PRIVACY

Last updated September 27, 2026

Short version: your face is analyzed on your phone and never uploaded. Attack videos are only visible to the people you send them to and are deleted after 24 hours. Clips stay on your phone unless you share them.

Smile detection happens on your device

During a duel the front camera measures facial expressions (ARKit face tracking, or Apple Vision on phones without Face ID) to decide when you smile. These measurements are processed in real time on your iPhone. We do not send face images, face geometry or tracking data to our servers, and we do not use it to identify you. We don't use Face ID and never unlock anything with your face.

When a duel ends, the app submits a small summary so scores can be verified: whether you cracked, the time, and a list of smile scores (a number from 0–100, ten per second). It contains no images.

What we store

Account: your sign-in method (Apple, phone number or email), handle, avatar color, and that you confirmed you are 16 or older.
Game data: friends, crews, duels, points, coins, streaks, tournament results.
Attack videos: the 15-second videos you send. Only you and the recipients can view them. They are deleted 24 hours after sending.
Reaction videos and clips: recorded and assembled on your phone. They are never uploaded unless you choose to share or save them.
Push notification token, if you allow notifications.
Purchases: if you subscribe to Crack'd+, Apple processes payment. We receive the subscription status, not your card details.
Reports: if you report someone, we store the report so our team can review it.

What we don't do

No ads in the app, no data brokers, no selling or renting your data.
No contact-book upload. Friends are added by handle or invite link.
The app doesn't track you across other companies' apps or websites and has no advertising SDKs.

Our website

This website (cant-crack.me) uses the Meta Pixel to measure how our ads on Facebook and Instagram perform. When you visit, Meta receives the pages you view, basic browser and device information and your IP address, and may connect that to your Meta account to measure and show ads. Nothing from the app is sent to Meta. You can limit this in Facebook or Instagram under Accounts Center → Ad preferences, or by blocking third-party cookies in your browser.

Who can see what

By default only accepted friends can send you attacks. Your handle, avatar and weekly crew stats are visible to your friends and crew members. You can block anyone; blocked people can't attack you or see your activity.

Service providers

We use Google Firebase (authentication, database, file storage, cloud functions, push notifications) to run the service, Apple for sign-in and payments, and Meta for ad measurement on this website only.

Age

Crack'd is for people 16 and older. If we learn an account belongs to someone younger, we pause it and delete its data.

Your choices

Delete your account in the app: Profile → Settings → Delete account. This removes your profile, handle, friendships, duels and attack videos from our servers.
Turn off notifications, camera or microphone access at any time in iOS Settings.
Ask us for a copy of your data or any question at hello@cant-crack.me.

Retention

Attack videos: 24 hours. Game data: until you delete your account. Reports: as long as needed to keep the community safe, then deleted.

Changes

If we change this policy in a meaningful way we'll tell you in the app before it applies.