The short version: your pizza nights are private. Crustly stores your bakes, recipes, and plans on your device. Sync goes through your own private iCloud — never through us. Pizza Pass parties go through Apple's CloudKit Shared Database, between your phones, never through a server we control. We have no backend that can read your data. We never sell ads. You can export or delete everything at any time.
1. Who We Are
Crustly is developed by Anchori Intel, a sole-trader app studio operated by Stuart McMillan, registered in Australia (ABN 51 277 394 323). Questions about this policy: anchoriintel@gmail.com.
2. What Crustly Collects, and Where It Goes
Crustly has five categories of data. Each goes to a different place.
Your pizza night data — the pizza nights you plan, the bakes you complete, your dough timelines, baker names, recipe choices, cooking method preferences, custom recipes you author, and notes you add.
- Stored on-device using Apple's SwiftData with at-rest encryption.
- Synced via Apple's CloudKit, in your private iCloud database. Only you can read it. Anchori Intel cannot.
- Never transmitted to a server we control. We have no backend that holds this data.
Pizza Pass party data — when you host or join a Pizza Pass party, your live baker snapshot (display name, current step, recipe choice) is shared with other participants in the same party.
- Travels through Apple's CloudKit Shared Database via a CKShare. Anchori Intel does not see this data.
- The party data lives only as long as the party does. Leaving the party removes your snapshot from the shared zone.
- End-of-night votes are tied to the party's CKShare and are deleted when the party is dismissed.
Your authentication identity — provided by Sign in with Apple, used only when you save a bake to your Pizza Book or subscribe to Crustly Pro.
- Apple gives us an opaque user identifier (a random string) and, optionally, your first name and email (relay email if you choose).
- We store these in your device's secure Keychain, locally only. They never leave your device.
- We do not maintain a user account on a server. There is no email list.
Anonymous product analytics — to know which features people use.
- Provided by PostHog. Events include "planned pizza night", "completed onboarding", "reached Master level", "viewed paywall" — never recipe contents, never baker names, never pizza night details.
- An anonymous random UUID identifies your install. There is no way to map this back to your identity.
- You can turn analytics off entirely in Settings → Privacy Dashboard.
Crash and performance reports — to fix bugs.
- Provided by Sentry. Includes the file and line where a crash happened, device model, and iOS version.
- Does not include your pizza night data, recipes, baker names, or any user-entered content.
3. What We Never Do
- We never sell your data. To anyone. Ever.
- We never show advertising. Crustly has no ad inventory.
- We never share your pizza night data with a third party.
- We never train an AI model on your recipes or bake history.
- We never use tracking identifiers (IDFA, ATT prompts) — Crustly opts out of tracking entirely.
4. Sign in with Apple
Crustly uses Sign in with Apple for the same reason we use everything Apple-native — it keeps your data on your device, in your control. Sign in is lazy-triggered: you can use Pizza Pass and plan pizza nights without signing in at all. Sign-in is only required when you save a bake to your Pizza Book for cross-device sync, or when you subscribe to Crustly Pro. Apple may relay an anonymous email address to us; that's fine, because Crustly has no email list and no marketing to send.
5. iCloud Sync (CloudKit Private and Shared Databases)
If you have iCloud enabled, Crustly syncs your data using Apple's CloudKit:
- Private Database — for your own pizza nights, bakes, custom recipes, and cooking methods. This is your iCloud, not ours. We don't have credentials to read it.
- Shared Database — for Pizza Pass parties. Each party is a CKShare invitation that the host generates and shares (via QR code or iMessage link). Participants gain temporary access to that single party's data, nothing more. Apple's documentation calls this a "private database scope" — meaning only authenticated participants can read or write.
If you sign out of iCloud, sync stops. Your local data stays on the device.
6. Universal Links (crustly.app)
When a mate shares a Pizza Pass party with you, the QR code or iMessage link points to crustly.app/party/[id]. This URL is handled by Apple's Universal Links system and opens directly in the Crustly app on your device. No data passes through Anchori Intel's servers — the link contains only the CloudKit Shared Database share identifier, which Apple uses to grant your device access to the party. If you don't have Crustly installed, the link falls back to a friendly page on crustly.app prompting you to install. The page itself does not collect any data.
7. Third-Party Services
Crustly uses these third-party services to operate:
- Apple iCloud — your private CloudKit database, holds your pizza night data. Apple's CloudKit Shared Database powers Pizza Pass. Apple Privacy →
- RevenueCat (revenuecat.com) — subscription management. Receives an anonymous subscriber ID and your subscription status from Apple's App Store. No pizza night data. RevenueCat Privacy →
- PostHog (posthog.com) — anonymous product analytics only. No personally identifiable information. PostHog Privacy →
- Sentry (sentry.io) — crash and performance reporting. No user content. Sentry Privacy →
8. Your Rights
You can, at any time, from inside the app:
- Export everything — Settings → Privacy Dashboard → Export. Generates a JSON file with all your local data.
- Delete everything — Settings → Privacy Dashboard → Delete All Data. Wipes the local SwiftData store and your CloudKit records.
- Turn analytics off — Settings → Privacy Dashboard → Analytics toggle.
- Leave a Pizza Pass party — Tap Leave on the party timeline. Your snapshot is removed from the shared zone.
- Cancel your subscription — Settings → Manage Subscription opens Apple's standard subscription management screen.
Depending on where you live, you may have additional rights over your personal data. To exercise any of these, contact us at anchoriintel@gmail.com and we will respond within 30 days.
9. Data Retention
Anchori Intel does not retain your data because we never have it. CloudKit data lives in your iCloud account for as long as you keep it there. Local data on your device persists until you delete it (via the in-app control above, by uninstalling the app, or by erasing the device).
10. Children
Crustly is not directed at children under 13. We do not knowingly collect data from anyone under 13. Pizza nights with kids in the household are great — but the adult in the household is the user account and data controller. If you believe a child has set up Crustly themselves, please email us and we will help ensure any associated CloudKit records are deleted from their device.
11. International Users
Crustly is built in Australia and operates under Australian privacy law. Because we don't transfer your pizza night data outside your device, there is no international data transfer to worry about. Anonymous analytics may be processed in the United States by PostHog; this is covered by their privacy policy.
12. Changes to This Policy
If we change this policy materially, we'll update the date at the top of this page and announce the change in the next app update's release notes. We never change it retroactively in a way that reduces your protections.
13. Contact
- Email: anchoriintel@gmail.com
- Studio: Anchori Intel, Australia (ABN 51 277 394 323)
We read every email and reply personally.