Privacy
What Crowd keeps, and for how long
Crowd is built to know as little as possible about the people who use it. This page lists everything it stores, why, and when it is deleted. Last updated 3 October 2026.
The short version
- No accounts, names, email addresses or phone numbers. Crowd never asks for them.
- No analytics, no advertising and no tracking scripts.
- One cookie, holding a random ID, so your device is only counted once.
- Your IP address is never stored. A scrambled version is kept for under a day to stop abuse.
- The random ID stored with your join is wiped 7 days after the action happens.
- There is no participant list, so there is nothing to hand over or leak.
What is stored
The actions themselves. The description, target, deadline, time and the counts (joins, yellow and red cards). These are public: anyone with the link sees them. They are kept until removed. To have one taken down, email [email protected] with the link.
A device cookie called cr_did. It holds a random ID and nothing else, can’t be read by scripts on the page, and expires after 365 days. It lets Crowd count your device once per action and show you “You’re in” when you come back. It is strictly necessary for that, so there is no cookie banner.
The same random ID, next to each join or card. That’s how a second tap from the same device is recognised. It is wiped 7 days after the action’s date. The join itself stays, so the count doesn’t change.
A salted hash of your IP address, stored with each action you create and each join or card. Crowd uses it only to limit how many actions one connection can create per hour and how fast it can tap. The hash can’t be turned back into your IP address. Hashes older than 1 hour are deleted by a job that runs once a day, so none lasts longer than about a day.
What is not collected
- Your IP address in the clear, your location or your browser details.
- Anything that ties your joins across different actions once the identifiers above are deleted.
- Analytics or page-view tracking of any kind.
- Third-party or advertising cookies.
Until 3 October 2026 the site used Google Analytics, which set its own cookies and recorded page views. It has been removed, and the Google Analytics property and its data are being deleted.
Who else handles your request
Like any website, Crowd runs on other companies’ infrastructure. They process requests on Crowd’s behalf and, like every web host, see your IP address as your request passes through. They keep their own logs under their own privacy policies.
- Vercel: hosts the website and runs its code.
- Cloudflare: carries traffic to and from getcrowd.app.
- Neon: hosts the database. Its short-term backups can hold deleted values for about a day before they roll over.
Why it is allowed
Under UK data protection law the random ID and the IP hash are kept on the basis of legitimate interests: keeping counts honest and stopping one person from flooding an action. They are kept for the shortest time that job needs, and nothing else is done with them.
Your choices
You can clear the cookie at any time in your browser. Crowd will treat you as a new device, and you’ll stop seeing “You’re in” on actions you joined.
Because Crowd holds nothing that identifies you, it usually can’t find “your” data to show or delete. If you created an action and want it removed, or have any question about this page, email [email protected]. If you are unhappy with the answer, you can complain to the Information Commissioner’s Office (ico.org.uk).