CROWDWRANGLER PRIVACY POLICY
Version and effective date: 16 August 2026
This Privacy Policy explains how IPEVENTS LIMITED, operating as CrowdWrangler (we, us), uses personal information in the CrowdWrangler website, web app, mobile apps and related services (the Service).
We are the controller for the platform processing described here. A Crowd organiser may have separate data-protection responsibilities for why it asks members or applicants for particular information and for any information it uses outside CrowdWrangler. Contact the organiser about that separate use. We remain responsible for the processing that CrowdWrangler controls.
Contact us about privacy at support@crowdwrangler.com. The website is https://crowdwrangler.com.
1. Who This Policy Covers
This Policy covers account holders, public-event guests, people represented by managed child profiles, people invited to a Crowd or Family, people whose content or conduct is reported, and visitors to our public website and web app.
An account holder must be at least 13. An eligible adult can create a managed child profile for a younger child. That profile cannot sign in. Some public guest actions are available only to a person who confirms that they are 18 or over.
2. Information We Use And Where It Comes From
We collect information directly from you, from other people using the Service, from a supported authentication or age-signal provider, and automatically from your device and use of the Service.
Account and authentication information
- Firebase user identifier, email address, email-verification status, supported sign-in provider and authentication/security events;
- display name, profile image and account status;
- the versions and time of legal-policy acceptance; and
- notification preferences, timezone and push-notification device tokens.
We do not receive your password from Google or Apple. For email/password authentication, Firebase provides the authentication service; CrowdWrangler does not store the password in its application database.
Age and Family-safety information
- an age range: under 13, 13–15, 16–17 or 18+;
- whether the range was declared by the user or a Family adult, or supplied by a supported platform age signal; its evidence level, current state, policy version and relevant timestamps;
- the minimum provider challenge, integrity, approval or revocation information needed to prevent replay and apply the result; and
- Family membership, manager status, responsible-adult relationships, safety acknowledgements, requested approvals and configured teen controls.
We do not ask for or store a date of birth or identity-document copy for the ordinary age-range process. A provider may handle information under its own privacy terms before returning a minimum result to us.
Crowd, Family and event information
- Crowds, groups, roles, memberships, invitations and join applications;
- application form definitions and applicant responses;
- Family roster, managed child profile, sharing and delegated-action choices;
- events, recurring events, venue addresses, coordinates, invitations, attendance and RSVP choices; and
- event feedback and attendance reports.
An eligible adult can explicitly use their device position to prioritise a location search or select a venue. We use that position only for the requested action, send the necessary query through our backend to the mapping provider and do not use it for continuous tracking. Under-18 accounts cannot use precise device location. Stored venue information describes a Crowd or event location, not a person's live location.
Communications and user content
- announcements, questions, replies, feedback, profile and Crowd images;
- membership-form questions, help text and choices; and
- metadata needed to deliver, edit, acknowledge or remove that content.
Do not use ordinary fields for passwords, authentication codes, payment-card details, bank credentials, identity-document copies, medical records or other unnecessary highly sensitive information. Crowd organisers must ask only for information genuinely needed for membership or event administration.
Safety, moderation and support information
- blocks, content reports, reporter explanations, appeals and the minimum content snapshot or isolated evidence needed for review;
- local and external automated moderation status, categories, scores and technical workflow records;
- platform actions, notices and limited audit history; and
- support messages and the information needed to answer them.
Eligible public or member-visible text and images can receive an external automated moderation review after a local check. This includes display names, avatars, announcements, Q&A, visible Crowd/group/event details and membership form definitions. We do not send confidential membership-application answers, private Family names or Family metadata to the external moderation provider. A report explanation can be sent after the report is accepted only as a non-destructive routing or prioritisation signal; we do not include structured identity, contact, age or Family metadata or resolution notes in that payload.
Essential technical information
- IP address, request time, security and authentication events, App Check result, rate-limit state, device/app/browser type and software version;
- service logs, correlation identifiers, error details and availability or performance metrics; and
- necessary cookies, local storage and similar technology used for sign-in, security, preferences, network operation and the requested Service.
We design production logs and metrics not to contain message content, email, display name, age range or Family relationships. A fault can still create limited technical context, which is access-controlled and retained for a short period.
Optional app diagnostics and product analytics
Eligible adult account holders can separately choose whether to share:
- crash and performance diagnostics through Firebase Crashlytics and Firebase Performance Monitoring; and
- limited feature-completion and screen-category events through Firebase Analytics.
Both choices are off until selected, are device-scoped and can be changed in Settings without losing core functionality. Under-18 accounts are not eligible for optional telemetry. We do not attach a CrowdWrangler account ID, email, display name, content, invite code, search text, precise location or full URL. Firebase can still process a pseudonymous app-instance identifier, device metadata and automatic app-lifecycle events when the relevant collection is enabled.
Our public marketing site does not use optional analytics or advertising cookies at launch. Necessary web-app storage remains available for sign-in, security and requested features.
3. Why We Use Information
| Purpose | Main lawful basis |
|---|---|
| Create and authenticate an eligible account; provide Crowds, events, communications, Family functions, requested location actions and account deletion | Performance of our agreement where applicable; our legitimate interests in providing the requested Service, particularly where contract is not the appropriate basis for a child or managed profile |
| Apply age ranges, teen protections, high-privacy defaults and Family safety controls | Our legitimate interests and the recognised interest in safeguarding people who need additional protection; legal obligation where a specific duty applies |
| Secure the Service, prevent fraud and abuse, authenticate clients, investigate faults and maintain short-lived operational logs | Our legitimate interests in protecting users and the Service; legal obligation where applicable |
| Check, moderate and respond to content, reports, complaints and appeals | Our legitimate interests, including keeping the Service safe and enforcing the Community Guidelines; legal obligation where online-safety or other law requires action |
| Send invitations, verification, security, attendance, account, safety and service messages | Performance of our agreement where applicable; our legitimate interests in operating and protecting the Service |
| Keep required compliance, deletion, moderation and legal records and respond to lawful requests | Legal obligation; our legitimate interests in establishing, exercising or defending legal rights |
| Process optional diagnostics and product analytics | Consent, which can be withdrawn in Settings |
Where we rely on legitimate interests, we assess necessity and balance those interests against people's rights, giving extra weight to the interests of children. We do not use optional analytics, advertising or a general claim of service improvement as a reason to reuse content unexpectedly.
If information is required to create an account or perform a requested action, not providing it means we may be unable to provide that account or action. Optional telemetry and optional device location are not required for ordinary use.
4. Who Can See Information Inside CrowdWrangler
Access depends on the relevant Crowd, group, event, role, Family relationship, age, block and privacy settings. Public Crowd and event information can be seen without joining. Member-only information is limited to authorised members and roles.
Joining a Family shows the Family roster identity—display name, avatar and manager or managed-child status—to Family members. It does not by itself expose an email address, age range, responsible-adult relationship or unrelated account activity.
Adults control Family-derived visibility of their own Crowd memberships and attendance, and separately control whether another eligible Family member can manage memberships or RSVPs for them. Managed child profiles remain visible to current Family managers for safeguarding and administration. Teen responsible- adult access is limited to the accepted relationship and configured controls; it is not general account surveillance. Blocking disables applicable Family-derived sharing and delegation.
Information somebody has already viewed, copied or exported cannot always be recalled from their device. Offline clients must reconnect before a changed permission can take effect locally.
5. Service Providers And Other Disclosures
We give providers only the information needed for their function and use contracts and access controls appropriate to the relationship. Launch provider categories include:
- Google Firebase: authentication, App Check, push notifications and, only where enabled, Analytics, Crashlytics and Performance Monitoring;
- Apple and Google platform services: supported sign-in, app distribution, device permissions, platform integrity and minimum age-signal results;
- hosting, database, object-storage, edge-security and monitoring providers: application delivery, storage, backup, logs, metrics and security;
- email providers: verification, invitation, attendance, account, safety and support-related delivery;
- OpenAI: asynchronous automated moderation for the eligible content and limited report-explanation uses described above, using the approved moderation data controls;
- Geoapify and mapping data providers: backend geocoding and map content for a requested search or venue action, without a CrowdWrangler account identity; and
- professional advisers, courts, regulators and public authorities: only where reasonably necessary, legally required or needed to establish, exercise or defend legal rights.
We may disclose information to a successor if the Service or company is reorganised or transferred, subject to appropriate confidentiality and continued data-protection obligations.
We do not sell personal information. We do not use personal information for third-party behavioural advertising.
6. International Transfers
Some providers may process information outside the United Kingdom. Where a restricted transfer occurs, we use a lawful transfer mechanism such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved contractual clauses, or another permitted safeguard. We carry out the required assessment where a safeguard requires it. Contact us if you want more information about the safeguard relevant to your information.
7. How Long We Keep Information
We keep information only for the purpose and period described below, unless a specific legal requirement or documented preservation instruction requires a different period for identified records.
| Information | Launch retention |
|---|---|
| Active account, profile, Family, Crowd membership and current event data | While the account or relevant relationship is active, followed by the deletion and limited-evidence rules below |
| Unpinned announcements and Q&A posts | Deleted after 60 days; a pinned post remains while pinned. A content-free “Content deleted” Q&A placeholder may remain only to preserve another person's reply |
| Notifications | 30 days; delivery/fan-out working records usually 7 days after completion and no more than 30 days while unsent |
| Device tokens | Deleted after 90 days without activity, or earlier through account deletion where controllable |
| Crowd audit records | 3 months |
| Historical events | 2 years |
| Unsubmitted join-application drafts | 7 days |
| Unresolved join applications | 30 days. Answers are deleted on approval, rejection or cancellation; prose-free outcome metadata is deleted after 90 days |
| Inactive guest/invited profiles | 30 days where there is no future RSVP |
| Inactive sign-in accounts | After 12 months of inactivity and a 30-day warning, except where ownership of a non-empty Crowd must first be resolved |
| Provisional registration | Cleanup begins after 7 days without meaningful progress and always within 30 days of creation; successful cleanup retry identifiers are removed within 30 days |
| Terminal automated moderation jobs | 10 days; unresolved or retryable jobs remain until they can be completed or handled as an incident |
| Report and appeal content/evidence | Reporter/appeal explanations, captured context and isolated evidence are deleted 90 days after the final outcome; terminal working rows are deleted within 365 days after sensitive cleanup succeeds |
| Reversible moderation state and privileged audit | Previous-state data remains while an action is active and for 90 days after closure or restoration; prose-free privileged audit is deleted after 12 months |
| Email delivery working records | Processed or superseded terminal records are deleted after 30 days; a minimum latest status may remain while the related user/action exists |
| Location preview objects no longer referenced | Up to 30 days |
| Production application logs | 14 days |
| Production metrics | 30 days |
| Firebase Analytics data | 2 months, with reset-on-new-activity disabled and no longer-retention export |
| Firebase Crashlytics data | Provider lifecycle of 90 days |
| Firebase Performance Monitoring data | Provider lifecycle of 30 days for IP-associated events and 60 days for installation-associated or de-identified performance data |
Support correspondence and provider delivery records are kept for the shortest practical configured period that supports the request, follow-up, security and legal obligations. We do not retain an indefinite or monthly archive at launch.
8. Account Deletion And Backups
Request deletion in the app or at https://app.crowdwrangler.com/account-deletion. Sign-in and recent authentication verify the request. The review explains what will happen to any sole-owned Crowd and Family before deletion is confirmed.
Application access and controllable live relational, identity and object data are removed through the deletion process. Crowd-owned data continues under an explicit ownership transfer or is deleted if the Crowd is dissolved. Your authored text, images and attribution are removed; a content-free structural placeholder remains only where needed to preserve another person's Q&A reply.
Narrow, access-restricted moderation/report evidence can remain until its existing period expires. This does not keep the public content or ordinary profile live. A specific legal preservation instruction may override deletion only for the identified records and period.
Encrypted backup copies expire within 30 days. A minimum restore-suppression record remains for 45 days so a restored backup cannot return a completed deletion to the live Service. Account deletion does not necessarily remove already de-identified or device-scoped optional telemetry held under the provider lifecycle above.
9. Automated Processing
Local automated checks can block new or edited free-form content before it is published. Eligible content that passes is queued for a second automated review and may later be hidden, removed or restored. A report explanation may be analysed only to assist internal routing or prioritisation; that result cannot reject, erase, resolve or delay the report or impose a sanction.
Age evidence is mapped to an age range and used to apply age-appropriate capabilities. We retain the source and evidence level so we do not describe a self-declared result as verified. Users can view and request correction of their range, and protective settings remain during relevant correction review.
Automated moderation can be wrong. A supported platform action includes notice and a human appeal route. We do not use automated processing to make a decision with legal or similarly significant effects without the safeguards required by law.
10. Your Rights
Depending on the circumstances, UK data-protection law gives you rights to:
- be informed about how your information is used;
- obtain a copy of your information;
- correct inaccurate or incomplete information;
- ask for erasure or restriction;
- object to processing based on legitimate interests;
- receive eligible information in a portable format;
- withdraw consent for optional telemetry at any time; and
- ask for safeguards around qualifying automated decisions.
These rights can have legal limits, including where information concerns other people or must be retained for a specific obligation. A child has their own data-protection rights. We assess who can exercise them according to the person's understanding and the circumstances, not merely Family-manager status.
Use in-app controls where available or email support@crowdwrangler.com. We may need to verify the request without asking for unnecessary identity data. You can complain to the UK Information Commissioner's Office at https://ico.org.uk/make-a-complaint/. We would appreciate the opportunity to address the issue first, but you do not have to contact us before the ICO.
11. Security
We use measures intended to protect information, including authenticated and role-scoped access, client attestation, encryption in transit, controlled storage access, rate limits, audit trails, content moderation, bounded backups and deletion retry processes. No internet service can promise absolute security. Keep your account and device secure and report suspected compromise to support@crowdwrangler.com.
12. Changes To This Policy
We review this Policy when our processing, providers, retention or legal duties change. A material update receives a new version and is presented for acknowledgement where appropriate. We will not start a materially different use of personal information merely because this section allows updates.
13. Contact
The controller is IPEVENTS LIMITED, registered in England and Wales, operating CrowdWrangler.
- Email: support@crowdwrangler.com
- Website: https://crowdwrangler.com