CR3D Privacy Policy

Version 2026-11-02-public3 · Last updated 2 November 2026 · Operated by CR3D STUDIOS LLC, a New York company.

1. Who we are

CR3D (“CR3D”, “we”, “us”) is a mobile app for organising and recording recreational sports games, leagues and communities, with two websites: cr3d.org (news and the early-access list) and cr3d.app (app links, support and this policy). It is operated by CR3D STUDIOS LLC. This policy explains what personal information the app and the websites collect, why, who receives it, and the choices you have. It applies to the CR3D app, to cr3d.app and to cr3d.org.

Privacy questions: privacy@cr3d.org · Mail: CR3D STUDIOS LLC, PO Box 235, Johnson, NY 10933, USA.

2. Age: 13 and older

CR3D is for people 13 and older. When you create an account we ask for your birthday. If you are under 13 we do not create the account. To stop the same person signing up again before they turn 13, we keep a small refusal record: one-way fingerprints (hashes) of the email address that was tried and, if the sign-up used Apple or Google, of that service's account identifier. The app also saves a flag on that phone. The record and the phone flag expire on the date the person turns 13, worked out from the birthday entered. If an account is created through Apple or Google for someone under 13, the account is deleted. We do not knowingly collect any other personal information from children under 13; if we learn we have, we delete it.

If you are 13 to 17, your profile starts with the most private settings available and can't be set to public while you are under 18.

A parent or guardian of a player under 18 can contact us about that player's account at privacy@cr3d.org.

3. What we collect

Information you give us

• Account: your email address and password (the password is stored only in scrambled, hashed form), or your Apple or Google sign-in. Your birthday and, if you choose, your gender. Both are kept private; we use them for the age rules and, later, for divisions.
• Profile: display name, username, bio, a free-text location you type, your time zone, profile photo, favourite sports, availability, your privacy and notification settings, and your level, XP, CR3DITS and Pro status.
• School verification (optional): if you verify your school, you sign in with your school's Google account and the app sends the resulting Google sign-in token to our server, which checks it. We then store your school email address, your campus, when you verified, and when the verification expires (12 months later).
• Games and leagues: games you create or join, scores you submit or confirm, teams, standings and achievements, and the venue for a game: its name, address and map coordinates, as typed or picked by the organiser.
• Content you post: direct and group messages, community posts and messages, reactions, and community pictures.
• Reports and blocks: reports you file about players, games or messages, and the people you block.
• Contacts (optional): if you tap “find friends from contacts” and allow access, your phone turns each email address and phone number into a one-way hash on your phone and sends only those hashes, so we can tell which of your contacts are already on CR3D. Your address book itself never leaves your phone. A hash can sometimes be matched back to a number or address by someone who already has it, so we treat these hashes as personal information and use them only to look for matches.
• Purchases: if you subscribe to CR3D Pro, Apple handles the payment. We receive confirmation of your subscription, not your card details.
• Messages to us: anything you send to support or to our privacy address.
• Early-access list and partner enquiries (cr3d.org): if you join the early-access list, your email address; if you fill in the partner form, whatever you type into it (for example your name, organisation, email address and message). See section 14.

Information collected automatically

• Device and app data: a push-notification token (if you allow notifications), the app version and update, and the time you were last active, so friends can see when you are online unless you hide it.
• Usage analytics: which features you use, tied to an opaque account number, never your name, email or username. We record screen names, not what is on the screen (session recordings are separate, see section 7). We switch off the analytics tool's IP-address location lookup.
• Session recordings: see section 7.
• Crash and error reports: technical details when the app fails, tied to the same opaque account number and linked to the recording of the same session. We set the crash tool not to attach IP addresses, request bodies or cookies to reports.
• Internet connection: like any online service, our providers receive your device's IP address when the app or one of our websites connects to them. An IP address can show your approximate location.

What we do not collect

• We do not read your phone's location (GPS). The location in your profile and the venues of games are what players type or pick.
• We do not use an advertising identifier and do not show third-party ads.
• We do not record audio.

4. How we use it

• To create and run your account, games, leagues, scores, standings, chat and notifications.
• To keep CR3D safe: reviewing reports, enforcing our Terms, and preventing fraud and abuse.
• To check school verification and give access to campus communities.
• To process purchases and subscriptions.
• To understand and improve the app (analytics, crash reports and session recordings), subject to section 7 and your choices.
• To send account emails (for example confirming your email address) and the notifications you allow.
• To send news about the CR3D beta and launch to people on the early-access list, and to reply to partner enquiries.
• To comply with the law and protect our rights.

We do not sell your personal information and we do not share it for cross-context behavioural advertising.

5. Who we share it with

We use the providers below to run CR3D. Most of them process data on our behalf as our service providers. Apple and Google also run their own services under their own privacy policies, for example when you sign in with them or buy through Apple.

Push notifications carry text. A notification can include other players' names. For direct, group and community messages it includes the sender's name and up to the first 140 characters of the message. Expo receives that text and passes it to Apple's push service, which delivers it to your phone. You can hide notification previews on your lock screen in your phone's settings, or turn CR3D notifications off.

We may also disclose information if the law requires it or to protect someone's safety, or to a successor if CR3D is sold or merged (you would be told).

6. How we review content

When someone files a report, people at CR3D review it. We do not use a third-party AI service to review your messages, posts or reports. If we start using automated filtering or AI review, we will update this policy first and ask for any permission the law or the App Store requires.

7. Analytics and session recordings

We use PostHog to see how the app is used and to find usability problems. This includes session recordings: a replay of the screens you see and the places you tap. Recordings are on by default for every player, of every age.

• Masked on your phone before upload: the app is set to mask text you type into fields, images (including profile and community photos), and the text and photos in chat messages.
• Not masked: other text shown on screen, for example players' names and usernames (yours and other players'), scores, standings, and venue names and addresses.
• Never recorded: sound, console logs and network contents.
• Linked to crash reports: a crash report includes a link to the recording of the same session, so we can see what led to the crash.

You can switch analytics and recordings off at any time in Settings → Share Usage Analytics. The setting is saved on your phone, so set it again if you use a new phone or reinstall the app. A parent or guardian can switch it off on a teen's phone the same way.

8. What other players can see

Your username, display name, profile photo and the stats and items you choose to show are visible to other players according to your settings. If you verify your school, other players can see your campus badge or frame. Your games, scores and league history are shared with the other players in them. Messages are visible to the people in the conversation. Profile and community pictures are stored in public file storage, so anyone who has a picture's web address can open it. Your birthday, gender, email address and school email address are not shown to other players.

9. Deleting your account and how long we keep data

Deleting your account

In the app, go to Settings → Delete Account. Your account is hidden at once. Signing in during the next 30 days cancels the deletion. After 30 days, we remove or anonymize your profile information, including your display name (replaced by “Deleted Player”), username, bio, the link to your profile photo, email address, phone number, location, time zone, push token, notification settings and availability. We also remove your posts and comments, your friend connections, your community memberships, your notifications and your school verification, and your sign-in can no longer be used.

Some things stay:

• Messages you sent in direct messages, group chats and community chats stay in the other people's conversations, shown as from “Deleted Player”.
• Games, scores, standings and league history you took part in stay for the other players, under “Deleted Player”.
• Reports filed in the app, and purchase and subscription records, are kept.
• The anonymized record may still include the last time you were active.
• Profile and community pictures you uploaded are not yet removed from file storage automatically; their link is removed from your profile. Email privacy@cr3d.org and we will remove them.

If you signed in with Apple, you can also remove CR3D from your Apple account in your iPhone's Settings (your name → Sign-In & Security → Sign in with Apple).

How long we keep data

• Your account and content: while your account is open, and then as described above.
• Backups: our database host keeps daily backups for a limited period (currently about 7 days), so deleted information can remain in a backup until that backup expires.
• Analytics events, session recordings, crash reports and email delivery logs: kept by each provider for the retention period of our plan with them.
• Purchase records: kept as long as the law requires for tax and accounting.
• Under-13 refusal records: as described in section 2.
• Early-access list and partner enquiries: see section 14.

10. Your choices and rights

• Access and correction: you can see and edit most of your information in Settings and Edit Profile. For anything else, contact us.
• Delete your account: in the app, as above. If you cannot use the app, email us from the address on your account.
• Copy of your data: email privacy@cr3d.org from the address on your account and we will send you a copy of your information. We respond within 45 days.
• Notifications: control them in the app and in your phone's settings.
• Contacts, camera and photos: you decide per permission in your phone's settings; the app works without them.
• Analytics and recordings: Settings → Share Usage Analytics.
• Early-access list: use the unsubscribe link in any of our emails, or email privacy@cr3d.org and we will remove you. Deleting an app account does not take you off the list.
• Do Not Track and Global Privacy Control: we do not sell or share personal information, so there is nothing for these signals to opt you out of. cr3d.app sets no cookies and runs no analytics or advertising code. cr3d.org itself sets no cookies and runs no analytics or advertising code; its early-access sign-up box is an embedded beehiiv form, which may set beehiiv's own cookies (see beehiiv's privacy policy), and its partner link opens a Google Form on Google's site.
• Appeal: if we refuse a request, you may appeal by replying to our decision.

11. US state privacy rights

Depending on where you live (for example California, Colorado, Connecticut, Virginia, Texas and other states with privacy laws), you may have the rights to know what we collect, to access, correct, delete and obtain a portable copy of your information, to opt out of sale, targeted advertising and profiling, and to appeal a refusal. We do not sell personal information or use it for targeted advertising. To exercise a right, email privacy@cr3d.org; an authorised agent may act for you with your written permission. We will respond within 45 days, and we may ask you to confirm your identity.

California. In the last 12 months we collected the categories of information in section 3 (identifiers, contact information including a school email if you verify, profile and user content, usage and diagnostic data, and purchase information) for the purposes in section 4, and disclosed them to the providers in section 5. We do not sell or share personal information as those terms are defined in California law, and we do not knowingly sell the information of anyone under 16.

New York. We know from the birthday which players are 13 to 17. Their profiles start private and can't be set to public. Analytics and session recordings currently run for them as for every other player unless switched off (section 7).

12. Security and where data is stored

We use industry-standard measures: encrypted connections, access controls in the database, and limited staff access. No system is perfectly secure. If a breach affects you, we will notify you and regulators as the law requires.

CR3D stores and processes data in the United States. If you use CR3D from outside the United States, your information is processed in the United States.

13. Changes to this policy

We will post changes here with a new version and date. For material changes (for example a new use of your data), we will also tell you in the app or by email.

14. Early-access list and our websites

Early-access list. cr3d.org has a sign-up box for the early-access list. It is run by our email provider, beehiiv. When you subscribe, beehiiv receives your email address and the time and page you signed up from, and may record technical data such as your IP address and whether you open our emails or click their links. We use your address only to send news about the CR3D beta and launch; we do not sell it. Every email has an unsubscribe link, and you can also email privacy@cr3d.org and we will remove you. We keep your address until you unsubscribe, or until 12 months after CR3D launches if you have not opened any of our emails by then, whichever comes first.

The list is separate from CR3D accounts: joining it does not create an account, and deleting an account in the app does not take you off the list. To leave the list, unsubscribe or email privacy@cr3d.org.

Partner enquiries. The “Partner with CR3D” button on cr3d.org opens a form hosted by Google Forms. Google receives what you type into it and your IP address. We use your answers only to reply to you.

The websites. cr3d.org and cr3d.app are both hosted by Cloudflare. When you visit, it receives your IP address and keeps standard server logs. For cookies, see section 10.

15. Contact

CR3D STUDIOS LLC · Privacy: privacy@cr3d.org · Support: support@cr3d.org · PO Box 235, Johnson, NY 10933, USA.

See also our Support page and Terms of Service.