Privacy Policy

Information We Collect

Account Information (via Threads OAuth)

• Threads username and display name
• Threads profile picture
• Threads user ID

Crush Messages

• Crush message content submitted to user pages
• Category and duration selections
• Sender identity (linked to your authenticated Threads account)
• Hashed IP addresses for rate limiting (cannot be reversed to identify you)

Location Data

• Approximate location derived from IP address for rate limiting and abuse prevention
• We do not collect precise GPS location or use location for advertising

Technical Data

• IP address (hashed before storage) and user agent for session security
• Session data (automatically expires after 7 days)
• Browser type and operating system

Optional Data

• Email address (optional, used for Stripe receipts if provided)
• Date of birth (collected for age verification, encrypted at the application level before storage). When matching features are enabled, your age in whole years is derived from it, shown on your public profile, and used to match you within your preferred age range. Your exact date of birth is never shown to others.
• Waitlist information (name, email, Threads handle) if you signed up before launch

Profile & Matching Data

These fields are optional. You choose whether to add them, and you can change or remove them at any time.

• Gender identity and an optional free-text gender description, shown on your public profile
• Sexual orientation, if you add it. This is a special category of personal data (for example under GDPR Article 9); we collect it only with your consent when you choose to provide it, and use it solely to display on your profile and to help surface compatible people.
• Relationship status and what you are looking for (romantic or platonic), shown on your public profile
• Astrology birth details and selected interests, if you add them. Birth time and coordinates are encrypted and never shown to others.
• Matching preferences (the genders and age range you want to see). These are kept private and are never shown on your profile or to anyone else.

How We Use Your Information

• Authenticate you via your Threads account
• Display your public crush page
• Deliver crush messages to your dashboard
• Match you with compatible people in Discover and determine who can send you a crush, based on your profile and matching preferences
• Display your profile details (such as age, gender, orientation, relationship status, and what you are looking for) on your public profile when you choose to add them
• Enable Pro subscribers to reveal the identity of crush senders
• Rate limit submissions and prevent abuse using hashed IP addresses
• Improve and maintain the Services
• Comply with legal obligations

Third-Party Services

• Meta/Threads OAuth: Authentication and profile data
• Cloudflare Turnstile: Bot protection and security verification
• Stripe: Payment processing for Pro subscriptions
• Omni Fractal: Application hosting and orchestration
• Content Moderation: Crush messages are checked for policy violations using automated moderation

These services have their own privacy policies governing their use of your data.

Data Retention

• Account data: Retained until you request deletion
• Crush messages: Retained until the recipient deletes them individually or deletes their account
• Session data: Automatically expires after 7 days
• IP hashes: Temporary, used only for rate limiting
• Notifications: Automatically purged after 90 days; you can delete individual notifications or clear all from the Notifications page
• Profile views: Retained while your account is active; deleted when you delete your account
• Reveal requests: Pending requests expire after 72 hours

Anonymity of Crush Messages

Sending a crush requires signing in with your Threads account. We store your identity as the sender so that Pro subscribers can request to reveal who sent them a crush. By default, recipients only see the message content, category, and duration. IP addresses are hashed for rate limiting and cannot be reversed to identify the sender.

Your Rights

• Access your personal data
• Correct inaccurate data (update your email in Settings; profile information syncs from your Threads account)
• Delete your account and all associated data
• Delete individual crush messages you've received
• Delete individual notifications or clear all notifications
• Export a copy of your data in machine-readable format
• Revoke Threads access at any time via your Threads settings

You can exercise these rights from your dashboard (crush management), Notifications page (notification management), and Settings page (data export and account deletion).

We do not sell, rent, or share your personal information with third parties for their marketing purposes. California residents may contact us at [email protected] for any CCPA-related requests.

Children's Privacy

ThreadsCrush is not intended for users under 18 years of age. We require date-of-birth verification before granting access to the platform, and all platform actions are blocked server-side until age verification is complete. We do not knowingly collect personal information from children. If we learn that we have collected information from a child under 18, we will delete it promptly.

Security

We use HTTPS/TLS encryption, hashed IP addresses, encrypted OAuth tokens, application-level encryption for sensitive personal data (such as date of birth), rate limiting, server-side age verification enforcement, and secure session management to protect your data. Expired sessions are automatically cleaned up. However, no method of transmission or storage is 100% secure.

Contact Us

For privacy-related questions: [email protected]

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website.

Last updated: June 10, 2026