KVKK Privacy Notice
This notice explains, under Article 10 of Türkiye's Personal Data Protection Law No. 6698 (KVKK), how your personal data is processed in the Crossova mobile app and on crossova.app. It is for your information; we do not ask you to approve it.
1. Data controller
The data controller is Doğukan Bener, Crossova's founder and publisher (an individual). When a company is founded for Crossova, the company will become the data controller; we will announce this in the app and on this page beforehand.
Contact:
- Personal data and requests: [email protected]
- Support: [email protected]
- Rights violations, illegal content and child-safety reports: [email protected]
- In the app: Settings → Contact us
2. What data we process
| Category | Examples |
|---|---|
| Identity | Name, username, birth date (only for the 18+ check; not shown on your profile) |
| Contact | E-mail address; the ID and e-mail provided by Apple or Google if you sign in with them; your mobile number, if you choose to verify it |
| Profile and preferences | Photos, cover, bio, city, interests, the team you support, gender (only for Girls Only; not shown on your profile), notification and privacy settings |
| Your content | Posts, stories, photos, videos, comments, polls, chats and direct messages, voice messages, GIFs you pick |
| Participation and travel | Crosses you said "I'm in" to (event, venue, city; for a flight, the flight number, date and airports), trip plans, squads, groups |
| Location | Only when you use a feature and only while the app is open; details below |
| Safety | Your trusted contacts (in-app users), Safe Return, SOS and help-alert records |
| Health (special category) | Only if you pick it yourself in an "I'm not OK" alert, a health-related reason (e.g. "I feel dizzy") — only with your explicit consent |
| Security | A one-way hash of a random ID created on your device (not a hardware ID), session records, the traffic log required by Law No. 5651 (IP address, time and, if known, source port when you sign in or create content), report, moderation-decision and appeal records |
| Marketing | Only if you allow it: your "Suggestions and offers" notification setting |
| Mil and Market | Mil transactions, rewards you got, Mil you gave to donation campaigns |
| Support and requests | Support chat, e-mails you send us, data-request and account-deletion request records |
Location in detail:
- Map: when you tap "Go to my location", your location is used only on your phone to center the map and is not sent to Crossova's servers. The map provider (Apple on iOS, Google on Android) may receive the area shown and device information under its own terms.
- "I'm here" (check-in): your location is sent once and compared with the Cross location on the server; it is not stored — only the fact and time of the check-in remain.
- Nearby (optional, off by default): your location rounded to ~1 km is deleted after 24 hours; for the home district you pick, only the district's center is used.
- Safe Return live location (optional, off by default): during the trip your precise location goes only to the people you chose; it is not stored.
- SOS and help alerts: if you add your location, an approximate ~5 km area.
- We never take your location in the background. Location and device information (metadata) in photos and videos is removed on your phone before upload.
What we do not collect: your contacts, background location, advertising ID, face or biometric data. We use no analytics or advertising tools.
3. Purposes and legal bases
| Purpose | Data | Legal basis (KVKK) |
|---|---|---|
| Opening your account, sign-in, running the app (feed, Explore, Crosses, chat, notifications) | Identity, contact, profile, content, participation | Art. 5(2)(c) performance of a contract |
| Applying the 18+ rule | Birth date | Art. 5(2)(c); Art. 5(2)(f) legitimate interest (protecting minors); Art. 5(2)(ç) (age measures under Law No. 5651) |
| Access to Girls Only spaces | Gender | Art. 5(2)(c) |
| Location features (check-in, Nearby, live location, SOS area) | Location | Art. 5(2)(c) (only when you use them) |
| Safe Return, SOS, help alerts | Safety data, trusted contacts | Art. 5(2)(c) |
| Sending a health-related reason in an "I'm not OK" alert | Health | Art. 6(3)(a) explicit consent |
| Optional phone verification (preventing fake accounts) | Phone number | Art. 5(2)(c); Art. 5(2)(f) |
| Reports, moderation, appeals; preventing fake accounts and spam; platform security | Content, security data, device hash | Art. 5(2)(f) legitimate interest; Art. 5(2)(ç) legal obligation; Art. 5(2)(e) establishing and defending rights |
| The traffic-log obligation under Law No. 5651 | IP address, time, port | Art. 5(2)(ç) legal obligation |
| Mil, Market, donation campaigns | Mil transactions | Art. 5(2)(c) |
| Support, data requests and account-deletion requests | Contact, correspondence, request records | Art. 5(2)(c); Art. 5(2)(ç); Art. 5(2)(e) for proof |
| Delivering app updates to your device | IP address, device and version information, update ID | Art. 5(2)(c); Art. 5(2)(f) for security fixes |
| Admin panel and access logs | The record handled, the team member, the time | Art. 5(2)(f); Art. 5(2)(ç) for the data-security duty in Art. 12 |
| "Suggestions and offers" notifications | Notification setting | Art. 5(1) explicit consent (off by default, can be withdrawn in Settings) |
We do not use artificial intelligence for automated moderation; a person reviews reports. If we ever want to use it, we will update this notice and tell you beforehand.
4. How we collect data
Electronically, by automated or partly automated means: from what you enter in the Crossova app or in the forms on crossova.app, from how you use the app and from the device permissions you grant (camera, photos, microphone, location, notifications; each asked separately). If you sign in with Apple or Google, from those providers; if someone added you as a trusted contact, from that user.
5. Who we share data with
| Recipient | Country | What and why |
|---|---|---|
| Supabase (database, files, sign-in; sub-processor AWS) | Germany (Frankfurt) | All data; running the app |
| Expo; Apple (APNs); Google (FCM) | USA | Delivering notifications: device push token and notification text |
| Expo (app updates) | USA | Update check when the app opens: IP address, platform, version, per-install update ID |
| Apple (maps on iOS) / Google (maps on Android) | USA | When you open the map: the area shown, IP address and device information, under the provider's own terms |
| Apple, Google (sign-in) | USA | If you sign in this way: sign-in ID and e-mail |
| Twilio (Verify) | USA | Only if you verify your phone: phone number and the verification SMS |
| Resend (e-mail delivery) | Japan (sending servers); US company | Sign-in code e-mails: e-mail address and code |
| Cloudflare (crossova.app hosting, forwarding of incoming e-mail, admin-panel access gate) | USA (global network) | Site visitors' IP address and browser information; e-mails you send us (in transit); team sign-ins |
| Google (Gmail; mailbox) | USA | E-mails and attachments you send to destek@, kvkk@ and bildirim@ |
| Giphy (GIFs) | USA | The search term you type when searching GIFs; because GIFs load from Giphy's servers, your IP address and device information |
| Telegram | UAE (global network) | A "new case" alert to the moderator: only the case code and category; no name, content or summary |
| Sentry (only if crash reporting is on) | USA | Error trace, app version, device model and OS, pseudonymous account ID; no name, e-mail or messages |
| Admin panel (admin.crossova.app) | — | Crossova's own tool; the data stays in Supabase. Only authorized team members, limited to their role; every action is logged |
| Other users | — | Your profile, posts and participation, according to the visibility you choose |
| Authorities | Türkiye | Courts, prosecutors, law enforcement, the Personal Data Protection Board and the authorities under Law No. 5651; only where legally required |
Transfers to providers abroad are made under KVKK Art. 9 by signing the standard contracts announced by the Board and notifying the Authority within 5 business days of signing.
6. How long we keep data
- Account data: while your account is open. Deleted when you delete your account; gone from backups within 30 days at the latest.
- Direct messages: while your account is open; deleted when you delete your account.
- Cross and squad chats: deleted 12 months after the Cross ends.
- Nearby location: 24 hours.
- SOS and help alerts (including any health reason): 30 days.
- Safe Return records: while your account is open; deleted when you delete your account.
- Content removed by moderation: deleted 90 days after the decision. The case copy of reported messages is deleted 90 days after the case closes.
- Report, moderation-decision and appeal records: kept for platform safety; when you delete your account, your identity is removed from them.
- Traffic log (Law No. 5651): 1 year; kept with restricted access until that period ends even if you delete your account, then deleted.
- Data-request records: 3 years (even after account deletion, to prove we handled the request; a one-way hash is kept instead of your identity). A prepared data archive can be downloaded for 7 days, then it is deleted.
- Account-deletion requests sent via crossova.app: 3 years after the request is closed.
- Other records the law requires us to keep: for the period set by law.
7. Automated decisions
A person decides on reports; we do not use automated restrictions. The one exception: if content is reported for child safety or for sharing intimate images without consent, the content is hidden at once and the posting account is frozen until the review ends, to prevent harm; then a person decides. If you are restricted, we tell you the reason and you can appeal in the app; you can also write to support while your account is restricted (KVKK Art. 11(1)(g)).
8. Your rights (KVKK Art. 11)
To learn whether your data is processed; to request information if so; to learn the purpose and whether it is used for that purpose; to know the third parties in Türkiye or abroad it is transferred to; to request correction if it is incomplete or wrong, and deletion or destruction under the conditions of Art. 7, and that these are notified to the third parties it was transferred to; to object to a result against you arising solely from automated analysis; to claim compensation for damage caused by unlawful processing.
9. How to apply
- In the app: Settings → Request my data (your data archive is delivered in the app), Settings → Delete account, or Settings → Contact us. We verify you through your account.
- By e-mail: [email protected] (writing from the e-mail address registered to your account lets us verify you faster).
- If you can't get into the app: the form at crossova.app/en/delete-account (processed after we verify the account is yours).
We conclude your request free of charge within 30 days at the latest (if the action has an extra cost, the fee in the Board's tariff may be charged). If your request is rejected, you find the answer insufficient or you get no answer in time, you may complain to the Personal Data Protection Board within 30 days of learning the answer and in any case within 60 days of your request.
10. Updates
We may update this notice. We announce important changes in the app beforehand. You can request earlier versions at [email protected].