Privacy Policy
In short:
- You can play Crosswold without an account. An account is only needed to keep your progress, create boards, or play Trophy Road.
- The only ads are optional ones in the Android and iOS apps: you choose to watch one for extra letter helps, and they are non-personalised. The website has no ads, there are no third-party trackers, and your data is never sold.
- We record short usage events (such as "game started") to improve the game — no location, no advertising IDs.
- You can delete your account at any time from Settings in the app.
1. Who is responsible for your data
Crosswold is operated by Yohanes Marthin Hutabarat, an individual based in Depok, Indonesia ("we"). For privacy questions, contact [email protected].
This policy covers the Crosswold website and the Crosswold apps for iOS and Android. It is written to comply with Indonesia's Personal Data Protection Law (Law No. 27 of 2022) and, for players elsewhere, the local rules that apply to them.
2. What we collect
What you give us
- Player profile: the nickname and avatar you choose. When you first open Crosswold we create a guest profile with a default name; you can change it at any time.
- Account (optional): your email address and password if you create an account by email. The password is stored as a hash by our authentication provider and is never readable by us. If you sign in with Google, we receive your account ID, email address and display name from Google.
- Boards you create: title, description, clues, answers, topic, tags, board language, the look you choose, and any image you upload as a backdrop or decoration. A published board is visible to other players together with your nickname.
- Reports: the reason and details when you report a board.
- Friends (accounts only): the friend code we give your account, the friend requests you send, accept or decline, your friends list, and the room invites you send to friends. Your friends see your nickname, avatar, trophies and title, and whether you are online or in a game, worked out from your last request to our server and kept only in the server's memory. Anyone with your friend code can send you a request; people you have shared a room with can send one without it.
What is recorded as you play
- Game results: words solved, time, score, hint use, duel outcomes (win, loss, draw, forfeit), trophy and rating changes, and the room codes you create or join.
- To keep the leaderboards fair, answers and timing are handled entirely on our server.
Usage data
The app sends short events to our server — for example session start, viewing or searching boards, starting and finishing a game, using a hint, sharing a result card, reporting a board — together with the platform (web, iOS, Android), the interface language, how you arrived (home, a board link, a room link) and the hostname of the referring site if there is one. These events are linked to your profile ID but contain no location, advertising identifier, contacts, or the contents of your device.
Stickers and purchases
We store your sticker ownership, prize or purchase source, and selected battle stickers with your profile ID. In the native apps, Apple or Google processes payment and RevenueCat verifies purchases using your profile ID and store transaction information. We do not receive card or bank details. Refunds can remove paid ownership. Other players in your match see stickers you send; sticker events are eligible for deletion after five minutes and are removed by the daily retention sweep. Account deletion removes ownership, selections and sends from our database. Store and RevenueCat records follow their own retention rules.
Technical data
Your IP address is processed transiently for rate limiting and abuse prevention; it is not stored in the game database. Our hosting provider may keep standard access logs (IP address, time, requested page) for security and troubleshooting for a reasonable period.
3. Storage on your device
Crosswold sets no cookies and installs no third-party trackers. The Android and iOS apps include Google's ad SDK, which keeps its own data on the device for the ads you choose to watch (see section 5). To work, the app keeps a few things in your device's local storage, all of them necessary for the game:
| What | Why |
|---|---|
| Session token | To recognise you as the same player when you return |
| Settings | Sound, motion, interface language, board language filter |
| Drafts and letters being typed | So a board you are creating or playing is not lost |
| Dismissed guides | So first-time guides do not appear again |
Clearing site data in your browser, or deleting the app, removes all of it. You can always sign back in with your account.
4. Why we use data, and on what basis
| Purpose | Basis |
|---|---|
| Running the game: saving progress, matching opponents, scoring and trophies, showing leaderboards | Providing the service you asked for |
| Accounts: sign-in, password recovery, linking a guest profile | Your consent when creating the account |
| Publishing the boards you create for other players, with your nickname as the author | Providing the service; you choose to publish |
| Security and fairness: preventing cheating, abuse and ranking manipulation, and acting on reports | Our legitimate interest in keeping the game fair |
| Understanding how the game is used, in aggregate, to improve it | Our legitimate interest in developing the game |
| Showing a rewarded ad when you choose to watch one, and adding the helps it earns (Android and iOS apps only) | Providing the service you asked for; your consent where the law requires it |
| Meeting legal obligations and lawful official requests | Legal obligation |
We do not build advertising profiles and make no automated decisions with legal effects about you.
5. Who receives data
- RevenueCat, Apple and Google process native purchases as described above. See RevenueCat’s privacy policy and your store’s privacy policy.
- Other players see your nickname, avatar, trophies, rating, and the boards you publish. In a duel your opponent sees your name, score and connection status.
-
Processors acting on our behalf and only on our
instructions:
- Supabase (database, account authentication and file storage), servers in the Singapore (AWS ap-southeast-1) region.
- Sumopod (Tencent Cloud, Singapore) to run the game server and the website.
- Google, only if you choose "Continue with Google"; Google's use of your data is governed by Google's privacy policy.
- Google AdMob, in the Android and iOS apps only and only when you choose to watch an ad for extra helps. We ask for non-personalised ads. To show and measure the ad and to prevent fraud, Google's SDK receives information about your device and the app, such as your IP address and, depending on your device settings, its advertising identifier. Where the law requires it (for example in the EEA and the UK) the app asks for your consent before any ad. Google's use of this data is governed by Google's privacy policy.
- Sponsored-board partners receive aggregate numbers only (such as player counts), never individual data.
- Authorities, where required by applicable law.
We never sell or rent your personal data.
6. How long we keep data
| Data | Retention |
|---|---|
| Sign-in sessions | 90 days from creation, or until you sign out |
| Usage events | 180 days, then deleted automatically |
| Game results, trophies, rankings | While Crosswold operates; after account deletion, linked only to an anonymous profile |
| Boards you published | Until you hide them; after account deletion they stay published under "Anonymous" unless you hid them first |
| Friend code, friends and friend requests | Until you remove the friend or decline the request; deleted when you delete your account |
| Room invites to friends | One day, then deleted automatically |
| Board reports | As long as needed for moderation |
| Email and account identity | Deleted when you delete your account |
7. Your rights
- Access and correction: your name and avatar can be changed in Settings; your boards in the Studio.
- Deletion: Settings → Manage your account → Delete account. This deletes your sign-in identity (including your email), revokes every session and anonymises your profile; game results remain without a name, and boards you published stay live under "Anonymous" — hide any board you do not want to leave behind first.
- Withdrawing consent: sign out or delete your account at any time.
- A copy of your data: request one by email at the address above; we reply within the period the law sets.
- Complaints: if you believe we have handled your data wrongly, contact us first. You also have the right to complain to the data protection authority in your country.
8. Children
Crosswold is suitable for all ages and can be played without an account. If you are under 18 (or the age of majority where you live), create an account only with a parent's or guardian's permission. We do not knowingly collect children's data beyond a nickname and game results; a parent or guardian who wants a child's data removed can contact us.
9. Security
All traffic is encrypted (HTTPS). Session tokens are stored on the server only as hashes. Puzzle answers and timing never reach a device ahead of time. The team's access to data is limited to what moderation and support need. No system is perfectly secure; if a breach affects you, we will notify you as the law requires.
10. International transfers
Data is stored on our processors' servers in the region named in section 5. Where that region is outside your country, we ensure the processor is bound by equivalent data-protection commitments.
11. Changes to this policy
When this policy changes, the new version is posted on this page with its effective date. We will announce material changes in the app before they take effect.
12. Contact
Yohanes Marthin Hutabarat (individual operator)
Depok, Indonesia
[email protected]