Privacy policy

1Who we are

Crosso is built and run by Murat Kuşlu. There is no company behind Crosso: Murat Kuşlu is an individual based in İzmir, Türkiye. For everything described here he is the data controller under Turkish Law No. 6698 on the Protection of Personal Data (KVKK), and the controller under the EU GDPR and the UK GDPR. When this policy says “we” or “us”, it means him.

• Controller: Murat Kuşlu, an individual
• Postal address: İzmir, Türkiye, postal code 35390
• E-mail: privacy@crosso.app

We have not appointed a data protection officer, and we have not appointed a representative in the European Union or the United Kingdom. Write to the e-mail or the address above and it reaches the person responsible.

2What we never do

• We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have never done either.
• We show no advertising, in the app or on the site, and no advertising or attribution service receives anything about you.
• We do not track you across apps or websites that belong to others. The app asks for no tracking permission because it does no tracking.
• There are no third-party analytics, advertising, attribution, crash-reporting or session-recording tools in the app or on the site. The only measurement we do is our own, on our own servers, and it is described below.
• We do not ask for your address book, and the app cannot read it.
• We do not read your calendar.
• We do not use your photos for facial recognition or to identify you. The one exception is the comparison that runs on your own phone when you ask to be verified, described below.

3Creating an account

You sign in with Apple or Google. We never see or store a password.

From the sign-in we keep:

• the identifier your provider gives us (an Apple or Google account ID),
• your e-mail address, if the provider shares it. With Apple this can be a private address that Apple creates for you. We use it to send you one welcome e-mail, and to acknowledge and answer you when you write to us through the feedback form. We do not send marketing e-mail.

Your profile is what other people see. All of it is optional except a nickname and your date of birth:

• nickname, profile photo and a handful of other photos,
• your date of birth. We ask for it because an age limit cannot be enforced on a birth year alone, and we show only your age to other people, never the date,
• gender and the languages you speak. Both are optional and both can be left unanswered,
• home city and country,
• what you are here for: dating, friendship or networking. You pick up to two, and the first is your main mode; you can add the tags “Activity” and “Travel buddy”. If you pick none, you count as being here for friendship. Your modes and tags show on your profile,
• the age range you want to meet. It is used only to filter whom you see, and it is shown to nobody. In dating, if you have not set one, your own age give or take eight years is used,
• a short bio and a motto,
• links to your own social profiles,
• your interests.

Gender is the only profile field that could be considered sensitive in some countries. It is optional, and it is a free choice from a short list that includes “unspecified”. Beyond that we ask for no special category of data: not health, not religion, not political opinion, not trade union membership, not sexual orientation, not genetic data. The face comparison used for verification is described separately under “Verification” below.

We also store, per account: when you signed up, when you were last active, the two-letter language your phone reports (so notifications reach you in your own language), whether the account is banned, and, if you have one, your subscription state.

4Who can see your profile

By default, other people in the app can find you in city lists, in overlaps, in rooms, in Nearby and on the map. In crossing and traveller lists, two people whose modes do not overlap never appear to one another. The rest is up to you:

• Ghost mode hides you from everyone who is not already a match: you disappear from city lists, overlaps, Nearby, check-ins and the “I’ll be there” map, and where your name would appear it says “Someone” instead. Ghost mode is part of the paid plan.
• Passport visibility lets you show your travel history to everyone, to matches only, or to nobody.
• Blocking works in both directions at once. Block someone and neither of you appears to the other anywhere in the app, and any pending hello between you is withdrawn.

People you block, and people whose account is suspended, do not see you in these places. One exception, so that you know it: a photograph you add of a place is published with your nickname next to it, and that credit is not hidden by ghost mode or by a block.

Outside the app, two pages on crosso.app can show something about you: the page your crossing code opens, and the page of an activity you have joined. Both are open to anyone who has the link, with or without an account, and both are described in their own sections below. In ghost mode you appear on neither; a block does not apply there, because we do not know who is opening the page.

We never show your e-mail address, date of birth, IP address, device details or precise location to anyone else.

5Routes

A route is a city and a start and end date. You add them yourself.

Other people in that city see your route, including its full start and end dates and the days you have in common, along with your name, photo, verified badge, gender and languages. You can set a route to public, to matches only, or to private. A private route is used only to suggest things to you and is never shown to anyone.

Routes are also created for you when you join an activity, so that the activity’s city and dates show up as part of your travel.

Your current or next public route also appears on the card and the page that your crossing code opens.

We keep routes until you delete them or delete your account.

6Crossings and hellos

When your route overlaps with someone else’s in the same city, both of you are told once. That notice includes the other person’s name, photo and the days you share.

On the free plan the first three people in every crossing list are open to you; the rest are shown without a name, with only the veil described below. People you already have a hello or a match with are never locked.

People lists can show a match score between 0 and 100 for you and another person, and badges such as “Same days”, “Same route”, “Shared language”, “New” or “Top match”. The score is worked out from how many days you are in the same city, how close your routes run, your modes, your shared languages, tags and interests, whether you have looked at each other’s profiles and whether there is a hello between you. On the free plan the number itself is not shown. Lists are sorted by the days you share first; among people with the same number of shared days, a similar score made from shared interests, shared activities, modes and closeness in age decides the order. Scores are not stored; they are worked out each time, they never decide who can see whom, and they do not switch anything on or off.

A hello is a request to talk. It carries an optional line of up to 300 characters and, if you choose, the route you are sending it from. The person you send it to sees who sent it and what you wrote. A hello expires after 48 hours if it is not answered. On the free plan you can send three a day.

If they accept, you are matched and you can send each other messages.

7Crossing code and the reward

Every account has a crossing code of its own, six characters long. You share it; anyone who types it into the app, whether they have just signed up or already use Crosso, can say hello to you even if your routes never cross. The code is fixed to your account; it cannot be changed in the app.

• When somebody says hello with your code, we record who typed it, when, and whether that hello became a match.
• A hello sent with a code does not count against the three free hellos a day. To stop abuse, an account can send at most 5 hellos a day with codes, and can say hello with a code to the same person only once.
• When somebody says hello with your code, or joins Crosso with it, we send you a push notification. It shows their nickname, or “Someone” if they are in ghost mode.
• You see who came to you through your code, and how many; the list also shows the current city of the person who said hello.
• The first time you match with someone who came through your code, you, as the owner of the code, get one week of Crosso Pass. This happens once per account: however many people come through your code afterwards, there is no second week. We record who you matched with and when the week was given, and tell the subscription verification service.
• The person who came through your code earns nothing through it; they earn their own week by sharing their own code. The same goes for you: typing someone else’s code earns you nothing.
• Anyone who types your code into the app sees a card: your nickname, profile photo, verified badge, the city and dates of your current or next public route, and your main mode. In ghost mode your name and photo are left off that card.
• Your code also has a public page on crosso.app. Anyone who opens it, with or without an account, sees the same card. The page does not show your account ID, and nobody can say hello from it; that takes the app. In ghost mode the page does not show you at all. If you post the link somewhere public, the page may also turn up in search engines.

Your code, the hellos that came through it and the free week it earned are deleted with your account.

8Messages, activities and rooms

Direct messages between matches are kept until one of you deletes the message or the account. Removing the match deletes the whole conversation. A message you delete is replaced by a tombstone that is purged after 30 days.

Activities are things people organise or join. If you join one, the other people going can see that you are going, unless you join in ghost mode. An activity has a chat room that opens before it starts and closes 24 hours after it ends. Room messages are deleted after 60 days.

Every activity also has a public page on crosso.app. Anyone with the link, with or without an account, sees the activity’s name, description, picture, place and date, how many people are going, and the nicknames and photos of up to four of them, the host first. If you joined in ghost mode, or you are in ghost mode, you do not appear there.

City rooms are one public chat per city, named after the city. Anyone using the app can join one, and they are large. Two things to know:

• the app shows you only the last 7 days of a city room’s history, and
• we delete city room messages after 30 days.

City rooms are muted by default. Instead of a notification per message, you get one summary a day telling you how many messages there were and how many of the people talking share your route.

Anything you write in a room is visible to every member of that room. Treat a city room as public.

9“I’ll be there”

You can declare a place and a stretch of hours you will be at it, say a café between three and five. The declaration holds the place’s name, the place’s own identifier from your phone’s map search, the venue’s coordinates (never yours), the roughly one-kilometre grid square the venue falls in, the city, your window, and optionally one word for what you will be doing there: coffee, walk, work, food, or nothing.

• A window is between 15 minutes and 4 hours long and may start at most 36 hours ahead. You may have 3 running at once.
• Anyone using the app who is looking at the map around that place sees it: your nickname, your photo and your verified badge, the place, your hours and your purpose. The map is asked for a radius between 0.5 and 10 km, 3 km by default. Ghost mode, blocks and suspended accounts apply here exactly as everywhere else.
• Declarations at the same place whose hours touch become one meet. The meet is what the pin on the map actually is, and it shows how many people are coming and up to three of their faces.
• Once a meet has two members it grows a temporary chat room. It opens 2 hours before the meet starts and stops taking messages 24 hours after it ends. Everyone in the meet can read it. Members are sent one reminder about half an hour before the start, and one message when it is over.
• You can mark “I’m here” and “I’ve left” while you are there; the marks are accepted only within half an hour either side of your own window. Marking that you arrived also opens a check-in at that place, exactly as if you had checked in yourself, and everyone else in the meet is told: they see that you arrived and when.
• Cancelling takes the declaration out of everyone’s view immediately. The row itself is deleted by the sweep below along with the rest.
• Your own past declarations are shown back to you for 30 days.

Declarations, the arrival marks on them and the meet’s room are deleted 7 days after the window ends. Nothing renews them.

10Photographs of places

A café the map knows about often has nothing to show for itself. So the person who is standing in it can add a photograph, and the newest one becomes that place’s cover everywhere in the app.

• You can add one only if you checked in at that place, or declared you would be there, within the last 7 days. Up to 5 a day.
• We store the picture, the place’s identifier, name and coordinates, your account, and when you added it.
• The photograph is public inside the app and it carries your nickname. That credit is not hidden by ghost mode, and it is visible to people you have blocked. If you would rather not be named under a picture of a place, do not add one.
• The picture is first checked for faces on your phone; that check runs on the device and the picture does not leave it for that purpose. A picture with a face in it is never uploaded.
• Once uploaded, the picture is screened again on the server by an automated image moderation service before it is published: for adult and violent content, and for faces. A photograph with a recognisable face in it is refused, because a place’s picture is of the place. If the screening cannot be reached at that moment, the picture is neither published nor kept; you are asked to try again shortly.
• Anyone can report one. 3 different people reporting the same photograph hides it immediately, without waiting for us. A moderator can also hide it.
• You can delete your own at any time, and they all go when your account does.

We keep place photographs until you or a moderator removes them, or your account is deleted. They are not swept on a timer, because a picture of a café is a fact about the café rather than about an evening.

11Nearby, Teleport and check-ins

Nearby is off unless you turn it on, and it only runs while the app is open and in the foreground.

Your phone works out which square of a roughly one-kilometre grid you are in and sends us only that square’s name, not your coordinates. We do not receive, and cannot derive, where you are within that square. We keep one row per person, overwritten each time, with no history.

• A position counts as current for 60 minutes. After that you stop appearing.
• Your phone reports at most every 30 minutes, and again when you cross into a new square.
• You can only see who is around a square if you are reporting one yourself, and only for your own square and the eight next to it.
• Distances shown are between squares, not between people. Two people in the same square see “0.0 km”.
• Turn Nearby off and we delete the row immediately. Anything left behind is deleted after 24 hours.

Teleport lets you look at who is around another city. It is read-only: nothing is written, the people you are looking at are not told, you do not appear to them, and no distances are shown. The coordinates the app sends for a teleport are the city centre’s, not yours.

Check-ins (“I’m here”) are different from Nearby: you pick a place from a search and say you are there. We store the place’s own identifier, its name and the place’s coordinates, never yours. A check-in lasts 2 hours, or until you end it. A place has to be within 3 km of the square you reported, so that “I am here” means here.

Check-ins are also kept as a ledger for 30 days, which supports three things: who is at a place now, who was there in the last 7 days, and “you were both at the same place”. That last one looks back 14 days and requires two explicit check-ins, yours and theirs, at the same place on the same day. We never infer that you were somewhere from a Nearby position.

12Location permission, and what your phone actually sends

The app asks for location only while you are using it. It never asks for background or “always” location, and it cannot collect your position when it is closed.

While you have given permission, three different things happen, and they are not the same:

• A coarse position for your profile. At most once every 5 minutes while the app is open, your phone sends your position, accurate to about 100 metres, to our server. We round it to one decimal degree, roughly 11 kilometres, before storing it, and only the rounded value is kept. It is used to answer “is this person in the same city, nearby, or far” and to sort travellers by distance. The precise value is not written down anywhere, and the rounded one is replaced each time.
• A grid square for Nearby, described above, which is all that feature ever receives.
• A position used and thrown away. Some map and search requests carry your position so the server can work out what is within a radius of it. That value is used to answer the request and is not stored.

Everything else about places happens on your phone: searching for a café, Apple Maps and Look Around, and working out whether you have arrived at a meet. That last one is a comparison of two grid squares, done on the phone.

If you turn location permission off in iOS Settings, all of this stops.

13Verification

Verification puts a badge on your profile. It is entirely optional.

The face comparison runs on the phone: your own profile photos are fetched to the phone and compared against the selfie there. The comparison starts only when you have read the explanation on the verification screen and opened the camera yourself.

• No face template, embedding or measurement ever leaves your phone. What reaches us is a number between 0 and 1 and a yes or no.
• Your selfie is uploaded only when the result is not clear enough to decide, so that a moderator can look at it. A clear yes and a clear no are both settled on the phone and no image is sent at all.
• When a selfie is uploaded, a reviewer sees your selfie, your profile photos and the score. The selfie is deleted the moment there is a decision. If nobody has decided within 7 days, the selfie is deleted, the request is cancelled and you are told to try again.

We keep only the outcome, the score and the date. Your selfie is never stored on your phone either.

Although no face measurement ever reaches us, we treat this comparison, to be on the safe side, as processing of biometric data, and we do it only with your explicit consent.

14Photos

Photos are stored with our content delivery and security provider, not in the database. Your phone re-encodes every picture you send before it leaves the device, which removes camera and location metadata (EXIF, including any GPS tag); our server re-encodes it again and strips the metadata a second time. Only the picture you actually choose is uploaded; the app never reads or lists your library.

Uploaded photos are screened for adult and violent content by an automated image moderation service. Only the image is sent, with no name and no account identifier. We keep nothing the service returns except the decision to allow, hold or remove the photo. A photo that fails is removed; a photo that could not be screened is held out of public view until a person looks at it.

The veil. We also keep a 24×30 pixel copy of your profile photo, blurred past recognition on our server. When you are shown to somebody without a Crosso Pass (in their “who looked” list, among the people going to an activity, or in the locked part of a crossing list), that tiny blur is sent instead of your name and your photo, so the address of the real picture never reaches them. It lives and dies with the photo: it is remade when you change it, and it goes when you remove it or when your account is deleted.

15Voice calls

Matches can call each other. Calls are voice only; the app has no video calling. Starting a call takes Crosso Pass; answering one does not.

• No call is recorded and no audio ever reaches our servers. Calls are set up between the phones over an encrypted connection; our servers only help to establish that connection. The audio is encrypted end to end between the two phones. Because phones on mobile networks usually cannot reach each other directly, the encrypted audio passes through a relay run by our content delivery and security provider. A relay forwards packets it cannot read; it cannot listen to a call.
• Our server issues the short-lived credentials your phone needs for that relay, and carries the messages the two phones use to find each other. We send the relay’s operator nothing that identifies you; the request for credentials carries only how long they should last.
• What we store is a call log: who called whom, which match it belonged to, when it started, when it was answered, when it ended, and whether it was answered, missed, declined or cancelled. Both of you can see your own call history. These rows are kept until one of the accounts is deleted.
• To make your phone ring when the app is closed we store a call notification token for your device, and send the call notification through Apple’s notification service. That notification carries the caller’s account identifier, nickname and profile photo address, so the phone can draw the incoming-call screen. The token is deleted when the device is unregistered, when you sign out of all devices, or when the account is deleted.

16Profile views

When someone opens your profile we record who looked and when, once per person per 24 hours.

You can see the last 30 days of this. On the free plan you see how many and when; on the paid plan you see who. Someone in ghost mode stays anonymous either way. We hold these records for 30 days and then delete them.

17Notifications and your devices

We send push notifications through a push notification service. To reach your phone we give it your Crosso account identifier as an alias, your device’s push token, and the notification itself, which can contain another person’s nickname and a preview of what they wrote. You can turn each kind off in the app. Call notifications go through Apple’s own notification service.

Per device we store the push identifier, the platform and when the device was last active.

18Payments

The paid plan is called Crosso Pass. It is bought through the App Store and tracked by a subscription verification service.

We never see your card. What we store is whether your entitlement is active, which product and entitlement it is, when it expires, whether it will renew, which store it came from and the last event we received about it. The subscription verification service is given your Crosso account identifier so that a purchase can be matched to your account.

An administrator can also grant or withdraw a free run of the paid plan, and we store the reason.

19Feedback

If you write to us through Help and Feedback in the app, we store your name, your e-mail address, the kind of message, what you wrote, your platform and app version, and our own handling notes. Your message is also forwarded to us by e-mail so that we can read and answer it, and we send you an acknowledgement e-mail. What you send through the forms on the site lands in the same inbox; see “The crosso.app website” below. If you delete your account, the text of your message stays, because an open bug report should not vanish, but your name, your e-mail address and the link to your account are removed from it. If you would rather the whole thing went, say so when you write to us and we will delete it.

20The crosso.app website

The site has no accounts; you use it without signing up.

• Visiting. When you open the site, your browser connects to the content delivery and security service that serves it. Your IP address and what your browser sends appear, as on any website, in short-lived logs used to serve the page and to stop abuse.
• Cookies. The site uses one strictly necessary cookie: the session cookie for signing in to the admin panel. For visitors there are no advertising cookies, no tracking pixels and no analytics tools.
• Contact and support forms. When you send a form we store your name, your e-mail address, your message, the topic you chose, your organisation if you give it, and the IP address and browser the form was sent from. Your message also lands in the same inbox as feedback from the app and may be forwarded to us by e-mail so that we can read and answer it; you are sent an acknowledgement e-mail. The site’s own records are kept for 24 months; the copy in the inbox stays, like feedback messages. If you want it deleted from both, write to us and we will delete it.
• Public pages. The pages opened by crossing codes and by activities are described above.

21How we measure the app

We measure the app ourselves, on our own servers. No analytics service is involved.

Each event is a row holding: the event name (for example a screen view, a paywall view, the outcome of a purchase), the screen, an optional source, the platform, the app version, the time, and, when you are signed in, your account identifier. We use it to see which screens are used and where people give up, and nothing else. No event carries a message, a photo, a location or a name.

To tell a first install from a reinstall, the app keeps a marker in the iOS keychain. That marker survives deleting the app, so a reinstall on the same device is not counted twice. It contains no personal data and is not used to build a profile of you.

Analytics rows are deleted after 180 days, and all of yours are deleted immediately if you delete your account.

22Your calendar

If you ask the app to add an activity to your calendar, that happens on your phone, and the app asks iOS for write-only access. It cannot read your calendar, and it is not sent to us.

23Reporting, blocking and moderation

You can report a person, a photo, a message, an activity or a photograph of a place. A report records who reported whom, the reason, anything you wrote and what was reported. Our moderators read reports and decide what to do. Every action they take is written to an audit log holding the administrator’s e-mail address and IP address, the action, what it was applied to (often an account) and the time. That log is kept and cannot be edited, which is the point of it.

We store reports, and the list of people you have blocked, in order to enforce the Community rules in our Terms of use.

Automated screening, and how to argue with it. Two decisions are taken by software without a person involved: an uploaded photo can be refused or held back by the content screening described above, and a photograph of a place is hidden automatically once three different people have reported it. Neither has a legal effect on you and neither decides anything about you as a person; the worst case is that one picture does not appear. If a decision is wrong, write to privacy@crosso.app and a person will look at the picture and put it back if it should never have gone.

24About IP addresses

Your IP address reaches our servers, as it does with every website and app. We use it to apply rate limits and to stop abuse, and it appears in short-lived server logs. We do not store it against your account, and we do not store it with your consent record. If you send a form on the site, your IP address is kept with that form’s record, as described above.

25Who else processes your data

Most of these are processors acting only on our instructions, not people we sell anything to. Apple and Google also act under their own terms and privacy policies for sign-in, and Apple does so for App Store purchases. We may also disclose data to a public authority, a court or a lawyer where the law obliges us to, and we would tell you unless we are forbidden to.

If Crosso is ever handed over to someone else, your data may pass to the new operator. We would tell you beforehand, and the protections in this policy would go with your data.

26Sending your data abroad

Every provider in the table above is outside Türkiye, and several are outside the European Economic Area. Running the app and the site is not possible without them.

For people in Türkiye. Under Article 9 of the KVKK, as amended in 2024, a transfer abroad needs an adequacy decision, or one of the appropriate safeguards filed with the Authority, or, where neither exists, your explicit consent. There is no adequacy decision covering these countries, and we have not filed a standard contract for these transfers. So for people who use the app, the transfer of personal data to the recipients listed above rests on your explicit consent, which you give with a separate switch on the consent screen when you sign up. That switch is never on by default; you turn it on yourself. You are being told, specifically and before it happens, which recipients receive your data, which countries they are in and what they do with it. You can withdraw that consent at any time by writing to us or by deleting your account; withdrawing it means we can no longer run the service for you, because there is no version of the app that does not use these providers.

For people in the EEA or the UK. Where the provider offers them, transfers are made under the European Commission’s Standard Contractual Clauses (and the UK Addendum where the UK GDPR applies). Ask us and we will tell you which mechanism a particular provider relies on.

27Where your data comes from

• From you: when you create an account, fill in your profile, add a route, write to people, or write to us from the app or the site.
• From your phone, automatically: your location if you allowed it (as described above), your push token, your platform and app version, our own measurement events, and your IP address.
• From your sign-in provider: your Apple or Google account ID and, if it is shared, your e-mail address.
• From the App Store, through the subscription verification service: the state of your Crosso Pass subscription.
• From other people using the app: when they say hello to you, use your code, look at your profile, report you or block you.
• From the site: your IP address and browser details when you visit, and what you type into a form.

We collect all of this electronically, by automated or partly automated means. The legal basis for each is in the table below.

28Why we are allowed to hold each thing

Where we rely on consent you can withdraw it at any time, and where we rely on a legitimate interest you can object to it. Both are described under “Your rights”.

Do you have to give us any of this? A nickname, a date of birth and an Apple or Google sign-in are required; there is no account without them. On the site’s forms a name, an e-mail address and a message are required, because we cannot answer you without them. Everything else is optional, and the only consequence of leaving it out is that the part of the app it feeds does not work.

29How long we keep things

30Deleting your account

You can delete your account from the app, in Settings. It is immediate and permanent: there is no grace period and nothing is archived.

Deleted with it: your profile and every photo you uploaded, including the files themselves in storage; your routes; your crossing code; your hellos and matches; your messages and the reactions you left; your activity attendance and room messages; your “I’ll be there” declarations and arrival marks; your photographs of places and the reports you filed on other people’s; your Nearby position and check-ins; your profile views in both directions; your call log and your call tokens; your notifications and settings; your subscription record and the week your code earned; your consent records; your devices; and every analytics row with your id on it.

Two things do not go with it, and one is changed rather than deleted:

• Activities you created stay, without a host, so that the people who joined them are not left with a hole in their plans.
• The moderator audit log stays. Reports you filed and reports filed about you are deleted with your account; what our moderators did about them is not, because an audit log that can be erased by the person it is about is not an audit log.
• Feedback messages stay so that an open bug report is not lost, but your name and e-mail address are removed from them and they are no longer linked to you.

A file that our storage provider refuses to delete is logged and retried by hand rather than left to fail the deletion silently; the database rows go either way. Copies left in our providers’ automatic backups are deleted by the backups’ own cycle within 30 days at the latest.

What you sent through the site’s forms is not linked to your account, so it is not deleted with it; write to us if you want it deleted.

If you have a Crosso Pass subscription, deleting your account does not cancel it or stop the billing; you have to cancel it in the App Store as well.

31Your rights

If you are in Türkiye. Article 11 of Law No. 6698 gives you the right to learn whether we process your personal data; to ask for information if we do; to learn the purpose and whether it is used accordingly; to know the third parties here and abroad that it is transferred to; to have incomplete or incorrect data corrected; to have it deleted or destroyed under the conditions in Article 7 of the KVKK, and to have that correction or deletion notified to the third parties it was transferred to; to object to a result that works against you and was produced solely by automated analysis; and to claim compensation if you suffer damage because it was processed unlawfully.

To use these rights, write to privacy@crosso.app from the e-mail address on your account, or send a signed letter to the postal address above. Your application should give your name and surname, your Turkish ID number if you are a Turkish citizen (otherwise your nationality and your passport or identity number), your address for correspondence, your e-mail address if you have one, and what you are asking for. We answer within 30 days and free of charge, as Article 13 requires; if the request needs a separate cost, we will tell you the tariff set by the Board first. If your application is refused, if you find our answer inadequate, or if we do not answer in time, you can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) within 30 days of learning our answer, and in any case within 60 days of your application.

If you are in the EEA or the UK. The GDPR gives you the rights of access, rectification, erasure, restriction of processing, data portability and objection (Articles 15 to 22), and the right not to be subject to a decision based solely on automated processing that produces legal effects; we take no such decision. Where we rely on your consent you may withdraw it at any time, which does not affect what was lawful before you withdrew it. Where we rely on a legitimate interest you may object, and we will stop unless we can show compelling grounds that override yours. We answer within one month; if a request is complex or there are many, that can be extended by two further months, and if it is, we tell you within the first month. You may complain to your own supervisory authority, or to the authority where you live or work.

Wherever you are. Most of this you can do in the app: your profile is editable, every feature that needs consent can be switched off in the same place you switched it on, and your account can be deleted in two taps. For anything else, write to us.

32If you are in California

We do not sell your personal information and we do not share it for cross-context behavioural advertising, as the CCPA and CPRA use those words. We have not done so in the last twelve months and we have no plans to. We do not knowingly process the personal information of anyone under 18, because the app is for adults. We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects, and we do not discriminate against anyone for using their rights.

33Security

Sign-in is through Apple or Google, so we never hold a password. Traffic between the app and our servers is encrypted in transit; photos are kept in separate storage rather than in the database; call audio is encrypted end to end between the two phones; sign-in tokens are short-lived and revoked when you sign out or delete your account; and every action a moderator takes is written to an audit log that cannot be edited.

No service is perfect. If there is a personal data breach, we report it to the Personal Data Protection Board within 72 hours of learning of it, and to the competent supervisory authority where the GDPR requires; we also tell the people affected as soon as we reasonably can.

34Children

Crosso is for adults. You must be 18 or older, we ask for your date of birth to enforce it, and we do not knowingly hold the data of anyone younger. If we learn that an account belongs to someone under 18 we close it and delete the data. If you believe a child is using the app, write to us.

35Changes

If we change this policy in a way that matters, the app shows you the new version and asks you to accept it before you carry on. We keep a record of which version you accepted, when, in which language and from which app build; we do not store your IP address with that record. The text on crosso.app is the same as the one in the app and is updated on the same day.

36Language

This policy is published in Turkish and in English, and the two are meant to say the same thing. For users in Türkiye the Turkish text prevails; for everyone else the English text prevails.

37Contact

• Controller: Murat Kuşlu
• Privacy and data requests: privacy@crosso.app
• Problems: support@crosso.app
• Everything else: hello@crosso.app
• Postal address: İzmir, Türkiye, postal code 35390