It's YOUR data. Aggregate it without exposing it. No middleman.
Last updated: 2026-10-15
Cravage is designed so that there is very little to collect, and this page says exactly what that little is.
The figure you type is processed on your phone. What the app sends to the other participants is a masked version of it: your figure plus random amounts that cancel out when everyone’s masked numbers are added together. No phone, including the host’s, can recover your figure from what it receives, unless every other participant in the round conspires against you. This relies on everyone checking the room code and counting the phones in the room. Otherwise a host could add pretend participants that exist only on their own phone, and those would count as conspirators. Your figure is held in memory only while the round is running and is cleared when it ends.
During a round your phone sends, to the other phones in the room: your nickname, your masked number, digital signatures that let the others check nothing was tampered with, a random number used to make the room code, and a confirmation that you saw the same room code (or, if you tap “The codes don’t match”, a signed note saying so). Phones connect to each other directly over Wi-Fi. Cravage does not operate a server that receives your round data.
While a room is open, nearby phones running Cravage can see the room’s label (what is being averaged), the host’s nickname and the group size, and so can any other nearby device, or any device on the same Wi-Fi network, that looks for them. Shortly after the round starts, the room’s listing drops the label and nickname and shows only a made-up name, until the host leaves. Once you join, the other participants see your nickname.
Cravage saves your nickname and your light or dark appearance choice. It does not save round history, and figures are never written to storage. Whether you have bought the one-off unlock is kept by Apple’s App Store, not by Cravage.
You can choose to share a transcript of a round that every phone agreed on. It contains the room’s label, the masked numbers, signatures and result, never anyone’s figure or nickname. Cravage writes the file only when you pick where to send it, and deletes its own copy when you leave the result screen. Once sent, whoever receives it can keep it and share it.
The optional one-off unlock is handled entirely by Apple through the App Store. We never see your payment details. Apple’s privacy policy applies to the purchase.
iOS asks for permission to find devices on the local network. Cravage uses it only to find other phones nearby running Cravage.
Cravage has no analytics, advertising or crash-reporting service. If you ask for help, you can copy a short diagnostic summary from Settings, or tap Report a problem, which opens an email to the address below with the summary filled in (if the iPhone’s Mail app isn’t set up, it offers to copy the summary instead). The summary contains the app and iOS versions, the phone model, the protocol stage, counts (such as how many phones confirmed the room code or how many sends failed), timings in seconds (such as how long a connection had been quiet), the kind of connection each link used (such as peer-to-peer Wi-Fi or a Wi-Fi network, never a network’s name) and error codes, including for the last round you left. It never contains a figure, a nickname, a room name, a key or the room code. It is only sent if you send it.
Cravage does not knowingly collect any information from children. Apart from an email you choose to send to support, it collects no information from anyone.
If this policy changes, the new version will be published at this address with a new date.
cravage.support@gmail.com
If you email this address, from Report a problem or otherwise, the developer receives your email address and whatever the email says, and uses them only to answer you.