Privacy policy

Effective 31 October 2026

In short: Crossprout collects only what it needs to run your games. You can play without giving us your email. There are no ads, no tracking across apps or websites, and we never sell your data. You can delete your account in the app at any time.

Who we are

Crossprout is made by Juan Paolo Ibarra, based in Spain, who is the data controller for the information described here. For any privacy question or request, email support@crossprout.com.

What we collect

A guest account. When you first open the app, we create an account with a random ID so your games can be saved. It doesn’t include your name, phone number or contacts.
Your display name. We give you a random name, which you can change. Your opponents see it. We check new names against a list of offensive words.
Your games. Boards, moves, letters, scores, turn deadlines, invite codes, and when each move was made.
Your email address, only if you add one. We use it to send you sign-in codes so you can save your games and get them back on another phone. Other players never see it, and we don’t send marketing emails.
Technical information. Like most online services, our servers record basic request details such as your IP address and the time of the request. These logs are kept for a short time and used to keep the service running and secure.
Messages you send us. If you email support, we keep your message and email address so we can reply.

Crossprout doesn’t use advertising, analytics or tracking tools, and doesn’t access your location, contacts, photos, camera or microphone.

Stored on your phone

The app keeps your sign-in session, unsubmitted turns, and a few choices (such as whether you dismissed a reminder) on your device. Deleting the app removes them.

Why we use it

To provide the game you asked for: saving your games, matching you with the friend you invited, showing your name to them, and recovering your games when you ask. This is necessary to perform our agreement with you (GDPR Article 6(1)(b)).
To keep Crossprout safe and working: preventing abuse, filtering offensive names and fixing problems. This is based on our legitimate interest in running a secure, friendly game (Article 6(1)(f)).
To answer you when you contact support (Article 6(1)(b) or (f)).

Who processes it for us

We use a small number of service providers, who process data only on our instructions:

Supabase stores your account and games and runs the game server, in Frankfurt, Germany.
Resend sends sign-in code emails, from Ireland.
Cloudflare hosts this website and forwards emails sent to support@crossprout.com to our inbox, which is hosted by Google.

Some of these companies are based in the United States, so data may be accessed from outside the European Economic Area. Where that happens, it’s protected by the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

Apple distributes the app. If you choose to share analytics or crash data with app developers in your iPhone settings, Apple shares anonymised reports with us. Apple’s handling of your data is covered by Apple’s own privacy policy.

We don’t sell your data or share it with anyone else, unless the law requires us to.

How long we keep it

Your account, display name, email and games are kept until you delete your account, or until you stop using Crossprout: we automatically delete guest accounts after 12 months without activity, and accounts with an email after 24 months. Deleting an inactive account works the same way as deleting it yourself.
Server logs are kept for a short period, normally no more than a few weeks.
Support emails are kept for as long as needed to help you, and deleted after that.

Deleting your account

Open More → Delete my account in the app. Deletion happens straight away:

your sign-in, display name and saved email are removed;
your active games are forfeited to your opponents, and waiting invitations are cancelled;
the data on your phone is cleared and the app starts over as a new guest.

Your opponents keep the record of games they played with you, but you’re shown as “Deleted player” and nothing in those games identifies you. Copies in backups are overwritten as part of the normal backup cycle.

If you can’t use the app, email us from the address you saved and we’ll delete your account for you.

Your rights

You can ask us to access, correct, delete or export your data, or to restrict or object to how we use it. Email support@crossprout.com and we’ll reply within one month. We may need to confirm the request comes from you, for example by sending a code to your saved email.

If you’re unhappy with how we handle your data, you can complain to a data protection authority. In Spain, that’s the Agencia Española de Protección de Datos.

Children

Crossprout isn’t intended for children under 14. If you think a child has given us their email address, contact us and we’ll delete it.

Changes

If we change this policy, we’ll update it here and change the date at the top. If the change is significant, we’ll tell you before it takes effect.