Privacy Policy
Effective date: 6 August 2026
The short version
Your photos never leave your phone. What we read from them is the
location and time metadata — where a picture was taken and when, never
what is in it. To compare you with someone, those places and times are sent to our
server in the EU, where the matching runs. Each of you gets back only the places you
were both in; neither of you ever sees the rest of the other person's map.
What we collect
- Photo metadata. Latitude, longitude and timestamp are read from
your photo library on your device and folded into visits — a place, a start
and end time, and how many photos you took there. The images themselves are never
opened for content, never uploaded, and never shown to anyone.
- Your trace, on our server. Those visits — real coordinates and
times, not hashes — are uploaded and stored in our database (Google Firebase,
EU multi-region eur3) so that two traces can be compared. A rescan replaces
the stored trace outright, so deleting photos removes those visits from anything
compared afterwards. No client can read this data: it is reachable only through our
matching service, which returns your own half and nothing else.
- Comparison results. For each comparison we store one document per
person, holding only that person's own crossings. Neither document describes where the
other person was.
- Invites. A one-time code, who sent it and the display name they
chose. Links expire after 24 hours and are swept afterwards.
- Account data. If you sign in with Apple or Google we store your
user ID and the display name you choose; that name travels with your invites and
comparisons so the other person knows who they are comparing with. Anonymous use is
supported; then we store only a random identifier.
- Ratings and feedback. If you rate the app or write a comment, we
store the rating, your text, the app version, the platform, roughly how long you have
had the app, and which moment prompted the question. It is linked to your account
identifier until you delete your account, after which the identifier is removed and
only the text remains.
- Crash reports. Crashes and unhandled errors are reported through
Firebase Crashlytics — device model, OS version and a stack trace. Crash reports carry
no location data.
- Purchase state. Subscriptions are processed by Apple through the
App Store and RevenueCat. We never see your payment details.
What we never collect
- Your photos, or anything visible in them
- Your live location — crosd never uses GPS tracking and runs nothing in the background
- Your contacts — crosd never asks for them
- Advertising identifiers — crosd contains no ads and no third-party trackers
Comparisons and consent
Nothing is compared until the other person explicitly accepts. Each side learns only
the places and times you were both in, at the precision that side chose — from
25 metres within the same half hour, up to about a kilometre within the same day, and
wider than that only for places you visited while travelling. Declining an invite shares
nothing further.
Deletion
Settings → Data → Delete my trace removes your trace from the device
and deletes your visits and every comparison half we hold from our servers. Deleting your
account additionally removes your identifier, so no future comparison can name you, and
detaches any feedback you left. You can also email us for deletion.
Data processors
Google Firebase — authentication, database and matching service (EU multi-region
eur3, functions in europe-west3) and Crashlytics for crash reporting;
Apple App Store and RevenueCat (subscriptions). Each processes data only as needed to
provide the service.
Children
crosd is not directed at children under 13 and we do not knowingly collect their data.
Changes
We will post any changes to this policy on this page and update the effective date.
The 6 August 2026 revision corrects an earlier description of how matching works: it
said only irreversible place-time hashes were exchanged and that your trace stayed on
your device. Matching moved to our server before launch, and the text above now
describes what the app actually does.
Contact
Questions or requests: tahtaciburak@gmail.com