Privacy

Crash helps you find a hotel and book it. This page says what we collect to do that, who else handles it, how long we keep it, and what you can ask us to do with it.

Last updated 11 November 2026.

Who we are

This policy covers trycrash.co, which is run by Crash. Here, we and us mean Crash. Write to contact@trycrash.co with any question about your information.

What we collect

  • Your account, if you make one. Your email address, your name, and the ID our sign-in provider gives your account. You sign in with Apple, with Google, or with a one-time code sent to your email; there are no passwords. If you choose Apple or Google, they share your name and email address with us. Apple can give us a private relay address instead of your real one if you ask it to.
  • Your bookings. The name of the person checking in, an email address for the confirmation, and a phone number if you want the hotel to be able to reach you. We keep these with the booking, together with the hotel, dates, rooms, number of travelers, price, cancellation terms and the references the supplier and the hotel give it. We also keep the supplier's own replies about each booking, which repeat those details.
  • Your preferences, if you set them. Your usual for a new search (the order, free cancellation, must-haves, kinds of stay, a rating floor, how far to walk, travelers and rooms) and how Trips shows your trips. When you are signed in we keep them on your account, so they follow you to another device; either way your browser keeps a copy.
  • Your saved stays, if you save any. The hotels you tap the heart on, the place you found them in, and the dates and number of travelers you were searching. We keep them on your account so they follow you to another device, and your browser keeps a copy. We keep no prices with them.
  • Your searches. The place, dates and number of travelers you search for. We use them to find prices; they are not tied to your account.
  • How the website is used. As you use trycrash.co, your browser tells us which pages you open, the place you search, the stays you open and when you start a checkout, together with the site that sent you here and any campaign tag in the link you followed. When you choose one of the suggestions under Where, it tells us which suggestion it was, its place in the list and how many letters you had typed, never the text you typed. We count visitors with a code worked out from your IP address and browser that changes every day, so it cannot follow you from one day to the next and cannot be traced back to you once that day's key is deleted. We do not keep the IP address or browser details with these counts and set no cookie for them, except that if you came through a creator's link, the cookie described under Cookies and your browser says which link, so the searches and stays you open are credited to it. The counts carry the tab's random ID, so we can tell how many visits end in a booking. If your browser sends Global Privacy Control or Do Not Track, it sends none of this. The iPhone app does not send it.
  • Creator links. When you follow a link a creator shared (trycrash.co/c/ and a name), we count the click the same way, with the daily code and no IP address or browser details, and note the site you came from. The link may fill in a discount code at checkout.
  • Notes you send us, if you write one. What you write on the postcard in the header and the kind of note it is, an email address if you add one for a reply, and, unless you choose to leave it off, where you were when you wrote: the page's address (which holds your search), the screen, the stay you had open, your window size, the look you use and whether you were signed in. The tab's random ID and your browser's user agent are kept with the note; your IP address is not.
  • Technical details. Your IP address and a random ID for each browser tab reach our servers with every request. We use them to keep Crash fast and to stop abuse, such as too many searches from one place. Our request traces record the IP address, the browser's user agent and the page asked for.

We do not collect card numbers, passwords, birthdays, ID documents or your precise location, and we use no advertising trackers and no outside analytics service: the visit counting above is our own and stays with us.

Payment

You pay in a payment form run by LiteAPI, the booking service of Nuitee, which is built on Stripe. Your card details go from your browser straight to them and never reach Crash's servers. We only learn whether the payment went through, with a transaction reference.

How we use it

  • To search for stays, and to make, show and cancel your bookings.
  • To email your booking confirmation and any cancellation, with a private link to your trip.
  • To remind you about a stay you started booking on the website and left before paying: at most three emails about that stay, with its real total now, whether it dropped or sold out, a few stays like it, and a last call as the dates come close. Not if you ticked the box under the email field at checkout, and not after you unsubscribe, which every one of these emails lets you do in one tap. Signed in, you can turn them off in Settings too.
  • To add bookings you made as a guest to your account when the email address matches.
  • To keep Crash running and secure, stop abuse and fix problems.
  • To understand how people find and use Crash, such as which links bring visitors and how many visits end in a booking, so we can improve it.
  • To read the notes you send us, answer them if you asked for a reply, and make Crash better.
  • To meet our legal, tax and accounting duties.

We do not sell your information and we do not use it for advertising.

Who else handles it

  • LiteAPI (Nuitee), our booking supplier, which also charges your card. It receives the guest's name, email and phone with each booking and passes on to the hotel what the hotel needs. Its payment form runs on Stripe.
  • The hotel you book, which gets the guest's name and the booking from the supplier, and may get the email and phone number.
  • Clerk, which runs sign-in, sends the sign-in codes and keeps your sign-in details. Apple and Google, if you choose to sign in with them.
  • Resend, which sends our emails.
  • Neon, which hosts our database, and Railway, which runs our servers, both in the United States.
  • Cloudflare, which runs our domain and helps protect the site from attacks.
  • Honeycomb, which stores our request traces so we can find and fix problems.
  • Sentry, which receives reports when something breaks on the website, so we can fix it. For a small share of visits it also receives a recording of what was on the screen, with everything you type hidden, the checkout, trip and account pages hidden, and the payment form left out. The report goes through our own server, so Sentry does not see your IP address.
  • OpenFreeMap and VersaTiles, which serve the map (VersaTiles the dark one). Your browser fetches the map from them directly, so they see your IP address and the area you look at. Hotel photos load the same way from the supplier's image servers.

Each of them handles your information only to provide its service to us. We will also share information when the law requires it, to protect people from harm or fraud, or with a buyer if Crash is ever sold, who would have to keep to this policy. Our providers keep information mostly in the United States, so if you use Crash from elsewhere, your information travels there.

Cookies and your browser

  • Sign-in uses Clerk's cookies to keep you signed in. Clerk loads only on the sign-in, checkout, Trips, trip and settings pages, and on the search page just after you save a stay while signed in, to send it to your account.
  • Our own pages keep a few things in your browser rather than in cookies: your last search, a random ID for the tab, the trips you looked up, and, during checkout, the booking you are making with the guest details you typed, so a refresh does not lose it. These clear when you close the tab. Your usual, your saved stays, the look and map style you chose, a note that you are signed in, and when the postcard last asked you for a note stay until you change them, sign out, or clear this device in Settings.
  • The payment form may set its own cookies to prevent fraud.
  • If you arrive through a creator's link, we set one cookie of our own, crash_via, for 30 days. It says only which link brought you, signed so it cannot be changed, so that the searches and stays you open, and any booking you make, in that time are credited to the link. It holds nothing about you, and you can delete it in your browser at any time.
  • We use no advertising cookies. Counting visits sets no cookie of its own and keeps nothing in your browser; it only reads crash_via when you have one.

How long we keep it

  • Your account and your preferences: until you delete the account.
  • A copy of your data you ask for in Settings: seven days from when it is ready, or until you delete the account.
  • Bookings, with the guest details on them: as long as we need them for the stay, for refunds and disputes, and for tax and accounting rules, which can mean several years.
  • Visit and link click counts: two days for each day's counting key, after which no count can be tied to an IP address, and about 13 months (400 days) for the counts themselves. Which creator link a booking came through is kept with the booking.
  • Searches and the prices they find: in a short-lived cache, from minutes to a few days. Limits that use your IP address expire within an hour.
  • Notes you send us: for as long as they help us improve Crash, or until you ask us to delete yours.
  • Server logs and traces: for a limited time, set by Railway and Honeycomb. Error reports and recordings: for a limited time, set by Sentry.
  • The private trip link in our emails stops working after 90 days.

Your choices

  • You can use Crash without an account: search freely and book as a guest.
  • In Settings, signed in, you can change your name and your usual, ask for a copy of the information we hold about you (we put it together on our side, usually within a minute, and keep it for seven days so you can download it even after signing out and back in), see the devices you are signed in on and sign them out, clear what this browser keeps, and delete your account yourself.
  • You can also write to contact@trycrash.co from the email address on your account or booking to see, correct or delete your information. We answer within 30 days.
  • Deleting your account removes your sign-in at Clerk, takes your name, email address and preferences off your account with us, and signs you out everywhere. The bookings you made are kept, with their guest details, because the supplier, the hotel and our accounts still need them; a stay still to come stays booked, and you can open it with its reference and the email on it. Once they are no longer needed, ask us and we will remove what the law does not require us to keep. If you later sign up again with the same email address, the bookings made under it show on the new account.
  • Depending on where you live, for example in the EU, the UK or California, you may have more rights, such as getting a copy of your information or objecting to how we use it. Write to us to use them. We will not treat you differently for asking.

Security

Connections to Crash are encrypted, card details never reach us, and only the people who run Crash can reach our systems. No system is perfectly safe; if something happens that affects your information, we will tell you.

Children

Crash is for adults, and you must be 18 or older to book. We do not knowingly collect information from children under 13. If you think a child has given us information, write to us and we will remove it.

Changes

When we change this page, we change the date at the top. If a change affects how we use information we already have, we will email account holders before it takes effect.

Contact

Crash, contact@trycrash.co.

Read the terms.