Privacy Policy

This policy explains what personal data Crossvocab (www.crossvocab.com) collects, why, how long we keep it, and the choices you have. We collect as little as we can: you can generate and solve crosswords without an account.

Who we are

Crossvocab is run by Ganna Kushnirenko, who is the data controller for this website. For any privacy question or request, write to help@crossvocab.com.

What we collect and why

When you generate a crossword (with or without an account):

• your IP address and a browser fingerprint (a code calculated from your browser settings, not stored in a cookie), so we can apply the daily generation limit and stop abuse;
• the date and time, and your account ID if you are signed in;
• the level, topic and number of words you chose. The topic is sent to OpenAI to generate the words and clues.

Generated crosswords are saved and are public: anyone with the link can open them, and we may show them to other users who choose the same level and topic. Do not put personal information in the topic field.

When you create an account: your email address and your subscription plan. If you sign in with Google, we also receive the basic profile information Google shares (your name and profile picture). We use your email to sign you in and to send you a welcome email and important service messages.

When you visit any page: Cloudflare Web Analytics counts the visit: the page, the site you came from, your country, your browser and device type, and how fast the page loaded. It uses no cookies or local storage and does not fingerprint your browser, and we only see totals, never individual visitors.

When you use a crossword: anonymous usage events, so we can see which features help learners: that a crossword was opened, solved, checked, printed or shared, which hints were used, that the daily limit was reached, and that the pricing page was viewed. Each event records only its type, the crossword, the time and whether the visitor was signed in. It contains no IP address, fingerprint or account ID, so it cannot be linked to you.

When you send feedback: your message, your email address if you give it, the page you were on, and your IP address and browser fingerprint. The message is delivered to our inbox by email and is not stored on the website. The IP address and fingerprint are also kept separately to limit how often the form can be used.

Legal bases (GDPR)

• Contract: running your account and the crosswords you ask for.
• Legitimate interests: rate limiting, security, abuse prevention and basic usage statistics.
• Consent: advertising cookies for visitors in the European Economic Area, the UK and Switzerland. You can change your choice at any time.

How long we keep data

• IP addresses and browser fingerprints are erased after 60 days. The anonymous record that a crossword was generated stays for usage statistics.
• Account data is kept until you ask us to delete your account.
• Generated crosswords are kept as public content and do not identify you.
• Anonymous usage events contain no personal data and are kept for long-term statistics.
• Feedback emails are kept in our inbox only as long as we need them to reply.

Cookies and local storage

Crossvocab itself uses your browser's local storage, not tracking cookies:

• a sign-in session, if you have an account;
• a list of crosswords you have already seen, so we do not show you the same one twice.

Advertising partners set their own cookies, as described below.

Advertising

We show ads through Google AdSense to keep Crossvocab free. Google and its partners use cookies to show ads based on your previous visits to this and other websites. Google's use of advertising cookies lets it and its partners serve ads to you based on those visits.

• Learn how Google uses information from sites or apps that use its services.
• You can turn off personalised ads in Google Ad Settings or opt out of some third-party vendors at aboutads.info.
• Visitors in the EEA, the UK and Switzerland see a consent message from Google and can accept, refuse or choose which purposes to allow.

Subscribers of Crossvocab PRO will not see ads.

Who processes data for us

• Supabase - database, sign-in and server functions.
• OpenAI - generating crossword words and clues from your topic.
• Resend - sending emails.
• Cloudflare - hosting and delivering the website, and visit statistics (Cloudflare Web Analytics, without cookies).
• Google - Google sign-in and AdSense advertising.
• Paddle - our reseller and Merchant of Record for Crossvocab PRO. Paddle collects your payment and billing details under its own privacy policy; we receive only your email, your subscription status and Paddle's customer and subscription IDs, never your card details.

Some of these providers process data outside your country, including in the United States, under safeguards such as the EU Standard Contractual Clauses. We do not sell your personal data.

Your rights

You can ask us to access, correct, delete or export your personal data, to restrict or object to its use, and to withdraw consent you have given. To delete your account or make any other request, write to help@crossvocab.com. If you think we have handled your data wrongly, you can also complain to the data protection authority in your country.

Children

Crossvocab is not directed at children under 13, and we do not knowingly collect their personal data. Teachers can print crosswords for their classes, so students do not need to use the website. If you believe a child under 13 has given us personal data, contact us and we will delete it.

Changes to this policy

If we change this policy, we will update the date at the top of this page. For significant changes, we will also let registered users know by email.