Privacy Policy

2.Who this covers

“Hosts” create an account and design an event app. “Guests” open an event app a host shares with them. “Visitors” browse crested.app without doing either.

Hosts decide who is invited and what goes into their event, including the names and contact details they add for guests. We process that information on the host’s behalf to run the event. If you’re a guest and want something about you changed or removed, ask the host, or email us and we’ll help.

3.What we collect

When you create a host account

• Your name (optional), email address, and password. We store your password only as a salted one-way hash, so we can’t read it.
• If you sign up or sign in with Google instead, Google sends us your name, your email address, and an ID for your Google account, and we use them only to sign you in. We don’t get your Google password or access to anything else in your Google account.
• When you created the account, when you agreed to our Terms and this policy, and whether you’ve verified your email.

When you design an event

• Everything in your design: event name, dates, time zone, places, schedule, colors, fonts, and module settings.
• Images and files you upload, such as hero photos, logos, profile photos, and documents.
• The guest list you build: names, photos, roles, and bios, plus any optional details you choose to add, like email addresses and phone numbers for invitations, Venmo or Cash App handles, home cities, pronouns, and golf handicaps.
• Your conversation with Monty (see “AI and Monty”).

When guests use an event app

• The name a guest picks from the guest list or types in.
• What guests add: posts and replies, photos, captions and hearts on photos, poll votes, tasks they add, task sign-ups and ticks, task status notes, bed claims, shared expenses (with an optional photo of the receipt) and side bets, the payments they record to settle up (who paid whom, how much, how, and who confirmed it), questions about an expense (“Something’s off?”, with an optional note), golf scores, travel plans such as flight numbers and arrival and departure times, payment handles, the amounts they chip in to a group gift (with any note they add) and whether the organizer marked them received, packing (what each guest has packed, the shared gear they said they’d bring, items they mark as renting or not needed, and personal items they add to their own list: only that guest sees those; the host sees a count, never the items), and the profile photo and one-line intro a guest can add to their own card on the crew list (everyone in the app sees them; the host can remove them), and a mobile number, only when a guest turns on sharing it with their crew (only the host and people on the crew list of an event with an invite code or password see it; the guest can turn it off at any time). A new expense typed but not yet sent is kept on that guest’s own phone until it is sent or discarded, and is cleared when they sign out or switch names.
• Who voted for what in a poll. The host always sees it; when the host turns on “Show who voted,” the other guests with a name in the app see it too, and each poll says who can see a pick.
• In an event’s Documents: a “Done” tick on a file the host asked guests to act on (the guest’s name and when they ticked it), and, when the host allows it, links a guest adds (the link, its name and note, who added it, and when).
• A precise location, only when a guest chooses to share it (see “Location sharing”).
• A record of each time someone opens the event app: the name they joined as, how they got in (an invitation, the event link, or as the host), when, and a random ID their browser makes up for itself so the host can see a guest opened the app on two phones. That ID is not a device fingerprint and says nothing about the phone.
• Notification settings a guest chooses, and an email address a guest adds to hear about the trip.
• If a guest turns on notifications on their phone, the push address their browser gives us (a web address at Apple, Google, or Mozilla’s push service, plus the keys to encrypt messages to it).

When you pay

• Payments go through Stripe Checkout. Stripe collects your card details directly. We receive a confirmation with the amount, currency, date, the event it’s for, the email you gave Stripe, and Stripe’s reference numbers. We never receive or store your full card number.

When we send messages

• When a host sends invitations, we pass the email address or phone number, the message, and the invite link to our email and text-message providers, and we keep a record that the invitation was sent.
• We also send account emails such as email verification, password resets, receipts, and reminders about an event you’re hosting.
• Guests with an email address (one the host added, one on their invitation, or one they added themselves) get a note a few days before the trip with their link to the app, a short plan on each morning of the trip, and reminders or announcements the host chooses to email. Every one of these has an unsubscribe link, and a host can turn them off for their event. We keep a record of what was sent so no one gets the same email twice.

Automatically

• Your IP address, browser type, and the pages you request. Our hosting provider logs these, and we use them to keep Crested secure and to limit abuse, for example with rate limits on sign-in and on Monty.
• The cookies and on-device storage described under “Cookies and local storage”.

If you contact us

• Your email address and message.

4.Photos

Photos you add to an event are resized on your device before upload. That saves a new copy without embedded metadata such as GPS location; only the time the photo was taken is read first and kept, so the wall can group photos by the day they were taken. Animated GIFs, and any other photo your device can’t process, are uploaded as they are and may still contain that metadata; a HEIC photo your device can’t convert is refused instead of uploaded. Documents are uploaded as they are. Anyone who can open the event can see its photos. The person who posted a photo, or the host, can delete it.

5.Location sharing

Event apps never track your location in the background. We collect a guest’s location only when they tap to share it on the event map and allow it in their browser. The guest chooses how: “Just this spot” takes one reading, so the pin doesn’t move as you do; “Follow me” updates the pin as you move, but only while the event app is open on your screen (it stops when you close the app or lock your phone), and we keep only your latest position, not a trail. Others in the event can see it until the share expires, after the time the guest picks (24 hours at most), and the guest can stop sharing sooner. When a share expires it stops showing right away, and we delete it from our database within a day after that. Every shared location is also deleted when the host deletes the event. The event’s host can turn location sharing off for the whole event (existing shares stop showing at once) and can take down anyone’s shared location.

“Where am I” on the event map shows your own position on your phone only. That reading is never sent to us or to anyone else.

6.AI and Monty

Monty is the AI concierge in our app builder. It’s built on Claude, a model made by Anthropic. When you chat with Monty, we send Anthropic your messages, the current state of your design (which can include your guests’ names), and any group-chat export or screenshots you attach, so it can write a reply and suggest changes. Your guests’ email addresses, phone numbers and payment notes, your event’s access code, the door and Wi-Fi codes, room codes and check-in steps in the Stay module, and lines in Info that look like codes are left out.

• Screenshots you attach are stored only so Monty can read them. Your browser deletes them once Monty has read them. If it can’t, for example because you closed the tab first, a daily cleanup on our servers deletes any screenshot that is more than a day old.
• Your chat history is saved in your browser’s localStorage so it survives a refresh. We don’t keep a copy of your Monty conversations on our servers.
• Anthropic processes this content as our service provider. Under Anthropic’s commercial terms, it doesn’t use content sent through its API to train its models, and it keeps that content only for a limited time, for purposes such as preventing abuse.
• We count Monty usage per account and per network address to keep it fair and stop abuse.
• Monty can be wrong. Check what it fills in, especially addresses, dates, times, and prices, before you launch.

Monty in a live event app (the Concierge, in Beta). If a host adds the Concierge, anyone in the group can ask Monty for places to eat or things to do. To answer, we send Anthropic the question, the rest of that person’s chat with Monty, their name, and the event details guests can already see: the schedule, the places you’re staying and visiting with their addresses, the route, the packing list’s must-haves, the group’s size and its open plans. Door codes, Wi-Fi passwords and payment notes are never sent. Monty uses Anthropic’s web search to find places, so the search terms it writes go to the search provider too, without your name.

• Each person’s chat stays in their own browser. While Monty works on an answer, the question and the answer are kept on our servers so the answer survives the person leaving the page; they’re deleted once their phone collects the answer, and after 24 hours at most.
• Plans the group makes with Monty (the options, the votes and who started them) and polls it starts are stored with names, like any poll in the app, until the host deletes the event.
• We count how much each person asks Monty each day, to keep one person from using up the group’s share; those counts are deleted after 7 days.
• Monty can’t book, reserve or pay for anything. Check hours and details with the place before you go.
• Please don’t share passwords, payment card numbers, or government ID numbers with Monty. The door code and Wi-Fi for the place you’re staying belong in the Stay module’s code fields: they’re shown only to guests who picked their name (on an open event, only to guests who opened their invite link, unless you choose to show them to anyone who picks a name), and they’re hidden from guests the day after the trip.

7.How we use information

• To run Crested: save your designs, publish your event app, show guests the right content, and keep everyone’s additions in sync.
• To send the messages you ask for, like invitations, and the ones the service needs, like verification, password resets, receipts, and event reminders.
• To process payments and keep accounting and tax records.
• To keep Crested secure: prevent spam, fraud, and abuse, and enforce our Terms.
• To answer you when you contact us.
• To understand and improve Crested, using aggregate information.

We don’t sell your personal information or share it for cross-context behavioral advertising, and we don’t show ads.

8.Who we share it with

Other people in your event. An event app is shared by link. Anyone with the link, plus the invite code if the host set one, can see the event’s content, including guest-list names, photos, and bios, and what other guests post. Email addresses and phone numbers a host adds for invitations aren’t shown to guests. Venmo and Cash App handles are shown so guests can pay each other.

Service providers who run parts of Crested for us under contracts that limit how they can use your information:

• Vercel — hosting, and storage for images and files uploaded in the builder
• Google Firebase — our database
• Google Sign-In — when you choose Continue with Google
• Cloudflare R2 — storage for photos guests upload
• Anthropic — the AI behind Monty
• Stripe — payments
• Resend — email
• Apple, Google, and Mozilla push services — delivering notifications to guests who turn them on; each message is encrypted so the push service can’t read it
• Twilio — text messages
• Google Maps Platform — address search, maps, and directions, when you use venue or map features
• Google Fonts and Unsplash — fonts and stock photos your browser loads directly from their servers, so they receive your IP address
• Plausible Analytics — cookieless, aggregate counts of visits to crested.app’s own pages (never pages inside an event app), only when we have analytics turned on. Your browser loads its script and reports each page view to it, so it receives your IP address and browser type; it sets no cookies
• Slack or Discord — alerts to our team when something breaks: error details such as the page, the browser type, a request reference and, for a text-message error, the last four digits of the phone number, with access tokens and other secrets removed

Legal and safety. We may disclose information if the law requires it, or if we believe in good faith it’s needed to protect someone’s safety, investigate fraud or abuse, or protect Crested’s rights.

Business changes. If Crested is involved in a merger, acquisition, or sale of assets, information may transfer as part of that deal, and this policy will keep applying to it.

9.Text messages

If a host invites you by text, we send the message through Twilio. Reply STOP to stop texts from Crested, or HELP for help. If you reply STOP, we keep your phone number on our do-not-text list for as long as we send texts, even after the event or the host’s account is deleted, so we keep honoring it; reply START to come off the list. Message and data rates may apply. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text-messaging opt-in data and consent are not shared with any third parties.

10.Cookies and local storage

We use login cookies, a referral cookie, a beta-code cookie and storage on your device. No ad trackers.

• Login cookies. If you’re a host, a cookie named crested_session keeps you signed in for up to 60 days, and a cookie named crested_known remembers, for up to a year, that your account has signed in on this browser (as a coded tag, not your email), so that someone else guessing at your password can’t lock this browser out of signing in. It stays after you sign out and signs no one in. If you’re a guest, a cookie whose name starts with crested_g_ remembers that you’ve joined a particular event (one per event), also for up to 60 days. If you sign in with Google, two short-lived cookies carry the sign-in while it is in progress: crested_google_flow (the security values of that sign-in, for 10 minutes) and, for a new account, crested_google_signup (your Google name and email until you agree to our terms, for 15 minutes). These cookies are strictly necessary, so there’s nothing to accept.
• Beta-code cookie. While Crested is in a closed beta, entering a beta code, or opening the sign-up page after following an invite link that carries one (Crested checks the link’s code then, without you typing it), sets a cookie named crested_beta that holds the code for up to 60 days. It lets this browser into the editor, fills in the code when you create an account, and that code is then recorded on your account as how you joined. It holds only the code, and you can delete it by clearing your cookies.
• Referral cookie. If you arrive through a link with a referral code (a friend’s invite link or a partner’s), a cookie named crested_ref remembers that code for up to 60 days, so that if you create an account we can credit whoever referred you. It holds only the code, is read only by Crested when you sign up, and you can delete it by clearing your cookies.
• Local storage. Your browser saves your in-progress design, your Monty chat, looked-up map addresses, small preferences like whether you dismissed the install prompt, and, for each event you open, who you joined as and its colors and initials (so it opens as you, and in its look even offline), on your device using localStorage and sessionStorage. Clearing your browser data removes them.
• The offline copy. So an event app still opens with no signal, your browser keeps the last copy of the event it showed you (the schedule, places, the guest list and what you last saw in each section) in its own storage (IndexedDB and the browser’s cache) on your device. It is tied to the name you joined as: it is deleted when you sign out of the event, what you last saw in each section is deleted when you pick another name, and it deletes itself 3 days after the trip ends, or 45 days after it was saved, whichever comes first. A random ID for your browser is kept there too (see “What we collect”).
• No ad trackers. We don’t use advertising cookies, tracking pixels, or third-party cookies that follow you across sites. If we measure visits to our pages, we use cookieless, aggregate analytics that don’t identify you.

11.How long we keep it

• Your account: until you delete it.
• Event apps and everything guests added: until the host deletes the app or their account, except that in-app notifications are deleted after 30 days, and a host can set a photo gallery to delete its photos a chosen number of days after the trip ends, or after each photo was posted for galleries set up before September 30, 2026 (checked once a day; guests are told a week ahead). Taking an app offline keeps its content so the host can bring it back. Deleting it removes the design, guest posts, photos, guests’ crew profile photos, intro lines and the phone numbers guests chose to share with their crew, votes, tasks with their sign-ups and status notes, bed claims, expenses and their receipt photos, recorded payments, questions about expenses, scores, travel plans, shared locations, Documents “Done” ticks and guest-added links, and invitations. We hold the event’s web address for 90 days after it goes offline so no one else can claim it right away; that hold contains no event content.
• Event documents: guests stop seeing a host’s document links a set time after the event ends (30 days unless the host picks 7, 90 days, or to keep them). The files themselves stay at their links, and anyone who already has a link can still open it, until the host removes them or deletes the app.
• Shared locations: shown until the share expires (24 hours at most), then deleted from our database within a day, whether or not the app is still online.
• Join records, notification settings, and the record of trip emails sent: kept with the event app and deleted with it.
• Push addresses: deleted when a guest turns notifications off, when the push service says the address no longer works, once the app is offline, or after 60 days without use.
• Email addresses that unsubscribed from trip emails: kept on our do-not-email list, as a one-way hash rather than the address itself, for as long as we send trip emails, even after the event or the host’s account is deleted, so the unsubscribe keeps working.
• Monty screenshots: deleted once Monty has read them. Any your browser couldn’t delete are removed by a daily cleanup on our servers once they are more than a day old.
• Phone numbers that replied STOP: kept on our do-not-text list for as long as we send texts, even after the event or the host’s account is deleted, so the opt-out keeps working. Reply START to come off it.
• Monty usage counts: the per-network counts for people who aren’t signed in are deleted after 7 days; the counts for your account are kept with it until you delete it. In a live event, each person’s daily Concierge count is deleted after 7 days.
• Concierge answers in progress: deleted once the asker’s phone collects the answer, and after 24 hours at most.
• Payment records: as long as tax and accounting law requires, typically seven years, even after you delete your account.
• Emails to us: until you ask us to delete them. Sign-ups from our earlier waitlist (an email address, the page signed up from and the referring page, browser type, and IP address) are also kept until you ask us to delete them.
• Logs and backups: copies expire on our providers’ normal schedules.
• Images and files you upload in the builder: deleted when you remove or replace them and save (once guests no longer see them), and when you delete the app or your account, unless another of your apps, a template or a decoration still uses them. Uploads you never save, and uploads made before you created an account, are deleted by a daily cleanup once they are 90 days old and nothing uses them. Email us and we’ll remove one sooner.

12.Your choices and rights

• See and export: download a copy of your apps from your account settings, or email us.
• Correct: edit your account and your apps at any time.
• Delete: delete an app from your dashboard, or delete your whole account from your account settings. Deleting your account permanently removes your apps and everything guests added to them.
• Guests: delete what you posted in the app, ask the host, or email us.
• Texts: reply STOP.
• Notifications: turn them off, or choose which kinds you get, from the bell in the event app, or in your phone’s settings.
• Trip emails: use the unsubscribe link in any of them, or switch them off in the event app’s notification settings. Hosts can turn them off for their whole event.
• Email: account emails are part of the service. If we ever email you news about Crested, you can unsubscribe at any time.

Depending on where you live (for example, California, Colorado, Connecticut, Virginia, and other US states), you may have the right to know what personal information we hold about you, get a copy, correct it, delete it, and opt out of its sale or use for targeted advertising. We don’t sell personal information or use it for targeted advertising. To make a request, email hello@crested.app from the address on your account. We’ll verify your request and respond within 45 days, and we won’t treat you differently for making it. You can use an authorized agent, and you can appeal our decision by replying to our response.

13.Security

We protect your information with encrypted connections (HTTPS), hashed passwords, signed login cookies, and a database that can be reached only through our servers. Hosts can require an invite code for their event. No system is perfectly secure. If you think your account has been compromised, change your password and email us.

14.Children

Crested isn’t directed to children under 13, and we don’t knowingly collect personal information from them. Host accounts are for adults 18 and older. Guests under 13 shouldn’t use an event app on their own; a parent or guardian can take part for them. If you believe a child under 13 has given us personal information, email us and we’ll delete it.

15.Where we process data

Crested is based in the United States. We and our providers process and store information in the United States. If you use Crested from elsewhere, your information will be transferred to the US.

16.Changes to this policy

If we make material changes, we’ll update the date at the top and tell hosts by email or in the app before they take effect. The current version is always at crested.app/privacy.

17.Contact

Questions or requests: hello@crested.app.