Legal

Privacy Policy

Last updated: 13 October 2026

This Privacy Policy explains how AEA Solutions Ltd ("AEA Solutions", "we", "us", "our") collects, uses, and protects your information across all of our products and services, including:

• Crowdy (formerly Rabble): a pass-and-play party game app for iOS and Android;
• Bluntly: a job search assistant browser extension for Google Chrome;
• MothTrack: a personal net worth tracker app for iPhone (not yet publicly released); and
• ilmi: an app for learning Islam, reading the Quran and prayer times, for iPhone (not yet publicly released).

AEA Solutions Ltd is a company registered in England and Wales (registered office: 7 Woodvale Grove, Bolton, England, BL3 3HQ) and is the data controller responsible for your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Because our products work very differently, this policy has a short set of general terms that apply to everything, followed by a product-specific section for each product. If a product-specific section conflicts with the general terms, the product-specific section applies to that product.

---

1. Summary

2. Crowdy

Crowdy's core gameplay runs on your device and does not require an account. We do not ask for or directly collect your name, email address, contacts, or precise location through Crowdy. Purchase and advertising services do transmit limited data from the app as described below.

• There are no accounts, sign-ups, or logins.
• We do not ask for your name, email address, contacts, or precise location.
• Anything you do in the app, such as the players you add or content created during a game, stays on your device and is not sent anywhere. This information is temporary and exists only for your play session.
• Crowdy's games can be played without an internet connection, but purchases, subscription checks, consent messages, and advertising require communication with third-party services.

2.1 Purchases

Purchases. Crowdy offers optional paid content through auto-renewing subscriptions, billed weekly or yearly. All payments are processed by Apple through the App Store on iOS, and by Google through Google Play on Android. We do not receive or store your payment card details.

We use RevenueCat to manage in-app purchases and subscription status. When you make a purchase, RevenueCat processes a randomly generated, anonymous app user ID and your purchase history (transaction receipts, product identifiers, subscription status) on our behalf. This identifier is not linked to your name, email, or any other information that identifies you, and it is not used for tracking or advertising. RevenueCat processes this data as our processor under its data processing terms; see RevenueCat's privacy policy for details.

2.2 Advertising

Crowdy uses Google AdMob to show interstitial advertisements to users who do not have an active premium entitlement. Premium users are not intentionally served advertisements. Ads appear only at natural breaks after a completed game, subject to frequency limits.

Crowdy also shows a second, optional format: a rewarded advertisement. In TWENTY and Blockbuster, saving a recorded clip to your device plays a short video first. You only ever see this one by choosing to save a clip, and if the advertisement cannot be shown, the clip is saved anyway.

Where required by law, including in the UK, EEA, and Switzerland, we ask for your consent before requesting personalised ads, and we request non-personalised ads if you decline. Elsewhere, including the United States, we may request personalised ads. On iOS, personalised advertising also depends on your App Tracking Transparency choice: if you decline, your advertising identifier is not used to track you across apps and websites owned by other companies.

Non-personalised ads are not selected using your past behaviour, but Google explains that they can still use cookies, mobile identifiers, or similar technologies for purposes such as frequency capping, aggregated reporting, security, and fraud prevention.

The Google Mobile Ads SDK may automatically collect and share:

• IP address, which may be used to estimate your general location;
• device or app identifiers, such as an advertising ID, app-set ID, or app/developer-scoped identifier;
• advertising data, such as ads shown and interactions with those ads;
• product interaction data, such as app launches, taps, and video views; and
• diagnostic and performance data, such as crash logs, launch time, hang rate, and energy usage.

Google uses this information to provide, measure, secure, and improve advertising services, including analytics and fraud prevention. Data sent to Google Mobile Ads is encrypted in transit. We receive aggregated advertising reports and do not use AdMob to obtain your name or email address. For more information, see How Google uses information from sites or apps that use its services and Google's Privacy Policy.

2.3 Consent and privacy choices

Where required by law, including in the UK, EEA, and Switzerland, Crowdy uses Google's User Messaging Platform to present a consent message before requesting ads. Depending on your region and choices, Google may serve non-personalised or limited ads, or ads may not be available. Where the control is available, you can review or change your choice from Settings → Ad Privacy Choices in Crowdy. You can also reset or limit advertising identifiers through your device's privacy settings.

2.4 Retention

We retain only aggregated advertising reports for as long as reasonably necessary for reporting, accounting, fraud prevention, and service improvement. Google, RevenueCat, Apple, and Google Play retain data they control in accordance with their own policies and legal obligations. Because Crowdy has no user accounts, we generally cannot connect those third-party records to your name or email address.

2.5 Mature content

Mature content. Crowdy contains some content intended for adult players, hidden behind an optional toggle that is off by default. Crowdy is not directed at children under 13. If you believe a child under 13 has provided personal data through Crowdy, contact us using the details below.

3. Bluntly

Bluntly is a Chrome extension that helps you with your job search. To provide this service, Bluntly collects and processes the following data.

3.1 Information we collect

• Account information. When you create an account: your email address and authentication credentials. Passwords are stored in hashed form by our authentication provider. We never see or store your plaintext password.
• Profile and job-search content. Information you choose to provide, such as your name, CV/resume content, work history, skills, and job preferences.
• Website content you choose to process. When you use Bluntly on a web page (for example, a job listing), the relevant page content (text, links) is processed to provide the feature you requested. This happens only when you actively invoke the extension. Bluntly does not passively read or harvest your browsing.
• Subscription and billing information. If you upgrade to a paid plan, our payment processor Stripe collects your payment details. We receive only limited billing metadata (e.g. subscription status, last 4 digits of your card) and never store full card numbers.
• Technical and usage data. Basic logs and usage information needed to operate, secure, and improve the service (e.g. timestamps, error logs, feature usage counts, and which product variants or experiments you were shown).

3.2 How we use your information

We use this data to: create and manage your account; provide the extension's features (including generating tailored job-search content); process payments and manage subscriptions; provide support; maintain security and prevent abuse; and comply with legal obligations.

We do not sell your personal data. We do not use your data for advertising. We do not use your data to determine creditworthiness or for lending purposes.

3.3 AI processing

Some Bluntly features are powered by one or more third-party AI service providers. These may include providers such as Anthropic, OpenAI, and Google, among others, and the providers we use may change from time to time as we improve the service. When you use these features, the relevant content (for example, a job description and the parts of your profile needed for the task) is sent to the provider to generate a response, and the response is returned to you. We access these providers through their business/API services and select providers whose terms do not permit your content to be used to train their models.

3.4 Storage and analytics

Your account and profile data is stored on our backend infrastructure provided by Supabase, hosted in secure cloud data centres which may be located in the UK, the EU, or the United States (see Section 7 on international transfers). We do not use third-party advertising or cross-site tracking technologies. We may use privacy-respecting, first-party usage measurement to understand how features are used.

3.5 How long we keep your data

We keep your account and profile data for as long as your account is active. If you delete your account, we delete your personal data within 30 days, except where we must retain limited records to comply with legal obligations (e.g. billing records, which are retained for six years under UK tax law). You can delete your account at any time from within the extension or by emailing us.

---

4. MothTrack

MothTrack is a personal net worth tracker for iPhone. It is not yet publicly released; this section describes the app as currently built and will be updated if that changes before launch. MothTrack has no user accounts: there is no sign-up, login, or MothTrack account held on our servers.

4.1 Your financial records are stored on your device

The information you enter into MothTrack is stored on your iPhone. We do not collect or receive it: we do not operate a server it is sent to, and we cannot see, access, or restore it. This includes:

• account names and types, balances, assets and liabilities, balance history, and contribution entries;
• monthly notes;
• your date of birth, which the app asks for during setup and uses only to show progress by age;
• household labels and ownership choices (for example You, Partner, or Joint);
• your reporting currency, check-in schedule, and reminder settings; and
• projection assumptions and goals.

If you import a spreadsheet (XLSX or CSV), the file is read and processed on your device. Importing a file does not connect MothTrack to your bank or any other institution, and MothTrack does not connect to bank accounts.

If MothTrack cannot read a spreadsheet, it can give you a formatting prompt to copy into an AI tool of your choice. Copying this prompt does not send your financial records to an AI provider, and the copied text does not contain them. If you then choose to upload your spreadsheet to that provider, you are sharing its contents with that provider under its own terms and privacy policy. This is optional: you can simplify the file yourself or add your accounts manually.

4.2 Purchases

MothTrack is free to download. Continued access after setup and the guided tour requires MothTrack Pro, offered as a monthly or annual auto-renewing subscription or a one-time Lifetime purchase. All payments are processed by Apple through the App Store. We do not receive or store your payment card details.

We use RevenueCat to check purchases and manage membership status. RevenueCat processes a randomly generated, anonymous app user ID and your purchase history (transaction receipts, product identifiers, and subscription status) on our behalf, together with the technical information needed to do so. We do not connect this identifier to your name or email address, although it does distinguish one installation from another, and it is not used for advertising. We do not send RevenueCat your account names, balances, date of birth, notes, or any other financial record. RevenueCat also gives us aggregated subscription reporting. RevenueCat processes this data as our processor under its data processing terms; see RevenueCat's privacy policy for details.

4.3 Device features

• Face ID, Touch ID, and passcode. If you turn on the app lock, authentication is carried out by Apple's system on your device. We never receive your face or fingerprint data or your device passcode.
• Reminders. Check-in reminders are local notifications scheduled on your device, at a time you choose. They are not sent from a server operated by us.
• Widgets. Home Screen widgets read a limited summary (totals and dates) that the app shares with its own widget on the same device. This is not a cloud upload.
• Institution logos. Logos are bundled inside the app. MothTrack does not look them up online or send your account names to a logo service. A logo identifies an institution; it does not mean that institution is affiliated with or endorses MothTrack.

4.4 Backups and exports

MothTrack does not send your records to us, and we do not run a backup service. Your records are included in your iPhone's own backup. If iCloud Backup is switched on, Apple stores a copy in your iCloud account; if you back up to a computer, a copy is kept on that computer. Those backups are made by your device under your Apple account and are governed by Apple's terms and privacy policy. We never receive them. You can also export a password-protected, encrypted backup file whenever you choose, including after a membership has ended, and restore from it later.

• You decide where an exported file is saved or shared. If you save it to iCloud Drive or another provider, that provider's own terms and privacy practices apply to it.
• We cannot recover your records for you. If you lose, erase, or replace your device, they can be restored only from your iPhone's own backup or from a backup file you exported. We also cannot recover a backup if you forget its password.

4.5 Advertising and analytics

MothTrack has no ads or advertising tracking. It contains no advertising SDK, and it does not include a general-purpose behavioural analytics SDK. The only third-party service in the app is RevenueCat, used for purchases as described in Section 4.2.

4.6 Removing your data

Because we do not hold your records, you control them directly. You can erase everything from inside the app (Settings > Delete all data), and deleting the app also removes the records it stored on that device. Please note that this is separate from four other things:

• deleting the app does not cancel a subscription; subscriptions are managed in your Apple account settings;
• it does not delete backup files you have already exported, which remain wherever you saved them;
• it does not remove copies already contained in a backup of your device, for example in iCloud, which are replaced or removed according to your backup settings; and
• it does not erase purchase records held by Apple or RevenueCat, which they retain in accordance with their own policies and legal obligations.

4.7 Support

If you email us about MothTrack, we receive your email address and whatever you choose to include, and we use it to respond to you and keep a record of the request. We keep support emails for up to 24 months after the conversation ends, and then delete them. This is separate from the records stored in the app, which we cannot see. Please do not send us backup files or backup passwords. You can reach us at help@moth.solutions or through the contact form at moth.solutions/#contact.

4.8 Why we process this, and for how long

• Managing your membership (checking purchases, granting and restoring access): necessary to perform our contract with you.
• Subscription reporting (aggregated figures on purchases and renewals): our legitimate interest in understanding and running the product.
• Support: our legitimate interest in answering you and keeping a record of what was agreed.
• Accounting and tax records: legal obligation.

Purchase records processed for us by RevenueCat are kept for as long as they are needed to maintain and restore your access, to deal with refunds and disputes, and to meet our legal record-keeping obligations. Apple keeps its own transaction records under its own policies.

5. ilmi

ilmi is an iPhone app for learning Islam through short lessons, reading the Quran, and prayer times. It is not yet publicly released; this section describes the app as currently built and will be updated if that changes before launch.

ilmi has no accounts, no sign-in, no ads or advertising tracking, and no general-purpose analytics. We do not ask for or collect your name, email address, or anything else that identifies you. The only third-party software in the app is RevenueCat, which is used to manage purchases as described in Section 5.5.

5.1 What is stored on your device

The following is stored on your iPhone and is never sent to us:

• your answers when you first set up the app: an optional first name, an age range, and your goals;
• your lesson progress, points and streak;
• your reading position in the Quran;
• the prayers you have ticked off;
• your Medina; and
• your settings.

Like other app data, this is included in your iPhone's own backup if you keep one (for example iCloud Backup, which Apple stores under your Apple account and its terms). We never receive it. Home Screen and Lock Screen widgets read a small summary that the app shares with its own widgets on the same device.

5.2 Location, for prayer times

ilmi asks for your location only if you turn on prayer times. Access is "while using the app". Before it is used, your location is rounded to about one kilometre. That rounded location, together with your chosen calculation settings, is sent to aladhan.com (api.aladhan.com) so that it can calculate prayer times for where you are. Nothing else about you is sent with it. Only the rounded location is kept, and only on your device. The qibla direction is worked out on your device and is not sent anywhere.

You can turn this off at any time in your iPhone's Settings. Without it, the rest of the app works as normal.

5.3 Audio

When you listen to a recitation, the audio for each verse is downloaded from everyayah.com or cdn.islamic.network and kept on your device. The recording of the call to prayer is downloaded from cdn.aladhan.com. As with any website, the servers that provide these files see the request, including your IP address and which file was asked for. We send them nothing else, and we do not receive anything from them about you.

5.4 Notifications

Reminders and prayer alerts are optional. They are scheduled on your device as local notifications. There is no push-notification server.

5.5 Purchases

ilmi Plus is an optional subscription bought through Apple's App Store. Apple processes the payment, and we do not receive or store your payment card details.

We use RevenueCat to check purchases and manage whether ilmi Plus is active. RevenueCat processes a randomly generated, anonymous app user ID and your purchase history (transaction receipts, product identifiers, and subscription status) on our behalf, together with the technical information needed to do so. The app creates this identifier when it is first opened, whether or not you buy anything. We do not connect it to your name or email address, although it does distinguish one installation from another, and it is not used for advertising. We do not send RevenueCat your name, age range, location, lesson progress, or anything else you enter in the app. RevenueCat also gives us aggregated subscription reporting. RevenueCat processes this data as our processor under its data processing terms; see RevenueCat's privacy policy for details.

We process this to provide what you have bought (performance of a contract) and to understand how the subscription is doing (our legitimate interests). Purchase records are kept for as long as they are needed to maintain and restore your access, to deal with refunds and disputes, and to meet our legal record-keeping obligations.

5.6 Younger users

ilmi can be used by people of any age, including those under 13. It does not ask anyone for a name, email address, or other identifying information, whatever their age. The purchase service described in Section 5.5 processes an anonymous identifier in the same way for every user. The age range chosen at setup stays on the device and is used only to decide which lessons are shown. Location is off unless someone turns on prayer times. Purchases can only be made by, or with the approval of, the holder of the Apple account. If you are a parent or guardian and have a question, contact us using the details below.

5.7 Removing your data

Deleting the app deletes all the data it stored on that device, including downloaded audio. It does not cancel a subscription, which is managed in your Apple account settings; it does not remove copies already contained in a backup of your device; and it does not erase purchase records held by Apple or RevenueCat, which they retain in accordance with their own policies and legal obligations.

6. Third parties we work with

We disclose data only as needed to operate our products, to service providers processing it on our behalf, and to advertising or platform partners that may act as independent controllers under their own privacy policies:

• Apple App Store / Google Play: app distribution and payment processing (Crowdy; Apple App Store only for MothTrack and ilmi).
• Supabase: database, authentication, and hosting (Bluntly).
• AI service providers (which may include Anthropic, OpenAI, Google, and others): AI feature processing (Bluntly).
• Stripe: subscription payments (Bluntly).
• RevenueCat: in-app purchase and subscription management (Crowdy, MothTrack and ilmi); processes an anonymous app user ID, purchase and entitlement history, and the technical information needed to operate the purchase service.
• Aladhan (aladhan.com): calculates prayer times from an approximate location if you turn prayer times on, and hosts the call-to-prayer recording (ilmi). It acts independently of us.
• EveryAyah and Islamic Network (everyayah.com, cdn.islamic.network): host the Quran recitation audio that ilmi downloads when you listen. They act independently of us.
• Google AdMob and participating advertising partners: ad delivery, measurement, analytics, security, and fraud prevention for non-premium Crowdy users.

We may replace a provider or advertising partner from time to time. Where a provider acts on our behalf, we require appropriate contractual protections; where a partner acts as an independent controller, its own privacy policy applies. We will update this policy where a change is material.

We may also create and use aggregated or anonymised data (data that can no longer identify you) for any lawful purpose, including improving our products, analytics, and business reporting. Such data is not personal data under UK GDPR.

We may also disclose data if required by law, or in connection with a merger, acquisition, or sale of assets (in which case this policy will continue to apply to your data, and we will notify you of any change of controller).

7. International transfers

Some of our service providers are located outside the UK (for example, in the United States). Where personal data is transferred internationally, we rely on safeguards recognised under UK GDPR, such as the UK International Data Transfer Agreement / Addendum or an adequacy decision.

8. Legal bases (UK GDPR)

We process personal data on the following bases: performance of a contract (providing the product you signed up for); legitimate interests (securing and improving our services, preventing fraud, and funding free access with advertising where permitted); legal obligation (e.g. tax and accounting records); and consent, where we ask for it (for example, location in ilmi), which you can withdraw at any time.

9. Security

We use appropriate technical and organisational measures to protect your data, including encryption in transit, hashed credentials, and access controls. No system is perfectly secure, but we take reasonable steps to protect your information and will notify you and the ICO of any breach where required by law.

10. Your rights

Under UK GDPR you have the right to: access your personal data; correct it; delete it; restrict or object to processing; data portability; and withdraw consent. To exercise any right concerning data controlled by AEA Solutions, contact us at the details below, and we will respond within one month. We do not hold MothTrack's financial records, so there is nothing from them for us to access, correct, or delete; you control them directly in the app. None of Crowdy, MothTrack or ilmi has user accounts, and we generally cannot associate RevenueCat or aggregated AdMob reporting data with your real-world identity. Google controls data it collects through AdMob; requests about that data can be made using the controls and contact routes described in Google's Privacy Policy.

You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk.

11. Children

ilmi can be used by people of any age and does not ask anyone for identifying information; see Section 5.6. Our other products are not directed at children under 13, and we do not knowingly collect personal data from children. Crowdy's optional mature content is off by default and the app is age-rated accordingly on the App Store and Google Play. If you believe a child has provided us personal data through Bluntly, contact us and we will delete it.

12. Changes to this policy

We may update this policy from time to time, for example when we launch new products or features. We will update the "Last updated" date above and, for material changes, provide a more prominent notice (for example, in-product or by email for Bluntly account holders).

13. Contact us

AEA Solutions Ltd
7 Woodvale Grove, Bolton, England, BL3 3HQ
Email: aeasolutionsltd@gmail.com