English · Latviešu
Privacy Policy
1. Who we are
CrossAware is a safety application operated by SIA "DAGAR" (registration No. 40103579673, legal address Silciema iela 15 k-2 - 40, Riga, LV-1024, Latvia). We are the data controller for the personal data described in this policy. For any privacy question or request, write to hello@crossaware.com.
2. What data we collect — and what we deliberately don't
CrossAware is built on a privacy-by-design principle: the app's core function — comparing your position against our danger-zone database (railway crossings and dangerous intersections in Riga) and reducing media volume — runs entirely on your device. Because of this architecture, we collect far less than a typical location app:
| Data | Where it is stored | Why we need it | How long we keep it |
|---|---|---|---|
| Account e-mail address, a hashed password (we never store the password itself) and technical sign-in data (such as when the account was created and when you last signed in; sign-in logs may also include your IP address) | Our database provider Supabase (EU region) | Sign-in, account management and account security | Until you delete your account, plus 30 days in backups |
| Account profile and acceptance record: a copy of your e-mail address, your app settings (whether notifications and location use are switched on), the time you confirmed location use, the time you confirmed your age or a parent's or guardian's consent and accepted the Terms, and the version of the Terms accepted | Our database provider Supabase (EU region) | Saving your settings; being able to show when and which version of the Terms was accepted by the user or their parent or guardian | Until you delete your account, plus 30 days in backups |
| E-mails you send us (for example questions and requests about your data, including account deletion requests) and our replies | Our e-mail inbox; e-mail sent to hello@crossaware.com is forwarded to it by Namecheap, Inc. (USA) | Replying to you and carrying out your request; being able to show that the request was handled | General correspondence: up to 12 months after the matter is resolved. Requests about your data and our replies: 3 years after the request is completed; after account deletion we keep only this correspondence, not your account data or history |
| Continuous real-time GPS position (while monitoring is active) | Your device only — the continuous stream is never uploaded | Detecting proximity to danger zones | Not stored; processed in memory and discarded |
| Danger-zone entry/exit events — the zone, whether you entered or left, and the time, linked to your account (we do not store the GPS coordinates of the crossing) | Our database provider Supabase (EU region) | Showing your in-app activity log and recent safety statistics | Automatically deleted 90 days after the event. You can also export or delete this history yourself in the app at any time |
| Android beta sign-up (crossaware.com form): your e-mail address — it must be the e-mail of your Google account — and the platform you chose | Collected through our form provider Formspree, Inc. (USA), which forwards it to our e-mail inbox. We then add your e-mail address to the tester list of CrossAware in Google Play Console, so Google can give you access to the beta | Inviting you to the Android beta and sending you beta-related messages (e.g. new test versions, the public launch) | Deleted from Formspree once you have been invited. Kept in the Play Console tester list and our e-mail inbox while the beta runs, and deleted within 30 days after the public launch. You can leave the beta and ask us to remove your address at any time |
| iOS launch notification (crossaware.com form): your e-mail address and the platform you chose | Formspree, Inc. (USA), forwarded to our e-mail inbox | Sending you one e-mail when the iOS app launches | Deleted after that e-mail is sent, and in any case by 31 March 2027, or earlier if you ask us or unsubscribe |
Payments: CrossAware is currently free and we do not process any payment data. If we introduce paid plans, we will update this policy before they launch.
We do not collect: a continuous trail of your movements, your name, your contacts, microphone or camera data, or any advertising identifiers. We log only the discrete moments you cross into or out of a danger zone (see the table above) — not where you are the rest of the time. The background location permission Android asks for is used on your device to detect those crossings; the continuous position stream itself is never sent to us.
When you visit crossaware.com: the website uses no cookies, analytics or tracking, and loads no content from third-party servers (our fonts are hosted on our own site). Like any website host, our hosting provider GitHub processes your IP address and basic request data (such as browser type and time of the request) to deliver the pages and keep the service secure. We do not receive or use this data to identify you.
3. How we store and protect your data
- Encryption: all traffic between the app, the website and our servers uses TLS; data in our Supabase database is encrypted at rest.
- Access control: production database access is restricted to the founder, protected by strong credentials and two-factor authentication on all critical services (Supabase, GitHub, Formspree, Google Play Console and our e-mail account).
- Minimization: if a feature does not strictly need a data point, we do not collect it — the table above lists all categories of personal data we store.
- Map and zone data: to show the map, the app requests map tiles from OpenStreetMap's tile servers; these requests reveal your device's IP address and the map area you are viewing. Danger-zone data is downloaded from public Overpass API servers for a fixed area covering all of Riga, so those requests reveal your IP address but not where you are. Neither includes your account. These services are operated independently by the OpenStreetMap Foundation and the Overpass server operators under their own privacy policies.
- Service providers (processors): we share personal data only with providers that process it on our behalf and under a data-processing agreement (GDPR Article 28):
- Supabase, Inc. — app database and sign-in (EU region);
- Formspree, Inc. (USA) — receives sign-ups from the website form;
- GitHub, Inc. (USA) — hosts crossaware.com;
- Namecheap, Inc. (USA) — forwards e-mail sent to hello@crossaware.com to our inbox.
- Google Play (Android beta): if you join the Android beta, we add your e-mail address to our tester list in Google Play Console. Google uses it to give you access to the beta under Google's Privacy Policy, as a separate controller.
- International transfers: some of these providers are based in the United States. GitHub is certified under the EU-U.S. Data Privacy Framework (European Commission adequacy decision (EU) 2023/1795). For Formspree and Namecheap, transfers are covered by the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914). You can ask us for a copy of the relevant safeguards at hello@crossaware.com.
- Breach response: in the unlikely event personal data is compromised, we will notify the Latvian Data State Inspectorate (DVI) within 72 hours as required by GDPR Article 33, and inform affected users without undue delay.
4. Legal bases for processing (GDPR Article 6)
We process account data and your danger-zone entry/exit history to perform our contract with you — providing the safety service and the in-app activity log and statistics. In line with data minimization, that history is kept for a limited 90-day window and then deleted automatically. We process your app settings likewise to perform our contract with you (GDPR Article 6(1)(b)). We keep the record of your age confirmation, Terms acceptance and location-use confirmation, and correspondence about your requests, based on our legitimate interest in being able to show that the contract was properly concluded and that requests were handled, and in defending our rights if necessary (Article 6(1)(f)). When you ask to join the Android beta, we use your e-mail address to invite you and add you to the Google Play tester list because you have requested it, as a step before you start using the app (GDPR Article 6(1)(b)). We send the iOS launch e-mail based on your consent (Article 6(1)(a)). You can leave the beta or withdraw consent at any time by replying "unsubscribe" or writing to hello@crossaware.com; this does not affect messages already sent. We process website request data (IP address) to deliver and secure the website based on our legitimate interest in operating a secure website (Article 6(1)(f)).
5. Your rights, including deletion
Under the GDPR you have the right to access, correct, delete or export your personal data, to restrict or object to its processing, and to withdraw consent. To export or delete just your danger-zone history: open Settings → Data & Privacy in the app, where you can download it as a file or delete it instantly. To delete your whole account: use the account deletion option in the app's Settings (if your app version offers it) or e-mail hello@crossaware.com from your registered address, as described at crossaware.com/delete-account.html. We complete deletion without undue delay and within 30 days at the latest, and in backups within a further 30 days. If a request comes from a different e-mail address, we may ask you to confirm it from your registered address, so that we can make sure the account is yours. You may also lodge a complaint with the Latvian Data State Inspectorate (dvi.gov.lv) or your local supervisory authority.
6. Children
CrossAware is intended for teenagers and adults who walk or cycle. It is not designed for or directed at children under 13. CrossAware has no minimum age and we do not verify users' age, so a parent or legal guardian may choose to set up the app for a younger child. A parent can also turn on a PIN lock so that safety mode cannot be switched off without the PIN (the PIN is stored only on the device).
We process account data to provide the service under our Terms (GDPR Article 6(1)(b)). A user under 18 may use CrossAware only with the consent of a parent or legal guardian, who accepts the Terms on the child's behalf; for a child under 13, the parent or legal guardian must set up the app and the account.
Where we rely on consent (for example, the iOS launch e-mail), a person aged 13 or over may give consent themselves; for a child under 13, consent must be given by a parent or legal guardian (GDPR Article 8; Latvian Personal Data Processing Law, Section 33). If we learn that we hold consent-based data of a child under 13 without a parent's or guardian's consent, we will delete it.
A parent or legal guardian may exercise the child's data protection rights on the child's behalf. A child's account follows exactly the same privacy model as any other account — we never collect more data from a minor.
7. Changes to this policy
We will post any updates on this page. For material changes we will additionally notify you in the app or by e-mail before they take effect.