Privacy Policy

Crush Balloon ("we") lets people secretly send a balloon to someone they like. It is run by an individual developer, the developer shown on the App Store. Contact: support@crushballoon.app.

What we collect

• Sign-in data: the account identifier, and the name and email if given, from Apple, Google, LINE or Kakao. We do not collect phone numbers.
• What you enter: your ID and name. An optional Instagram username from earlier versions is no longer shown.
• Member number: an 8-character number we create for each account, so we can find it when you contact us.
• Activity: balloons you send and receive and when, matches, blocks and reports.
• Device data: a push notification token, time zone, language, IP addresses in server logs, and Apple DeviceCheck's mark for this iPhone (only "an account was made on this phone", to stop mass fake accounts; no personal data).

On Android, Google Play Integrity checks that the app is the genuine one from Google Play running on a real phone; we only receive whether it passed, no personal data.

Spark leaderboard

Joining the leaderboard is your choice, and you can leave anytime in Settings. While you're on it, if the number of spark balloons you received is in the top 20, everyone can see your name, ID and the count. Leaving removes you right away.

There are no photos, contacts or location in Crush Balloon, and we don't collect them. We don't sell data or use it for ad tracking.

Emails other people enter

Sending a balloon to the email of someone not on the app yet is paused, and we no longer take new addresses. For balloons sent before the pause, we keep only a one-way value keyed with a server secret (HMAC-SHA256, pseudonymized data) and a masked version shown to the sender (for example j•••@gmail.com). When the owner signs in with that address, the balloon is delivered and they are told someone sent it to their email. The value is deleted once the balloon is delivered, taken back, or after 90 days.

Chat and drifting balloons

When crush balloons match, you talk in the app's own chat. Drifting balloons (once available) are opt-in; with your consent we keep your gender and who you'd like to meet (men, women or anyone), used only to decide which balloon yours meets and never shown to anyone. When two balloons meet, a chat opens; it shows no name or ID. Messages are stored encrypted and deleted when either side leaves. If you report something, we keep an encrypted copy of the reported message and the conversation around it for up to 90 days to handle the report. So you never meet the same person twice, we keep a record of who you met. Leaving deletes your gender and preference; deleting your account deletes everything. If the law requires it, we may give necessary data to the authorities.

Why we use it

• To run the service: deliver balloons, detect matches, chat.
• Safety: prevent fake accounts, harassment and abuse; handle reports.
• Notifications: balloons arriving, matches and new messages.

Service providers

• Google Firebase: push notifications.
• Railway: server and database hosting (United States).
• Apple, Google, LINE and Kakao: sign-in. Apple: DeviceCheck. Google: Play Integrity.

They process data only to provide Crush Balloon. We don't share data with anyone else unless the law requires it. Your data is stored on servers in the United States.

How long we keep it

Until you delete your account. Deleting your account immediately deletes your account, balloons, matches and chats. After a balloon sent by email ends, its masked address (for example j•••@gmail.com) is deleted within 30 days. Server logs are kept for up to 30 days and do not contain email addresses or chat messages.

Your rights

In the app you can view and change your ID and name, or delete your account. For a copy of your data or other requests (access, correction, objection), email us with your member number at support@crushballoon.app; we reply within 30 days. California residents: we do not sell or share personal information.

Age

Crush Balloon is for people 18 and older. Accounts of people under 18 are deleted when found.

Security

Chat messages are stored encrypted with AES-256-GCM, and the only thing we keep of an email address is an HMAC-SHA256 value keyed with a server secret. Keys are stored apart from the database and all traffic uses HTTPS. These values are still personal data (pseudonymized, not anonymous), and we protect them under this policy.

Changes

We'll tell you in the app about important changes.