Privacy Policy
1. Who we are
CrossAware is a safety application operated by DAGAR Ltd (SIA), a company registered in Riga, Latvia. We are the data controller for the personal data described in this policy. For any privacy question or request, write to hello@crossaware.com.
2. What data we collect — and what we deliberately don't
CrossAware is built on a privacy-by-design principle: the app's core function — comparing your position against our danger-zone database (railway crossings and dangerous intersections in Riga) and reducing media volume — runs entirely on your device. Because of this architecture, we collect far less than a typical location app:
| Data | Where it is stored | Why we need it | How long we keep it |
|---|---|---|---|
| Account e-mail and an encrypted (hashed) password | Supabase database, hosted in the EU | Sign-in and subscription management | Until you delete your account, plus 30 days in backups |
| Real-time GPS position | Your device only — never uploaded | Detecting proximity to danger zones | Not stored; processed in memory and discarded |
| Anonymous usage events (which mapped zone triggered an alert, and when — with no coordinate trail and no identity attached) | Supabase analytics tables (EU) | Measuring that the product works and pruning zones that produce false alarms | 24 months, then aggregated into statistics |
| Waitlist e-mail (if you signed up on crossaware.com) | Website form provider | One launch notification | Deleted after the launch campaign, or immediately on request |
| Payment details | Stripe (PCI-DSS certified processor) | Paid subscriptions | Per Stripe's policy — we never see or store your card number |
We do not collect: your continuous location or movement history, your name, your contacts, microphone or camera data, or any advertising identifiers. The background location permission Android asks for is used exclusively on your device — it does not mean your location is sent to us.
3. How we store and protect your data
- Encryption: all traffic between the app, the website and our servers uses TLS; data in our Supabase database is encrypted at rest.
- Access control: production database access is restricted to the founder, protected by strong credentials and two-factor authentication on all critical services (Supabase, GitHub, Google Workspace).
- Minimization: if a feature does not strictly need a data point, we do not collect it — the table above is the complete list.
- Processors: we use Supabase (database, EU region), Stripe (payments) and GitHub Pages (this website). Each operates under its standard GDPR data-processing agreement.
- Breach response: in the unlikely event personal data is compromised, we will notify the Latvian Data State Inspectorate (DVI) within 72 hours as required by GDPR Article 33, and inform affected users without undue delay.
4. Legal bases for processing (GDPR Article 6)
We process account data to perform our contract with you (providing the safety service). We process anonymous usage events under our legitimate interest in keeping the danger-zone database accurate and the product functional. We send the waitlist launch e-mail based on your consent, which you can withdraw at any time by replying "unsubscribe".
5. Your rights, including deletion
Under the GDPR you have the right to access, correct, delete or export your personal data, to restrict or object to its processing, and to withdraw consent. To request deletion: use "Delete account" inside the app, or e-mail hello@crossaware.com from your registered address — we confirm and complete deletion within 30 days, including backups within a further 30 days. You may also lodge a complaint with the Latvian Data State Inspectorate (dvi.gov.lv) or your local supervisory authority.
6. Children
CrossAware is often used by school-age children whose parents purchase the subscription. Users under 16 need a parent's or guardian's consent, which we request during signup (GDPR Article 8). Child accounts follow exactly the same on-device privacy model as adult accounts — we never collect more data from a minor.
7. Changes to this policy
We will post any updates on this page. For material changes we will additionally notify you in the app or by e-mail before they take effect.