Privacy Policy
CrossAcross is an iPhone crossword app made by Brunch Development I/S (CVR 46546105, Denmark), the data controller for what’s described here. Questions or requests: support@brunchdev.tech.
The short version
- You can play every mode without an account, and without a network connection.
- Usage analytics are anonymous, and you can turn them off in Settings.
- An account is optional. If you make one, it lives in the EU and holds your results and first name.
- Friends see only your first name and your result on rounds you share with them.
- Deleting your account in the app deletes it and everything uploaded with it.
On your iPhone
Your solves, times, streaks, history and settings are stored on your device. They stay there unless you sign in, which uploads your results (below).
Anonymous usage analytics
To learn which parts of the app work, CrossAcross sends anonymous events such as “a puzzle was solved” or “a screen was opened” to PostHog, hosted in the EU. Each event carries a random ID that changes every day, so days can’t be linked together, and it is never linked to your account, name or email. We don’t use the advertising identifier, don’t record your screen, and don’t build profiles. Turn this off in Settings › Share Anonymous Usage.
Crash reports
If the app crashes or hits an error, a technical report (the device model, iOS version and what went wrong) may be sent to Firebase Crashlytics (Google) so we can fix it. Reports carry no name, email or account.
Accounts (optional)
You can sign in with Apple or Google to keep your results and see how you compare. Accounts are stored with Supabase in the EU (Ireland). From the sign-in we keep an account ID, your first name, and the email address Apple or Google gives us (with Apple this can be a private relay address). We use the email only to recognise your account; we don’t send you anything.
While you’re signed in, the app uploads each result you play, including ones from before you signed in:
- the puzzle or round, the mode and the date you played it;
- your time, hints used and, for 5-Minute Madness, puzzles solved and skipped;
- a fingerprint of your finished grid and whether you were offline, to check results are genuine.
Results that look implausible are marked, not deleted, and count only for you. Stats show everyone’s results as anonymous totals, never anyone’s individual result, and only once at least 20 players have played.
Playing with friends
A challenge or puzzle link you share carries your score or time, so your friend can compare. It never carries your name or account. If you’re both signed in, each of you sees the other’s first name and result on rounds you both played. In a live round, the two phones exchange progress through Supabase Realtime under a random, temporary ID, plus your first name if you’re signed in.
Purchases
Buying Ad-Free goes through Apple. We never see your payment details; the app only learns that the purchase exists.
Ads
This version of CrossAcross shows no ads. If that changes, this policy will be updated first.
How long we keep it
- Account data and results: until you delete your account.
- Anonymous analytics: as anonymous events, which can’t be traced back to you.
- Crash reports: up to 90 days.
- Our providers’ request logs: a few days.
Deleting your account
In the app: Settings › Account › Delete Account. It deletes your account and every result uploaded with it, and for Apple accounts disconnects CrossAcross from your Apple ID. What’s on your iPhone stays until you delete the app.
Your rights
Under the GDPR you can ask for a copy of your data, have it corrected or deleted, object to its use, or take it elsewhere. Email support@brunchdev.tech. You can also complain to the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk).
Who processes data for us
- Supabase (accounts, results, live rounds), EU
- PostHog (anonymous analytics), EU
- Google Firebase Crashlytics (crash reports)
- Apple and Google (sign-in), Apple (purchases)
- Vercel (this website)
Children
CrossAcross is a general-audience game. It needs no account to play, and we don’t knowingly collect personal data from children under 13.
Changes
If this policy changes, the new version appears here with a new effective date.