Privacy Policy

This explains, in plain words, what data Crossova processes, why and for how long, who we share it with and what you control. The legal details are in the KVKK Privacy Notice. The data controller is Crossova's founder, Doğukan Bener (an individual); when a company is founded for Crossova it will become the controller, and we will announce this beforehand. Contact: [email protected] · [email protected] · in the app, Settings → Contact us.

1. What we collect

• Account: your e-mail address; if you sign in with Apple or Google, the ID and e-mail the provider gives us. If you want, you can verify your mobile number; it is not shown on your profile.
• Profile: name, username, city, profile and cover photo, bio, interests, the team you support (optional).
• Birth date: only for the 18+ check; not shown to other users.
• Gender: only to decide who can join Girls Only spaces; not shown on your profile. Anyone who selects "woman" as their gender on their profile can join Girls Only; we do not ask for documents. You can choose "Prefer not to say" (then you can't join Girls Only). When you join a Girls Only Cross, the other participants there see you.
• Your content: posts, stories, photos, videos, comments, polls, chats and direct messages, voice messages, GIFs you pick.
• Your participation and trips: Crosses you said "I'm in" to (for a flight: flight number, date and airports), your trip plans, squads, groups.
• Safety: your trusted contacts (in-app users), Safe Return, SOS and help-alert records. Choosing a health-related reason (e.g. "I feel dizzy") in an "I'm not OK" alert is only possible with your separate explicit consent; without it these options are hidden and your alert still goes out.
• Mil and Market: your Mil transactions, rewards you got, Mil you gave to donation campaigns.
• Technical: a one-way hash of a random ID created on your device to prevent abuse (not your phone's hardware ID), session records, your device's push token, and the traffic log required by Law No. 5651: your IP address, the time and, if known, the source port when you sign in and when you create content.

What we do not collect: your contacts, background location, advertising ID, face or biometric data. We use no analytics or advertising tools.

2. Location: when and for how long

We take your location only while the app is open and only when you use a feature.

Photos and videos: location and device information (metadata) are removed on your phone before upload.

3. What we use your data for

• Opening your account and running Crossova (feed, Explore, Crosses, chat, notifications).
• Applying the 18+ rule and the Girls Only rules.
• Protecting you and the community: blocking, reports, moderation, preventing fake accounts and spam.
• Running the Safety Center (Safe Return, SOS, help alerts).
• Running Mil and Market; answering support and data requests.
• Meeting our legal obligations (e.g. the traffic log under Law No. 5651).
• Only if you allow it separately: "Suggestions and offers" notifications (off by default).

We never sell your data or share it for advertising. We do not use artificial intelligence for automated moderation; a person reviews reports. If we ever want to use it, we will update this policy and tell you beforehand.

4. Who sees what

• Everyone: your name, username, profile photo, bio, city.
• Your "I'm in"s: the default visibility is Followers. For each one you can choose "Everyone" or "Followers"; with Plus on, "Invisible mode" keeps you off every list (Plus is unlocked with Mil and is never sold for money). Following on Crossova needs no approval: anyone who follows you sees your Followers-only participation (flights included).
• Your trip plans: the default is Everyone; for each plan you can choose "Followers" or "Link only".
• Your posts: according to the visibility you choose for each.
• Chat members: when you join a chat, your name and photo are visible there. A Cross's chat is open to everyone who said "I'm in" to it.
• People you block don't see you in lists and chats, and you don't see them.
• Other users never see: your birth date, gender (except Girls Only participation), phone or e-mail.
• The Crossova team: does not read your direct messages. If a message is reported, the reviewer sees it and up to 10 earlier messages; every case opening is logged. The team accesses birth date, gender and contact details only when a task requires it (a report, support or a data request). The founder is the only person with technical access to the database.

5. Our service providers

Transfers to providers abroad are made under KVKK Art. 9 by signing the Board's standard contracts and notifying the Authority. Only where legally required do we provide information to courts, prosecutors, law enforcement, the Personal Data Protection Board and the authorities under Law No. 5651.

6. How long we keep data

• Account and profile data: while your account is open.
• When you delete your account: your data and files are deleted and gone from backups within 30 days at the latest. Crosses and groups shared with others stay for them without your link; your reports stay anonymous. What is not deleted is listed below: the traffic log (1 year), data-request records (3 years, without your identity) and other records the law requires us to keep.
• Direct messages: while your account is open.
• Cross and squad chats: deleted 12 months after the Cross ends.
• Nearby location: 24 hours.
• SOS and help alerts (including any health reason): 30 days.
• Safe Return records: while your account is open.
• Content removed by moderation: deleted 90 days after the decision. The case copy of reported messages is deleted 90 days after the case closes.
• Report, decision and appeal records: kept for platform safety; when you delete your account, your identity is removed from them.
• Traffic log (Law No. 5651): 1 year; only the founder can access it, and only for a legal request or a security incident.
• Read notifications: 180 days.
• Data-request records: 3 years. A prepared data archive can be downloaded for 7 days, then it is deleted.
• Account-deletion requests sent via crossova.app: 3 years after the request is closed.

7. Security

Connections are encrypted. Every table has row-level access rules; other users cannot read your private data. Birth date, gender, the device hash, health consent and the traffic log are kept in separate, restricted tables. Every action in the admin panel is logged. If there is a data breach, we notify the Board and the people affected within the legal deadlines (the Board within 72 hours; for users in the EU, also the competent supervisory authority within 72 hours).

8. Your rights and controls

• Access and download: Settings → Request my data. Your archive is delivered in the app within 30 days at the latest.
• Correct: Edit profile.
• Delete: Settings → Delete account.
• Visibility: for each "I'm in", trip plan and post.
• Location: the Nearby and live-location switches; location permission in your phone's settings.
• Withdraw permissions: health-reason consent and "Suggestions and offers" notifications can be turned off in Settings.
• Appeal decisions: if you are restricted, we tell you the reason; you appeal with "Appeal" in the notice. A person reviews your appeal. You can write to support even while your account is restricted.
• If you can't get into the app: the form at crossova.app/en/delete-account (processed after we verify the account is yours) or [email protected].
• Your other KVKK rights and how to apply: see the KVKK Privacy Notice.

9. Under 18s

Crossova is not for anyone under 18. We ask for your birth date at sign-up and no account is opened for anyone under 18. If you notice an account of someone under 18, report it; we will close it and delete its data. Our child-safety standards: crossova.app/en/child-safety.

10. Users in the EU (GDPR)

If you live in the European Union or the European Economic Area, your data is also processed under the General Data Protection Regulation (GDPR, 2016/679).

Legal bases (Art. 6 and Art. 9):

• Performance of a contract (Art. 6(1)(b)): your account, the app's features, location features, the Safety Center, Mil and Market, support.
• Legitimate interests (Art. 6(1)(f)): platform security, reports and moderation, preventing fake accounts and spam, the 18+ rule, optional phone verification, admin-panel access logs, security updates, complying with laws that apply to us (e.g. the traffic log under Türkiye's Law No. 5651).
• Legal obligation (Art. 6(1)(c)): obligations under EU law (e.g. requests from competent authorities).
• Consent (Art. 6(1)(a)): "Suggestions and offers" notifications.
• Explicit consent (Art. 9(2)(a)): a health reason in an "I'm not OK" alert.

Your rights (Art. 15–22): access (Art. 15); rectification (Art. 16); erasure (Art. 17); restriction of processing (Art. 18); receiving your data in a structured, machine-readable format and moving it to another service (Art. 20 — the "Request my data" archive is in JSON); objecting to processing based on legitimate interests (Art. 21); not being subject to a decision based solely on automated processing that significantly affects you (Art. 22 — we do not make such decisions; a person also reviews and decides on the temporary freeze in child-safety reports). You can withdraw consent at any time; this does not affect processing before the withdrawal (Art. 7(3)).

How to apply: Settings → Request my data, or [email protected]. We answer within 1 month at the latest; for complex requests this can be extended by 2 months, in which case we tell you why (Art. 12(3)).

Right to complain: you can complain to the data protection supervisory authority in the EU country where you live, work or where the infringement took place (Art. 77).

Transfers: your data is stored in the EU (Germany). Transfers to providers in the USA rely on the EU-US Data Privacy Framework where the provider takes part in it, otherwise on the European Commission's standard contractual clauses (Art. 46(2)(c)). Japan has an EU adequacy decision (Art. 45). Crossova is operated from Türkiye, so your data is accessed from Türkiye. There is no EU adequacy decision for Türkiye; we apply standard contractual clauses to this access as well.

11. Changes and contact

We may update this policy; we announce important changes in the app beforehand. Questions and requests: [email protected] · [email protected] · in the app, Settings → Contact us.