Privacy Policy
Last updated: August 2, 2026
This Privacy Policy explains how the Crossed Paths app (the “App”) handles information. The App is operated by an independent individual developer (“we,” “us,” “our”), not by a company. The App was designed around one rule: we read the location and date stored inside your photos, never the photos themselves.
By using the App you agree to the practices described here. If you do not agree, please do not use the App.
1. The short version
- There is no account. We never ask for your name, email address or phone number.
- Your photos are never uploaded and never leave your device.
- We read only each photo's coordinates and capture date, and immediately reduce them to coarse map cells (roughly one kilometre across).
- Those coarse cells are stored on our servers so that a friend you connect with can be matched against them.
- You can delete everything at any time by removing the App and asking us to erase your record.
2. What the App reads from your device
With your permission, the App scans your photo library using Apple's Photos framework. For each photo it reads only two properties: the GPS coordinate and the creation date. It never opens, copies, transmits or analyses the image content. If a photo has no location data, it is ignored entirely.
Coordinates are rounded into grid cells of about 0.01° (roughly 1.1 km) before anything is stored or transmitted. Precise coordinates are never sent off the device.
3. What we store on our servers
To let two people compare maps, the following is stored in Google Firebase (Firestore) under a random device identifier:
| Data | Why |
|---|---|
| Random device identifier | Identifies your record without identifying you |
| Anonymous authentication id | Proves write access to your own record |
| Display name you type in the app | So a connected friend sees who they matched with |
| Invite code | Lets a friend connect to you |
| Coarse map cells, visit dates, photo counts, city and country names | Computing overlaps and near misses |
| Friendship records and their overlap summaries | Showing both sides the same result |
| Push notification token | Notifying you when a connection or wave arrives |
The name you enter is entirely your choice — a nickname works. We do not verify it and we do not link it to any other identifier.
4. The optional city pool
If you leave the “Appear in city pool” switch on, the App also publishes an anonymous fingerprint of your movement: cells rounded to roughly 11 km, your most-visited city name, and an emoji. This is what lets the App suggest an anonymous “route twin”. No name, no precise location and no contact details are included, and you can switch it off at any time — doing so deletes that record.
5. Sub-processors
- Google Firebase (Authentication, Firestore, Cloud Functions, Cloud Messaging) — stores the data above and delivers notifications.
- RevenueCat — manages subscription status. It receives a purchase receipt, not your map data.
- Apple — processes payments and delivers push notifications. We never see your payment details.
6. What we do not do
- We do not sell or rent your data.
- We do not use your data for advertising or build advertising profiles.
- We do not track you across other apps or websites.
- We do not access your contacts, microphone, or precise live location.
7. Retention and deletion
Your record is kept for as long as you use the App. Deleting the App from your device stops all further processing. To have your server record and any friendships permanently erased, email crossedpathsapp@outlook.com from any address and include your invite code; we will delete it within 30 days.
8. Your rights
Depending on where you live (for example under the GDPR or the CCPA), you may have the right to access, correct, export or delete your data, and to object to processing. Because the App holds no contact details for you, we use your invite code to locate your record. Contact us at crossedpathsapp@outlook.com.
9. Children
The App is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child has used the App, contact us and we will delete the record.
10. International transfers
The developer is based in Sweden, and the App's infrastructure runs on Google Cloud servers in the United States. Using the App therefore involves transferring your coarse map data out of the EU/EEA. Google LLC is certified under the EU–U.S. Data Privacy Framework, and Google's Standard Contractual Clauses apply to the processing carried out on our behalf. RevenueCat likewise processes subscription data in the United States under Standard Contractual Clauses.
11. Changes
If this policy changes materially we will update the date at the top and, where appropriate, notify you in the App.
12. Contact
Questions or requests: crossedpathsapp@outlook.com. The developer operates from Sweden.