日本語

Not sold. Not handed out. You choose who sees what.

Every follow needs your approval, and you choose who can see your posts and who can message you. Email addresses and message text are stored encrypted. This page describes only what is actually running today.

Three people talking outdoors

You decide, in Settings.

CrowOn’s “Settings & privacy” screen

Privacy settings, in one place.

“Settings & privacy” gathers close friends, blocking, location, messages, tag approvals and hidden words.

Open setting
The “Privacy & audience” screen

Choose who, item by item.

“Who can see your posts”, “Who can DM you”, “Who can call you” and “Who can add you to groups” are each set on their own. Messages from people you don’t follow go to message requests, and calls from anyone you haven’t allowed don’t ring.

Open setting
The “Messages & streaks” screen

Unsent means gone from the server too.

Text you unsend, and disappearing messages that run out (24 hours or 7 days), are deleted from CrowOn’s servers. Notification preview is set to “Name only” by default.

Open setting
The “Content & recommendations” screen

What recommendations use, in the open.

Posts you saw and how you reacted are kept on the server for 90 days. “Use device context for recommendations” (on by default) uses time of day, battery, connection, sound and scroll speed. That isn’t stored, only held in memory for up to 30 minutes, and turning it off erases what was learned.

Open setting

Nothing handed to outside companies.

Three friends walking by railway tracks

Not sold, not shared

CrowOn doesn’t sell personal information or share it for cross-site behavioural advertising.

What leaves CrowOn
Payments
On Stripe’s page. Card numbers never reach CrowOn
Push notifications
Through your browser or device maker’s service
Google / Apple sign-in
Talks to that company
Anything else
Nothing. No analytics or ad scripts either

Three exceptions

Payments happen on Stripe’s page, so card numbers never reach CrowOn. Push notifications travel through your browser or device maker’s service. Signing in with Google or Apple talks to that company.

How it’s stored.

A person looking out of a window

The key is kept somewhere else.

Someone who walks off with the database file or a backup still can’t read email addresses or message text. The key that unlocks them lives outside the data.

What actually gets written to the database
Email address
aoi@example.come1:flzjDbqlmfFACbPP0Uyl1ghpNeOAQx8tKC/p/Dhp0s4GmaVfF0aW+g+i+A==
Birthday
2009-04-18e1:Esty9/mj9LFFqtChUApugjlm/c8yBiU+s4GCp4HE/zCkevC4ivU=

Real output of the encryption code, made with a throwaway key.

Encryption at rest

Email addresses, birthdays, legal names, ID photos and message text are encrypted with AES-256-GCM before they’re written. The key lives outside the data. Looking someone up by email uses a keyed hash.

How long things are kept
Access log
90 days
Attack log (failed sign-ins and similar)
30 days
Reactions used for recommendations
90 days
Device context (battery, connection…)
Not stored
ID documents for age checks
Until decided
Under-13 lock
Device 180 days · traits + IP 30 days
Backups of deleted accounts
Normally within 90 days

How long things are kept

The access log is deleted after 90 days and the attack log after 30. ID documents are deleted once a decision is made, and the under-13 lock uses keyed hashes only, never a name or birthday.

The “Account & login” screen

Download it. Delete it. Yourself.

“Download your data” gives you your account details, settings, chats, posts, photos and videos in one file. “Delete account” starts deleting right away; backup copies normally go within 90 days.

Open setting

What isn’t done yet.

A person laughing by a window

What isn’t done yet.

When these change, this page changes too.

What isn’t done yet.
  1. It isn’t end-to-end encrypted. The running server decrypts as it reads, so CrowOn’s systems can handle message content. Staff only look at it in the cases in section 7 of the Privacy Policy.
  2. Photo and voice files in messages are not yet deleted from the server when unsent or expired.
  3. “View once” stops the other person’s app opening it twice. It isn’t deleted from the server yet.
  4. Text of messages unsent before November 6, 2026 may still be on the server.
  5. Photo, video and voice files in posts and messages aren’t covered by encryption at rest.

Exactly where things stand.

We never describe something as working when it isn’t. When anything here changes, this page changes too.

The formal text is the Privacy Policy.

This page explains. What CrowOn commits to is written in the Privacy Policy.