privacy policy

effective May 1, 2026

Crayon is a private place for two people to leave each other small drawings, color washes, and questions. We try to keep your data on your phone — and when it has to leave, we keep it minimal, encrypted, and short-lived.

This policy explains exactly what data the Crayon iOS app collects, who processes it, and how long it lives.

What we collect

account identity

• Anonymous user ID. When you first open the app, we sign you in anonymously through our cloud backend. This ID is a random UUID — no email, no phone number, no name from another service.
• Display name. The name you type when you pair (e.g. "A" or "Aanya"). Stored on your user row so your partner sees it.
• Couple ID. A random UUID linking you and your partner once you've both confirmed pairing. Deleted on unpair.

messages, drawings, and moods

• Drawings, color moods, and questions are end-to-end encrypted on your device with a key derived from a Curve25519 key exchange between you and your partner. The server only ever sees ciphertext.
• Drawings themselves are not persisted server-side. Their stroke data is replayed live and not stored. Only a small encrypted payload representing the message arrives on the server.
• Messages are ephemeral. Once your partner views a message, the server deletes it within ~60 seconds. Unviewed messages auto-expire after 1 day.

device + push

• APNs device token. Apple gives us a per-device push token so we can send a silent push when your partner sends you a moment. The token is stored on your user row alongside whether the build is sandbox or production.
• Build / OS / region metadata. Release builds upload app version, iOS version, device model, and country (derived from the App Store region) for product analytics. Debug builds skip this.

subscription

• Subscription state. When you subscribe through the App Store, our subscription management platform tracks the purchase against an identifier we set to your anonymous user ID. We mirror the resulting status (active / expired / lifetime / billing-issue) onto your user row so your partner can also see "the box is unlocked".
• Apple processes the actual payment. We never see your card or billing details.

diagnostics + analytics

• Crash reports. Our crash reporting service records stack traces if the app crashes. We tag reports with your anonymous user ID so we can correlate a crash to a "support code" you send us by email.
• Product analytics. Our product analytics provider records aggregate events (e.g. "message_sent", "paywall_opened") in Release builds. Debug builds skip this.
• Session replay (Microsoft Clarity). We use Microsoft Clarity in Release builds only to capture gesture-level session replays so we can see how the app is used in the real world and fix awkward flows. Inputs you type are masked by default by Clarity's SDK. Microsoft Clarity is named here per their disclosure terms — see Microsoft's privacy statement for how they handle the data.
• On-device debug log. The app keeps a rolling 200KB log of launch / push / refresh events on your device. Names and pair codes are redacted before they're written. Nothing is uploaded automatically — you can share this log via the "something feels off?" button in Settings only when you choose to.

How we use the data

• Deliver your partner's message to your device + widget.
• Authenticate you against your couple on every request.
• Bill you for a subscription and mirror entitlement state for both partners.
• Diagnose crashes, fix bugs, and improve the experience.
• Surface usage trends in aggregate (no per-user dashboards).

We do not sell your data, build advertising profiles, or share it with anyone outside the categories of service providers listed below.

Categories of service providers we use

• Apple. App Store, push notifications, and in-app purchase. Named because Apple is the platform.
• Cloud backend provider. Hosts the database, authentication, and the encrypted message rows.
• Subscription management platform. Tracks subscription state and entitlement transfer across devices.
• Crash reporting service. Receives stack traces tagged with your anonymous user ID when the app crashes.
• Product analytics provider. Receives aggregated event data in Release builds only (e.g. how many people opened the paywall last week).
• Microsoft Clarity. Session replay in Release builds only. Named per Clarity's disclosure terms.

For the current list of named subprocessors with their respective privacy policies, email tech.noobqa@gmail.com with subject "subprocessors" and we'll send it back.

Encryption + retention

• Drawings, color messages, and questions are end-to-end encrypted; the server cannot read them.
• Viewed messages are deleted within ~60 seconds by a server-side sweep.
• Unviewed messages expire after 1 day.
• Pair codes expire after 5 minutes.
• The on-device debug log self-rotates at 200KB; you can clear it any time.
• Diagnostic data sent to our crash, analytics, and session-replay providers is governed by their respective retention policies — typically 30 to 90 days.

Your rights

• Unpair. Tap "ask {partner} to unpair" in Settings. Once both confirm, every message, drawing, mood, and shared key is erased from both phones and the server.
• Force-end. If your partner doesn't respond within 3 days, you can unilaterally end the pair from your side.
• Delete your account / data. Email tech.noobqa@gmail.com with your support code (Settings → "send to support") and we'll wipe your account and any backend traces within 14 days.
• Export. Same email — we'll export your encrypted messages and metadata to you on request.

Children

Crayon is not directed at children under 13. If you're a parent or guardian and believe your child has used the app, email us and we'll remove their data.

Changes

We may update this policy from time to time. The "effective" date at the top reflects the latest revision. Material changes will be communicated in-app before they take effect.

Contact

Questions? Reach us at tech.noobqa@gmail.com.