Privacy Policy
Operator and data controller: Oxynlabs LLC. Contact: support@cringy.io
This policy explains how the Cringy app for iPhone and Android, and this website (cringy.io), handle your data. In this policy, "we", "us" and "our" mean the operator named above. "You" means the person using the app.
- Your chat file is read on your phone. The stats are made on your phone. We do not upload your whole chat.
- To write the AI report, the app sends a selection of your text messages and the stats to our server. Links, email addresses and phone numbers are removed first. Names and other details inside messages are not removed.
- Our server passes this to an AI provider and does not save your messages. It does save the AI result (which can quote a few short lines from the chat) for up to 180 days after its last use, so the same chat gives the same report without a new charge.
- No account, name or email. A random device id, usage events and your IP address are kept, as explained below.
- We never sell your data and we do not show ads.
1. Your chat export stays on your phone
You choose a WhatsApp chat export file (the file WhatsApp makes when you use Export Chat). The app opens it on your phone. Your phone's file picker puts a temporary copy of the file in the app's cache folder, which your phone can clear at any time and which is removed when you uninstall the app.
The statistics are computed on your phone: message counts, reply times, who starts conversations, deleted messages, top words, longest messages and long silences. The app does not upload the chat file, photos, videos, voice notes or other media to us.
The report you see is kept in the app's memory while you use it. The app does not save your chats or reports on our servers.
2. What the app sends to make the AI report
When you start an analysis, the app sends this to our server (our own API):
- Your device id (see section 3), so the server can check if you have a subscription.
- Your choices: the type of relationship you picked (for example crush, ex or friend), the gender option you picked, and the app language.
- Stats about the chat: message counts, first and last message dates, average reply times, who starts conversations, number of deleted messages, the top words of each person, a month by month summary of these numbers, and the long silences. This includes the other person's name as it appears in the export.
- A selection of text messages: for each one, who sent it (you or the other person), the time, and the text, cut to 400 characters. Deleted messages are sent only as "[deleted a message]".
Before anything is sent, the app replaces links with "[link]", email addresses with "[email]" and phone numbers with "[number]". It does not remove names or other personal details written inside messages.
How much is sent: up to about 200,000 characters of messages (about 60,000 for chats mostly in Chinese, Japanese or Korean). For a long chat, the app picks messages from the whole history: how it started, important moments and the most recent part. For a short or average chat, this can be all of your text messages.
If you do not have a subscription yet, our server checks that first and answers "locked". In that case the messages are not passed to the AI provider and not saved.
3. Your device id
The first time you open the app, it makes a random id and stores it on your phone. It is not your phone's serial number or advertising id. The app sends it to our server, which creates a record for it with the app name and the operating system (iOS or Android). We use this id to know if you have a subscription, to count how many AI reports you have run, and to link usage events and purchases. The app will show this id in Settings > Device ID so you can give it to us when you ask for help or deletion.
4. What happens on our server
With a subscription, our server sends the stats and the selected messages to an AI provider (see section 7). The AI writes the report: a verdict, labels, red flags with short exact quotes from the other person's messages, and an estimate of blocks with short quotes and notes. For the block estimate, a second, smaller AI model may read up to 13 messages around one line to check it.
What we do not keep: we do not save the messages or the stats you send. Our server logs keep one line per request (time, address called, result, device id) and never the content you send.
What we keep:
- The AI result, in a cache. It is stored under a fingerprint (a one-way hash) of the input, not under your device id. If the same chat is analyzed again, we return the stored result instead of running the AI again. It is deleted automatically 180 days after it was last used. Because it can contain short quotes from the chat, please note it exists. As it is not linked to your device id, we usually cannot find it from a deletion request, but it expires on its own.
- A usage record for each AI run: your device id, the number of messages, language, relationship type, AI model, size of the request and its cost. No message text. Deleted after 90 days.
- Counters on your device record: how many reports you ran, today and in total, the date of the last one, and the AI cost of your subscription period, so we can apply fair use limits.
5. Usage events (analytics)
The app sends simple events to our server, for example "app opened", "file read" with the file format, "file could not be read" with an error code, and "buy button tapped" with the plan. Each event has your device id, the app name and your operating system. Events never contain message text or names.
Our server stores these events in our database (deleted after 90 days) and forwards them to PostHog, a product analytics service, to help us see which steps work and fix bugs. We do not use them for ads. The app has no advertising SDK and does not track you across other companies' apps or websites.
6. Your IP address
Every request reaches our server with your IP address. For some actions (opening the app, which registers your device, and running an analysis) we record the IP address with your device id, the day, the action, the number of times and your app's user agent. We keep this to stop abuse and fraud and to handle payment disputes, which can come months later. This log has no automatic end date. We delete it when it is no longer needed for that purpose, or when you ask, unless we must keep it for an open dispute or a legal claim.
7. Who we share data with
We share data only with service providers that help us run Cringy, and only what they need:
| Provider | What for | What they get |
|---|---|---|
| APIYI (apiyi.com), an AI gateway, and the AI model makers it forwards to (currently OpenAI for the report and Google for the block check) | Writing the AI report | The stats and selected messages from section 2, without your device id |
| Our server host and MongoDB Atlas (database) | Running our API and storing records | Everything our server keeps (sections 3 to 6) |
| PostHog | Product analytics | Usage events with your device id |
| RevenueCat | Managing subscriptions | Your device id, your purchase receipts and basic app and device information |
| Apple (App Store) and Google (Google Play) | Payments, refunds, app delivery | They handle your payment under their own privacy policies. We never see your card or bank details. |
These providers handle data under their own terms. We do not control how long AI providers keep request logs on their side. We may also share data if the law requires it, to protect our rights or users' safety, or as part of a sale or transfer of the business (this policy would still apply). We never sell your personal data, and we do not "share" it for cross-context behavioral advertising as defined in California law.
8. Payments
Subscriptions are bought through the App Store or Google Play. Apple or Google take the payment and know your account. We receive, through RevenueCat, whether your device id has an active subscription, the product, and the purchase and renewal dates. We do not receive your name, email or payment details from them.
9. What we do not collect
The app does not ask for an account, your name, email or phone number. It does not read your contacts, photos, location, microphone or camera. It only reads the file you choose.
10. Why we use your data (legal bases)
If you are in the European Economic Area, the UK or Switzerland, we rely on these legal bases:
- To provide the service you ask for (contract): making the report, checking your subscription, restoring purchases.
- Our legitimate interests: keeping the service safe, stopping fraud and abuse, handling disputes, fair use limits, and understanding how the app is used so we can fix it.
- Legal obligations: for example tax and accounting records, and answering lawful requests.
Chats can contain sensitive details about you and others. You choose to give us that content for the report, and we use it only to make the report.
11. Other people in your chat
A chat contains the other person's messages too. Only analyze chats you are part of, and think about their privacy. The selected messages are used only to make your report, and we do not build profiles of the people in your chats.
12. How long we keep data
| Data | Kept for |
|---|---|
| Chat file and report on your phone | Until your phone clears the cache, you close the app, or you uninstall it |
| Messages and stats sent for the AI report | Not saved by us |
| AI result (cache) | 180 days after its last use, then deleted automatically |
| Usage events and AI usage records | 90 days in our database. PostHog keeps events under its own retention settings. |
| Device record and counters | While you use the app, or until you ask us to delete it |
| IP address log | As long as needed for fraud, abuse and disputes, or until you ask (see section 6) |
| Purchase records | As long as your subscription is active, and after that as long as the law requires for tax and accounting |
13. Your rights
Depending on where you live (for example under the GDPR in Europe, or the CCPA in California), you can ask us to:
- tell you what data we have about you and give you a copy,
- correct it,
- delete it,
- limit or object to how we use it,
- move it to another service (portability).
We will not treat you differently for using these rights. If we rely on your consent for something, you can take it back at any time.
How to ask: email support@cringy.io with the device id shown in the app (Settings > Device ID). We do not have your name or email, so the device id is how we find your data. We answer within 30 days. If you are in Europe or the UK, you can also complain to your local data protection authority.
Step by step deletion instructions are on our Support page.
14. Children
Cringy is not for children under 13, and the app is rated 13+. We do not knowingly collect data from children under 13. If you are under 18 and live in a country where the law requires a parent's consent to use an app like this (for example some countries in the European Union), you need that consent first. If you think a child under 13 has used the app, email us with the device id and we will delete the data.
15. International transfers
Our providers may process data in other countries, including the United States, where data protection laws can be different from yours. Where the law requires it, we rely on safeguards such as the European Commission's Standard Contractual Clauses offered by our providers.
16. Security
The app talks to our server over HTTPS, so data is encrypted while it travels. Access to our server and database is limited to the people who run Cringy. No system is perfectly safe, so we keep as little as we can, as described above.
17. This website
cringy.io is a simple static website. It has no analytics, no cookies and no ads. Our hosting provider (Cloudflare) handles the requests and may keep short technical logs, such as IP addresses, for security.
18. Changes to this policy
If we change this policy, we will update the date at the top of this page. If the change is important, we will also tell you in the app before it applies.
19. Contact
For any question about privacy, email support@cringy.io.