Crople Privacy Policy

1. Who we are and what this policy covers

Crople is operated by Crople, Inc., a Delaware corporation (“Crople,” “we,” “us,” or “our”). Crople is responsible for the personal information described in this Privacy Policy.

Crople is an 18+ sports-friend matching service. This policy applies to the Crople mobile app, Crople’s public website, account and authentication flows, support and safety channels, notifications, and related backend and operational systems.

This policy does not control the independent privacy practices of third-party services, websites, devices, operating systems, or app stores.

2. Information we collect and why

Crople does not ask you to enter a legal name as a Crople profile field. Your public Crople identity uses the nickname you choose. If you use Google sign-in, Google may provide basic account profile metadata, including a name, to Supabase Auth for authentication. Crople does not display that provider name as your Crople nickname or use it for discovery or matching. For Sign in with Apple, Crople requests the email scope and does not request the full-name scope.

3. How we collect information

We may collect personal information:

• directly from you when you create an account, build a profile, send a request or message, select a place, submit a report or appeal, contact support, or make a purchase;
• automatically from your device or use of the Service, such as app version, security events, diagnostics, permission status, or foreground location when you allow it;
• from Apple Health or Google Health Connect only after you opt into the Bonus Coin fitness-reward feature and grant the relevant operating-system permission;
• from service providers, such as authentication, SMS verification, app-store purchase, notification, map, or diagnostic providers; and
• from other users when they send you content, include you in an activity, block you, or report an interaction involving you.

If you do not provide information required for account creation, authentication, safety, or core matching functions, Crople may not be able to provide the relevant feature.

4. How we use personal information

Crople may use personal information to:

• create, authenticate, secure, and administer accounts;
• enforce age eligibility and community rules;
• create profiles and provide discovery, matching, friend-request, chat, place, and sports-session features;
• display information to other users when the Service requires it;
• send service, safety, support, purchase, and push notifications where enabled;
• detect, investigate, and prevent fraud, spam, abuse, security incidents, and policy violations;
• process reports, moderation actions, appeals, and support requests;
• verify one-time purchases and manage Coins, paid-item balances, refunds, and revocations;
• calculate the user’s own optional Bonus Coin fitness-reward progress from current daily and weekly step and exercise-minute totals and protect that reward system from duplicate or abusive claims;
• diagnose errors, monitor reliability, and improve the Service;
• comply with law, legal process, tax, accounting, regulatory, child-safety, or app-store obligations; and
• establish, exercise, or defend legal claims.

5. Profile visibility and disclosure to other users

Certain profile information and User Content is intended to be visible to other Crople users. This may include your nickname, profile photos, bio, sports interests, avatar information, approximate area or distance, and information you choose to send through friend requests, chat, or activity coordination.

Crople does not intentionally display your precise GPS coordinates or private home address to other users. You should not place sensitive or private information in a public profile, nickname, bio, or photo.

6. Location information

The current MVP uses foreground location only when you grant operating-system permission. It does not request background location permission.

Location information may be used for nearby matching, area or distance display, map and place search, selected places, temporary sports-session progress, abuse prevention, and location-use evidence where required or appropriate.

When you use place search, Crople processes the words you type and may use your foreground location as a location bias. Crople first searches its own curated place data. If more results are needed, Crople sends the search terms and, when available, a location bias containing latitude, longitude, and search radius through a Supabase-hosted Edge Function to Google Maps Platform so Google can return relevant places.

Google Maps Platform Terms state that Google collects and receives data including search terms, IP addresses, and latitude/longitude coordinates, and that Google and its affiliates may use and retain this data to provide and improve Google products and services. Crople sends place-search text to Google in a POST request body and may include the location bias described above. Google's processing is governed by the Google Privacy Policy (https://policies.google.com/privacy) and the Google Maps Platform Terms (https://cloud.google.com/maps-platform/terms). Do not enter a person's name, home address, Health information, or other sensitive information into place search unless it is necessary to find the place you want.

Temporary session-progress coordinates are designed to be redacted under the 24-hour cleanup rule unless a safety, security, dispute, or legal exception applies.

Crople does not automatically provide a user’s precise session-progress coordinates, movement route, or Crople user ID to a sports facility or commercial data partner. If Crople later offers an integrated facility booking, inquiry, check-in, directions, or arrival-assistance feature, the user must initiate that specific action and will receive a prominent disclosure identifying the recipient, purpose, information to be sent, and relevant retention or cancellation controls before consenting. The transfer may include the selected meeting place or facility and its map coordinates, date and time, party size, sport, appointment status, and necessary reservation contact details. A one-time current precise location or proximity result may be sent only when the user separately chooses a feature that reasonably requires it. Crople will not send an ongoing movement route or background location for these partner features, and the recipient may not reuse the transferred information for advertising, unrelated profiling, resale, or data-broker activity.

Crople may create commercial area, sport, and time-period demand statistics only after removing user and device identifiers, precise coordinates, original timestamps, individual appointments, contact details, and other elements that could reasonably associate the result with a person. Crople will suppress or broaden sparse groups and prohibit recipients from attempting re-identification or combining the statistics to reconstruct individual activity. Raw or pseudonymous location histories are not included in such statistics.

You can withdraw location permission through your device settings. Some discovery, map, distance, or session features may then stop working.

7. Photos, messages, reports, appeals, and support content

Profile photos are user-submitted profile content. Crople is designed to use randomized storage paths, reasonable file limits, image recompression or metadata removal where feasible, and cleanup of replaced, deleted, or orphaned profile-photo objects.

Friend requests, chat messages, reports, appeals, support inquiries, and related metadata may be processed to provide social features, respond to users, investigate safety concerns, prevent repeat abuse, preserve evidence, and resolve disputes.

An in-app report is stored in Crople's restricted Admin review queue. A Settings report may immediately hide the reported user from the reporter's Home. A Chat report may immediately block the reported user and cancel pending or confirmed appointments in that chat. These reporter-protection effects are not an account sanction or a finding that a violation occurred. The current reporting flow does not copy report contents into email or alerts or automatically submit a report to police or another external organization. Any account sanction, legally required report, or lawful disclosure is a separate human decision. Messages sent directly to safety@crople.app are received through the separate safety mailbox.

Crople may use automated rules or filters to detect restricted content, external-contact patterns, abuse signals, fraud, or security events. These tools may not detect every issue and may be supplemented by human review.

8. Health and fitness information

When enabled, the optional Bonus Coin fitness-reward feature can read step count and exercise minutes from Apple Health or Google Health Connect after you review the in-app explanation, choose to continue, and grant operating-system permission. Health permission is not required for profiles, discovery, matching, chat, or sports appointments.

Crople sends only the current daily and weekly step totals and exercise-minute totals needed to calculate your own reward progress. Crople does not send or store individual Health samples, lists of workout start or end times, workout type, heart rate, calories, distance, source app or device, or location routes obtained from Health services. The feature is read-only and does not write to Health services or request background Health access.

Crople uses these limited aggregates only to display and calculate your Bonus Coin progress, determine whether an eligible goal is met, let you claim the resulting Bonus Coins to your Crople account, maintain an auditable reward ledger, and prevent duplicate or abusive claims. Bonus Coins are a non-cash, non-transferable in-app benefit. They cannot be withdrawn, redeemed for money, gifted, sold, or transferred between accounts, and can be used only for eligible account-bound features or digital catalogue and avatar items inside Crople.

Supabase processes these limited aggregates on Crople's behalf as Crople's contracted backend service provider and processor for storage, reward calculation, duplicate and abuse prevention, and Coin-ledger maintenance. Crople does not sell the aggregates or disclose them to advertisers, data brokers, information resellers, sports facilities, or other parties for their own purposes. Crople does not use Health information for advertising, marketing, cross-app tracking, credit, insurance, employment, or third-party data mining.

You can disconnect the feature in Crople and manage or withdraw operating-system Health permission in your device settings. Disconnecting stops future synchronization. Current-period aggregates and limited reward-integrity records may remain as described in Section 14 to prevent duplicate claims and maintain an auditable Coin ledger; final account deletion removes account-linked Health connection and aggregate rows from active systems unless a narrowly applicable legal or security exception requires limited retention.

9. Purchases, Coins, and paid digital items

All currently planned paid products are one-time consumable purchases. When paid products are enabled, Crople may process store platform, product ID, pack quantity, localized price, currency, country, transaction or order identifier, purchase token, receipt hash or validation result, Bestie Rush, Max Me, Round Refresh, or Coin balance records, refund or revocation state, and fraud-prevention metadata.

Crople maintains account-linked ledgers designed to distinguish transaction source, purchased and free or promotional Coin credits, item-unit credits and uses, Coin exchanges, virtual-item ownership, refunds, revocations, reversals, negative balances, and later offsets. These records are used to verify delivery, prevent duplicate crediting or duplicate use, synchronize eligible balances to the same account after reinstall or device change, investigate purchase problems, correct refunded or invalid transactions, prevent fraud, and resolve disputes.

Purchased Coins and free or promotional Coins do not expire solely because time passes after they are credited to an active account. A limited opportunity to claim a reward may end before the reward is credited. Where both types are held, purchased Coins are consumed first.

If a Coin purchase is refunded, revoked, reversed, charged back, or found invalid, Crople may adjust the associated ledger and deduct an equivalent quantity from any remaining Coin balance, including free or promotional Coins. Where the balance is insufficient, Crople may record a negative balance, offset later Coin credits, revoke related virtual items or benefits, or record a paid-feature restriction, as described in the Terms of Service and subject to applicable law.

Bestie Rush, Max Me, Round Refresh, Coin balances, and eligible account-linked virtual items are stored against the relevant Crople user ID. When a user reinstalls the app or changes devices and signs in to the same Crople account, the eligible server-recorded balance is automatically re-synchronized. A different Crople account does not receive or merge the prior account’s balances.

Final account deletion ends access to the account and generally ends licences to unused Coins, paid item units, and account-linked virtual items, subject to mandatory legal and platform rights. See the Terms of Service (https://crople.app/legal/terms) for the complete purchase, refund, clawback, synchronization, and deletion rules.

10. Analytics, diagnostics, cookies, advertising, and tracking

Crople uses sanitized operational analytics and crash diagnostics to keep the Service reliable and secure. Crople is designed not to intentionally send raw phone numbers, passwords, one-time passcodes, authentication tokens, raw chat text, precise location, or full payment receipts to analytics or crash logs.

The current Crople app and public website do not use an advertising SDK, attribution SDK, device advertising identifier, cross-app tracking, retargeting, or personalized advertising. The public website does not currently set marketing or advertising cookies. If Crople later introduces any of these technologies, Crople will update this policy and provide any notice, choice, or consent required before activating them.

Crople does not use Health information or place-search terms for advertising, attribution, cross-app tracking, retargeting, personalized advertising, or sale.

11. Service providers

Crople uses or may use the following service providers where the relevant feature is enabled:

Where a provider acts as Crople's service provider or processor, it processes personal information on Crople's behalf to provide the contracted service. Using such a provider is not a sale of personal information. Crople does not authorize Supabase to sell Crople customer data or use it for advertising. Some providers, including Google Maps Platform, may also process request or log data under their own published terms and privacy policies; those practices are described above. Provider names and functions must be updated if the production architecture changes.

12. When we share or disclose information

Crople may disclose personal information:

• to other Crople users as required for profiles, discovery, requests, chat, place selection, activities, and area or distance indicators;
• to service providers that operate infrastructure or features for Crople;
• to a sports facility, reservation, check-in, directions, or arrival-assistance partner only when the user initiates the specific action and, after a prominent disclosure, consents to the recipient, purpose, information, and relevant retention or cancellation controls required for that transaction;
• to professional advisers, auditors, insurers, or contractors where reasonably necessary and subject to appropriate obligations;
• to competent authorities, courts, reporting organizations, or other parties where required or permitted by law, legal process, child-safety needs, emergency response, fraud prevention, security response, tax, accounting, or dispute handling; and
• in connection with a merger, financing, reorganization, sale of assets, or transfer of the Service, subject to applicable privacy obligations.

Crople does not sell personal information or operate as a data broker. Crople may charge facilities or partners for reservation, referral, check-in, arrival-assistance, featured-listing, or other services that support a user-initiated sports appointment; those fees are for the service and do not authorize secondary use or sale of the user’s information. Crople may also license or sell fully anonymized, group-level area, sport, and time-period demand statistics that can no longer be associated with an individual. Those statistics exclude Health data, precise coordinates, raw or pseudonymous location histories, user and device identifiers, contact details, and individual appointments, and recipients may not attempt re-identification.

13. International transfers and overseas processing

Crople, Inc. is a United States company. Crople's primary Supabase project, including the primary application database, authentication, and storage services, is deployed in Sydney, Australia (AWS region ap-southeast-2). Working on or administering the Service from South Korea does not move that primary project out of Australia, but authorized remote access from South Korea is a form of processing in South Korea.

The countries in which current overseas recipients or provider operations are likely to be located include Australia, South Korea, and the United States. Sentry also identifies product infrastructure or group operations in Germany, Canada, Austria, and the Netherlands. Google, Apple, Vonage, Vercel, Supabase, and their subprocessors operate globally, so support, security, communications, routing, or other limited provider processing may also occur in countries listed in their then-current privacy or subprocessor disclosures.

Current provider location and transfer disclosures are available from Supabase (https://supabase.com/docs/guides/platform/regions), Vonage (https://www.vonage.co.uk/legal/privacy-policy/), Google (https://policies.google.com/privacy), Apple (https://www.apple.com/legal/privacy/), Sentry (https://sentry.io/legal/dpa/), and Vercel (https://vercel.com/legal/dpa). These provider disclosures may change independently of Crople.

Crople will maintain and update its provider and processing-location record as production providers change. A provider's infrastructure may route or support data from more than one country even when Crople selects an Australian primary region.

Where required by applicable law, Crople will take reasonable steps designed to ensure that overseas recipients handle personal information consistently with applicable privacy obligations.

14. Retention

Crople keeps information only for as long as reasonably needed for the purposes described in this policy, subject to the following current baselines:

Encrypted backups or disaster-recovery copies may retain data after it is removed from active systems until the applicable backup rotation completes. Crople's current Supabase production configuration uses daily physical backups retained for seven days and does not use point-in-time recovery. Backup copies are isolated from ordinary product use. If a backup is restored, Crople will reapply valid deletion and retention requirements before returning the restored system to ordinary use. Crople will update this policy if the production backup configuration materially changes.

15. Security

Crople uses administrative, technical, and organizational measures designed to protect personal information. Current measures described in the product baseline include encrypted transport, access minimization, server-side authorization, role separation, audit and security logging, sensitive-log minimization, rate limiting, and provider security controls.

No service can guarantee absolute security. You should protect your device, phone number, authentication codes, and account access and should contact support@crople.app if you suspect unauthorized access.

Where required by applicable law, Crople will notify affected users and regulators of an eligible data breach.

16. Child-safety reports, legal process, and emergency disclosures

Crople may review and preserve account information, User Content, metadata, and safety reports where necessary to investigate child sexual abuse or exploitation, threats, fraud, serious misconduct, or other unlawful activity.

Where Crople obtains actual knowledge of apparent child sexual abuse material or another reportable child-exploitation offense, Crople may disable access, preserve the legally required material and context, and report to the National Center for Missing & Exploited Children (NCMEC) or an appropriate regional authority. Crople limits access and copying to what is reasonably necessary for safety, reporting, evidence preservation, and legal compliance.

Crople reviews law-enforcement requests for authenticity, legal basis, scope, and jurisdiction. We may preserve or disclose information in response to valid legal process. Where law permits, Crople may also disclose information in good faith when an emergency involving danger of death or serious physical injury requires disclosure without delay.

Crople may not notify an affected user before or after a disclosure where notice is prohibited by law, court order, or would reasonably create a safety risk, compromise an investigation, facilitate evasion, or endanger evidence.

17. Account deletion

You may request account deletion through Settings > Account > Delete account or at https://crople.app/delete-account.

After verification, the request enters a 30-day pending period. Ordinary profile and discovery exposure stops during that period. Logging back in cancels the deletion request.

After the pending period, Crople's automated daily finalization process attempts account deletion. Completion may be delayed where a safety report, active restriction, fraud or payment record, legal hold, relational record, or other lawful retention requirement must first be resolved, retained, or de-identified. A delay in finalization does not restore ordinary profile or discovery exposure.

Final account deletion ends access to the account and generally ends licences to unused Coins, Bestie Rush units, Max Me units, and Round Refresh units, subject to mandatory legal rights. Deleting the app alone does not delete the account or create a refund right.

When finalization succeeds, Crople removes account-linked chat threads and messages, invitations, confirmed sessions, support inquiries, purchase orders, and other records configured to be deleted with the account from active Crople systems. Safety reports, fraud records, payment or accounting records, legal holds, and related audit material may block finalization or be retained with access restricted, or retained after the account identifier is removed or replaced, where reasonably necessary and lawful. Backup copies may retain deleted data for the current seven-day rotation period, as described in Section 14.

18. Your choices and privacy rights

Depending on applicable law, you may have rights to request access to, correction of, deletion of, or information about personal information Crople holds about you. You may also be able to withdraw consent or object to certain processing where applicable.

You can edit certain profile information in the app, manage device permissions in your operating-system settings, manage notifications where available, block or hide users, report content, appeal certain Crople enforcement decisions, and request account deletion.

To make a privacy request, email privacy@crople.app. Crople may need to verify your identity before acting on a request. We will respond within the period required by applicable law and may refuse or limit a request where the law permits or requires us to do so.

19. Privacy complaints

Crople’s founder and sole director currently serves as the designated privacy contact and is responsible for monitoring privacy@crople.app.

You may submit a privacy complaint to privacy@crople.app or by mail using the address in Section 23. Please describe the concern, the relevant account or contact information, and the outcome you are seeking. Crople aims to acknowledge and provide an initial substantive response within 30 calendar days, although complex matters may require additional time. We will notify you if more time is reasonably required.

Where the Australian Privacy Act applies, you may be able to complain to the Office of the Australian Information Commissioner after first giving Crople a reasonable opportunity to respond.

20. Children and age eligibility

Crople is intended only for users aged 18 or older. We do not knowingly allow users under 18 to create accounts or use the Service.

If we learn or reasonably believe that an account belongs to a person under 18, we may restrict or deactivate the account and delete or de-identify related personal information, except where limited retention is needed for safety, fraud prevention, legal compliance, dispute resolution, or abuse prevention.

Report a suspected underage account or child-safety concern through the in-app reporting tools or at safety@crople.app.

21. Automated matching and moderation

Crople may use rule-based or automated systems to organize discovery results, calculate distance or compatibility signals, detect restricted content, prevent abuse, or prioritize reports. These systems may use profile, sports-interest, location, account, content, or security information, depending on the feature.

Crople's current automated processing includes recommendation and distance calculations, deterministic restricted-text checks, abuse-prevention controls, and queue prioritization. No current computer program independently imposes a significant Crople account sanction. A human operator selects sanctions such as a warning, temporary suspension, or permanent suspension through the moderation workflow. Crople will maintain an inventory of automated systems and will update this policy before enabling a computer program to make, or substantially and directly assist in making, a decision that could reasonably be expected to significantly affect a user's rights or interests. The additional Australian privacy-policy obligations for such decisions commence on 10 December 2026.

22. Changes to this policy

Crople may update this policy as the Service, data practices, law, or platform requirements change. We will post the current version at the Public URL above and update the “Last updated” date. Where required, we will provide additional notice or obtain consent.

23. Contact and company information

Service operator: Crople, Inc., a Delaware corporation

Business mailing address: 8 The Green, Suite 24165, Dover, DE 19901, United States

Website: https://crople.app

Privacy inquiries and complaints: privacy@crople.app

General support: support@crople.app

Safety and child-safety reports: safety@crople.app

© 2026 Crople, Inc. All rights reserved.