Legal

Privacy Policy

Effective 28 October 2026 · Applies to the CrowdUp app and this website

CrowdUp helps people organise private meetings and public events, and builds trust through verified meetings, attendance and ratings. This policy explains what information we collect to do that, why, who else handles it, and the choices you have. “CrowdUp”, “we” and “us” mean the developer, Karunanayake Handhagama Ralalage Vikum Priyasad Karunanayake.

The short version

Private meetings are never shown in Discover, in search or on anyone’s profile.
We don’t sell your personal information, we don’t show ads, and we don’t use your data for advertising.
We don’t track you: we don’t follow what you do in other companies’ apps or websites, and CrowdUp doesn’t use advertising identifiers.
Your photos and the text you post are checked for unsafe content by an AI service (OpenAI). We ask your permission for this when you create your account.
Your location is used to find events near you, only when you allow it.
Your public profile shows your name, photo, town, ratings, reliability, host record, credits and upcoming public events.
You can delete your account and its data at any time, right in the app.
CrowdUp only connects people. Event and profile details come from members, and we can’t personally verify them.

1. What we collect

Information you give us

Account: your name and email address. If you sign in with Google, we receive your name, email address and Google account ID from Google. If you sign in with Apple, we receive an Apple user ID, your name if you choose to share it, and an email address, which can be a private relay address if you choose Apple’s Hide My Email (Apple then forwards our emails to you). We don’t use your Google profile picture.
Profile: the profile photo you take or choose, your town (optional) and the interests you pick.
Meetings you create: title, description, category, date and times, place name and address, an exact map pin if you add one, a video link for online meetings, an extra link, a cover photo, the meeting’s time zone (so its time shows correctly in other countries) and, for repeating meetings, the dates in the series.
Your answers and activity: invitations you send and receive, whether you’re going, joins by meeting code, who you follow, the public events you save, the ratings you give hosts and events, and, for hosts, the attendance you record.

Information created as you use CrowdUp

Records: when a meeting was verified, when attendance was saved, whether an invitation was opened, and that you opened a public event (recorded once, with the time you first opened it, for that event’s host).
Verification photo: the photo a host takes with the in-app camera to verify a meeting. It is compressed and its hidden details (such as location data) are removed before upload.
Reputation and rewards: your host rating, event rating, reliability, host record, credits and milestones. These are calculated from the records above.
Settings stored with your account: your recent places (up to 5), how many free map pins you’ve used, and which milestones we’ve already congratulated you on.
Notifications: if you allow notifications, a notification token for your phone, the type of phone and your time zone (so reminders arrive at the right local time), and the choices you make under Settings → Notifications.
Safety: reports you make (the reason and any details you add), members you block, and moderation records, such as which photos passed our safety check and whether an account was restricted.
Premium: whether your account has Premium, which plan you chose, and the purchase and renewal status the app store confirms to us. Payments are handled by Google Play, or by Apple on iPhone; we never see or store your card details. See our Subscription Terms.

Information collected automatically

Technical information: when the app talks to our servers, our hosting provider receives standard technical details such as your IP address, device type, operating system, app version and the time of the request. These are used to keep CrowdUp working and secure, and to fix errors.
Sign-in session: a secure token stored on your phone keeps you signed in until you sign out.
Abuse protection: a short-lived count of how often you do certain things, such as entering meeting codes, creating meetings or sending invitations, so we can stop automated abuse. It’s deleted after 1 day.

Information we don’t collect

We don’t collect your contacts, your phone number, your messages in other apps, or your location in the background.

2. Phone permissions and location

CrowdUp only asks for a phone permission when you use the feature that needs it, and the app explains why first. Every permission is optional: if you say no, the rest of CrowdUp keeps working, and you can change your choice at any time in your phone’s settings.

Permission	Why CrowdUp asks	If you say no
Location (while using the app)	To show events near you in Discover and on the map, and to help you pin a meeting place.	Search for a town instead.
Camera	To take your profile photo, a meeting moment when verifying a meeting, or an event cover photo.	Choose a photo from your gallery instead.
Photos and media	To choose a profile photo or event cover photo from your gallery. Only the photo you pick is used.	Take a new photo instead.
Notifications	To tell you about invitations, answers, meeting reminders, rating requests and new events from people you follow.	You won’t get alerts; everything still shows in the app.
Internet	To sign you in and load meetings, maps and profiles.	Needed for CrowdUp to work.

CrowdUp never accesses your contacts, microphone, phone calls, SMS, files other than photos you choose, or your location in the background.

How location is used

CrowdUp asks for location permission only when you choose to use your location, for example in Discover or when pinning a meeting place. You can say no and search for a town instead.
When you look for events near a place, its coordinates are sent to our servers to find events around it. We don’t store that search.
We save a place to your account when you choose it in Discover (your recent places, up to 5), and we may save the town name to your profile if you left it empty.
Directions open in your phone’s own maps app, which has its own privacy policy.

3. How we use your information

To run your account, sign you in and send sign-in and verification codes by email.
To create meetings, deliver invitations and show the right people the right details.
To show public events in Discover, ranked by the hosts you follow, your interests and your location.
To verify meetings, record attendance and calculate ratings, reliability, credits and milestones.
To enforce plan limits (for example 8 guests for free private meetings and 50 for free public events) and provide Premium features.
To send the notifications you allow: new invitations, answers to your meetings, changes and cancellations (also for public events you saved), new public events from people you follow (at most one a day per person; you can turn this off), reminders a day and an hour before, and reminders to verify, mark attendance or rate.
To check meeting details, names and photos for unsafe content, such as nudity, hate or violence, before they’re shown, and to review reports from members.
To keep CrowdUp safe: preventing abuse, fake meetings and attempts to game ratings or credits.
To fix problems and improve the app.

Where the law asks for a legal basis, we rely on providing the service you asked for (contract), your consent (for example, location), and our legitimate interest in keeping CrowdUp safe and working.

4. What other people can see

Information	Who can see it
Name, profile photo, town, interests, follower counts	Other signed-in CrowdUp members
Host rating, event rating, reliability, host record, credits and milestones	Other signed-in members, on your public profile
Your upcoming public events	Other signed-in members (finished events stay in your own history)
A public event’s web page	Anyone with the link, and search engines such as Google: the title, description, category, date and time, place name and town (never the street address or exact map pin), cover photo, how many are going, and the host’s first name, last initial, profile photo and host rating. Never who is going, private meetings or video links. The page is removed 30 days after the event
A private meeting and its guest list	The host and the people invited to it
Who’s coming to a private meeting	The host, and guests of that meeting who accepted
Who’s going to a public event	Signed-in members who open that event
A meeting code’s preview	Anyone you give the code to: title, time, place name and host only
An online meeting’s video link	The host and people who said they’re going
Individual ratings for a meeting	The person who gave the rating and the host of that meeting. Everyone else sees averages only
Profile photos and event cover photos	Shown in the app; stored so that anyone with the image link can open it
Public events you saved	Only you see your saved list. The host sees only how many people saved their event, never who
That you opened a public event	Only the host of that event, and only while the host has Premium: they see your name, profile photo and town, when you first opened it, and can open your public profile. Hosts on the free plan see only how many people opened it. No other member can see which events you opened
That you’re going to a public event	Your friends (people you follow who follow you back) may see “a friend is going” on that event
A meeting’s verification photo	Private meeting: the host and guests who accepted. Public event: signed-in members who open it. Stored privately; shown only after our automatic safety check

Information shared by other members

Meeting details, event information and profiles are written by the members who share them. CrowdUp is a digital app that connects people, so we can’t personally check or guarantee that this information is accurate, or know who someone really is. Please use your own judgement before sharing personal details or meeting anyone. What happens before, during or after a meeting is the responsibility of the people taking part, as explained in our Terms of Service.

We don’t sell your personal information. We share it only with service providers that help us run CrowdUp, and only what they need:

Supabase: hosts our database, sign-in system and photo storage.
Google: Google Sign-In, if you use it; Google Play for downloads and Premium payments on Android.
Apple: Sign in with Apple, if you use it; the App Store for downloads and Premium payments on iPhone; and Apple Push Notification service, which delivers notifications to iPhones.
Brevo: sends our emails, such as sign-in and password codes. It receives your email address.
OpenAI: automatically checks meeting text, profile names and uploaded photos for unsafe content. It receives only the text or photo being checked, not your email address or account details, and doesn’t use data sent through its API to train its models by default.
Firebase Cloud Messaging (Google): delivers push notifications to your phone. It receives your phone’s notification token and the text of the notification.
RevenueCat: manages Premium subscriptions with Google Play and Apple. It receives your CrowdUp account ID, your purchase and renewal status, and basic device information. It never receives your card details.
OpenStreetMap: provides map images and turns addresses into map positions. Your device requests map tiles for the area you view, and place searches you type are sent to its search service.

Automatic safety checks (AI)

To keep CrowdUp safe, the photos you upload (profile and event photos) and the text you post (meeting details, your name and town) are sent to OpenAI, a third-party AI service, which checks them for nudity, sexual content, hate, harassment, violence, self-harm and illegal activity. Only the photo or text being checked is sent, never your email address, password or account details. OpenAI returns a result; photos that fail are deleted straight away. Under its API terms, OpenAI doesn’t use this data to train its models by default and may keep it for up to 30 days to detect abuse. We ask for your explicit permission before any of your content is sent, when you create your account.

We may also share information if the law requires it, to protect people’s safety, or as part of a sale or merger of CrowdUp, in which case this policy continues to apply. These providers may process data in countries other than yours; we use providers that protect it with appropriate safeguards.

6. How long we keep it

We keep your account information while your account is open.
When you delete your account in the app, your profile, photos, meetings you host, invitations, follows and ratings linked to you are deleted straight away. Requests by email are completed within 30 days. We keep only what the law requires.
Meeting records and ratings are kept while the account that created them exists, because reputation and credits are calculated from them.
Notification tokens are kept until you sign out or uninstall the app. Records of notifications we sent are deleted after 35 days.
Photos that fail our safety check are deleted straight away and never shown.
Reports are kept while we review them and for as long as needed to keep members safe. Members you block stay blocked until you unblock them.
Counts used for abuse protection are deleted after 1 day.

7. Your choices and rights

Edit: change your name, photo, town and interests in the app at any time.
Notifications: choose which notifications you get in the app under Profile → Settings → Notifications, or turn them all off in your phone’s settings.
Location: turn location permission on or off in your phone’s settings.
Delete: delete your account in the app under Profile → Settings → Delete my account. It takes effect straight away. Without the app, follow the steps on our account deletion page.
Access and copy: ask us for a copy of your information.
Correct: ask us to correct information that’s wrong, if you can’t change it yourself in the app.
Withdraw consent: where we rely on your consent, such as for location or notifications, you can withdraw it at any time in your phone’s settings. Every photo and post on CrowdUp is checked for safety, so to withdraw permission for the AI safety checks you can stop posting or delete your account.
Sign in with Apple: you can stop using your Apple Account with CrowdUp at any time on your iPhone in Settings → your name → Sign-In & Security → Sign in with Apple. When you delete your CrowdUp account, we also end CrowdUp’s access to your Apple Account.
Report or block: report a member or content in the app, or by email, and we’ll review it.

To make a request, email digitalappmarket@gmail.com from the email address on your account. We reply within 30 days and won’t treat you differently for using your rights.

For people in the United States

We don’t sell your personal information, and we don’t share it for targeted advertising. Depending on your state, you may have the rights to know, access, correct and delete your information, which you can use as described above.

For people in the UK and European Economic Area

You have the rights to access, correct, delete, restrict and object to the use of your information, and to data portability. You can also complain to your local data protection authority.

8. Security

Your data is sent over encrypted connections. Our database uses row-level security, so each member can only read and change what the rules allow, such as their own account and the meetings they’re part of. Photos are compressed and limited to 5 MB, and before a photo is uploaded the app removes hidden details stored inside it, such as the location where it was taken and the phone model. An online meeting’s video link can only be read by its host and the people who said they’re going. We also limit how often some actions can be repeated, to stop automated abuse. No system is perfectly secure, so please use a strong password and keep your sign-in details private.

9. Age limit

CrowdUp is for people aged 18 and over, because it helps people meet in person. We don’t knowingly collect information from anyone under 18. If you think someone under 18 is using CrowdUp, please contact us and we’ll remove the account.

10. Changes to this policy

If we change this policy, we’ll update the date at the top. If the change is significant, we’ll tell you in the app before it takes effect.

11. Contact Us

For any privacy questions or data requests, contact the data controller:

Data Controller: Karunanayake Handhagama Ralalage Vikum Priyasad Karunanayake
Email: digitalappmarket@gmail.com
Address: No 193,
Godage Mawatha,
Anuradhapura, 50000,
Sri Lanka.