permitted on their device.
• Measure product usage, diagnose errors, improve reliability, security, accessibility and performance, and understand whether features are working as intended.
• Respond to support, privacy, account-access, account-deletion and Happening concerns.
• Comply with legal obligations and establish, exercise or defend legal rights where necessary.

5. Relevance and automated systems

CRÜ may use automated systems to organise, rank, filter, recommend, protect or limit parts of the Service. Relevance can use information such as profile context, private preferences, activity, broad location context and safety or integrity signals.

These systems do not create a public popularity score, and CRÜ does not guarantee any particular reach, recommendation, reply or outcome. Automated systems may also flag suspicious or potentially harmful activity for restriction or human review.

6. Content, visibility and messages

Content you choose to publish may be visible to other members according to the product surface and your settings. Private preferences, internal analytics and trust or moderation signals are not intended to be shown to other members.

CRÜ does not read private messages as a matter of course. We may access or review messages, content, reports or account activity where reasonably necessary to investigate a report, enforce our Terms or Rules, protect users or the Service, provide support, prevent abuse or comply with law.

7. Happenings and location

Happenings may use event titles, dates, broad locations, organiser information, event links, access and safety context, images and other listing information. Private save or interest signals are not intended to become public attendee lists unless CRÜ clearly introduces that feature with appropriate notice and controls.

CRÜ's location approach is based on connection feasibility rather than precise tracking. Where possible, the Service uses broad areas, suburbs, regions or member-controlled context. Public surfaces should not expose raw latitude, longitude, geohash or internal location precision.

8. Notifications

If you enable push notifications, CRÜ may register an installation and push-provider token so eligible notifications can be delivered. Notification payloads are designed to carry the routing information needed to open the relevant CRÜ surface rather than unnecessary private content.

You can control notification permission through your device settings. Disabling permission stops future push delivery to that device, although in-app notification records may still exist where the product uses them.

9. Service providers and overseas processing

CRÜ uses service providers to operate the Service. Depending on the feature and environment, these include providers for hosting and deployment, database/authentication/storage, error monitoring, rate limiting, push delivery, maps/place information and support or email operations.

Current infrastructure may include Supabase, Vercel, Sentry where enabled, Upstash, Expo and mobile-platform push services, and Google Maps Platform or Places for relevant location features. These providers process information for the services they provide to CRÜ and are also subject to their own terms and privacy practices.

Some providers may process information outside Australia. We select providers with regard to security and operational requirements and take reasonable steps appropriate to the Service and the information involved.

10. Security

We take reasonable technical and organisational steps to protect information, including access controls, encryption in transit where appropriate, authenticated service boundaries, rate limiting, logging and separation between public/member-visible data and private operational data.

No internet service can guarantee absolute security. If we become aware of a security issue, we will assess and respond to it according to the circumstances and applicable obligations.

11. Retention

Retention depends on the type of information and why it is needed. We keep information for no longer than reasonably necessary for service operation, safety, moderation, abuse prevention, security, support, dispute handling, audit integrity and applicable legal obligations.

• Technical and reliability logs may be retained for troubleshooting, security and incident analysis.
• Reports, moderation and abuse-prevention records may be retained longer where needed to identify repeated harm, preserve evidence or protect users.
• Messages may be retained for recipient conversation continuity, safety review, abuse handling or legal reasons.
• Happening and organiser records may be retained where needed for listing integrity, safety, dispute handling or audit purposes.

12. Account deletion

You can request account deletion through CRÜ where the in-app deletion control is available. If you cannot access your account, you can also initiate a deletion request by emailing support@cruspace.com.au with the subject “CRÜ account deletion request”. We may need to verify that the request relates to your account.

A 7-day cooling-off period may apply before processing begins, during which cancellation may be available. Once processing begins, CRÜ suppresses account access and clears or hides member-visible profile information as part of the deletion lifecycle.

Account deletion does not necessarily erase every record immediately. Some user-generated content, messages, moderation records, security records, audit references or limited technical records may be retained where reasonably necessary for recipient context, safety, abuse prevention, legal obligations or platform integrity. Retained information should not keep a deleted member's active public profile reachable.

See the Account Deletion page for the current process and important limitations.

13. Your choices and requests

• Update or remove profile information using the controls available in CRÜ.
• Use visibility, relevance and interaction controls where the product makes them available.
• Control push-notification permission through your device settings.
• Request access to or correction of personal information we hold about you, subject to applicable exceptions.
• Request account deletion.
• Contact us with a privacy question or complaint.

We may need to verify identity before actioning an access, correction or deletion request.

14. Third-party links

CRÜ may link to organiser sites, venues, ticketing providers, social platforms or other external services. Those services control their own data handling. Review their privacy information before providing information to them.

15. Changes to this policy

We may update this Privacy Policy as CRÜ changes. The current version takes effect when it is published. If a change materially affects how we handle information, we will take reasonable steps to provide additional notice where appropriate.

16. Contact and complaints

For privacy questions, access or correction requests, account-deletion help or a privacy concern about a Happening, email support@cruspace.com.au with the subject “Privacy request”, or use our Contact page.

If you are not satisfied with our response, you may have a right to raise the matter with an appropriate privacy regulator, including the Office of the Australian Information Commissioner where its jurisdiction applies.