Privacy Policy

1. Who we are

Croisée is operated by Thomas Cosialls, an individual established in France, who is the data controller responsible for your personal data under the EU and UK General Data Protection Regulation (GDPR).

This policy applies to the Croisée mobile app and to this website. It does not cover third-party services that have their own privacy policies, which we identify below.

You can reach us about privacy at any time at hello@digisulit.com.

2. What we collect

We collect only what the app needs to help you and your friends coordinate. By category:

• Account and identity. When you sign up we use Clerk, our authentication provider. Clerk handles your email address and, if you use them, your Google or Apple sign-in. We store only an opaque Clerk account identifier. We never see or store your password.
• Profile. Your handle, display name, chosen avatar color and initial, an optional profile photo you upload, and your preferred app language.
• Home base and trips, at city level only. The city name, country, the coordinates of the city center, optional dates and time zone, and your chosen visibility for each trip. We never collect, request, or store your live device GPS or background location.
• Social connections. Your friend connections, friend requests, and any friend groups you create.
• Crossings. When your plans overlap a friend's in the same place at the same time, we store that computed overlap so we can show and notify you.
• Device and technical data. A push notification token, your app language, and an app-icon badge count, so we can deliver and clear notifications.
• Diagnostics and analytics. Crash and error reports through Sentry, identified only by an opaque account id with email and invite codes removed, and privacy-preserving product analytics through PostHog that carry no name, email, handle, or location.
• Website. If you submit our early-access form, the form provider (Typeform) collects the name and email you choose to give. Our website host keeps short technical logs.

We do not build advertising profiles, and we do not run an ad business. There is no advertising identifier and no tracking-for-ads in Croisée.

3. How we use it, and our legal bases

We use your personal data for the purposes below. Under the GDPR we must have a lawful basis for each one:

• To provide the core service: create your account, show your plans to the friends you have added and accepted, and detect crossings. Legal basis: performance of our contract with you (Article 6(1)(b)).
• To send the notifications you have enabled, such as crossing and friend-request alerts, in your language. Legal basis: performance of our contract and, where required, your consent, which you can withdraw at any time in Settings.
• To keep the service secure, prevent abuse, and diagnose crashes and errors. Legal basis: our legitimate interests in a safe, working app (Article 6(1)(f)).
• To understand which features are used, through analytics that contain no personal identifiers. Legal basis: our legitimate interests in improving the app (Article 6(1)(f)).
• To comply with legal obligations where they apply. Legal basis: compliance with a legal obligation (Article 6(1)(c)).

4. How visibility between friends works

Croisée is built so that you control what other people see:

• A connection exists only after both people send and accept a request. Strangers cannot see anything about you.
• Ghost Mode hides you entirely from every friend's map until you turn it back on.
• Each trip can be visible to all your friends, kept private, or limited to a group you choose.
• You can turn off sharing of your home base separately from your trips.
• Removing a friend stops all sharing between you immediately.

Friends never see your email, your exact device location, your notification or crossing settings, or trips you keep private.

5. Who we share it with

We never sell your personal data. To run Croisée we rely on a small set of trusted service providers (processors) that handle data only on our instructions and only for the purposes below:

Several of these providers are established in, or process data in, the United States and other countries outside the European Economic Area. See the next section on international transfers.

6. International data transfers

When a provider processes your data outside the European Economic Area or the United Kingdom, we rely on a lawful transfer mechanism, such as the European Commission's Standard Contractual Clauses or an adequacy decision, to give your data a level of protection equivalent to that in the EEA and UK.

Contact us at hello@digisulit.com for more information about these safeguards.

7. How long we keep your data

We keep your personal data for as long as your account is active.

When you delete your account, we remove your profile, trips, friend connections, friend requests, crossings, and notifications immediately, and we erase any profile photo from storage. Deletion is permanent: there is no recovery period, and we do not keep an archived copy.

Our service providers may retain limited technical logs for short periods as part of their normal operation and their own legal obligations.

8. Your rights

If you are in the European Economic Area or the United Kingdom, you have the following rights over your personal data:

• Access: obtain a copy of the data we hold about you.
• Rectification: correct data that is inaccurate or incomplete.
• Erasure: delete your data, which you can do yourself at any time in the app.
• Restriction and objection: limit or object to certain processing, including processing based on our legitimate interests.
• Portability: receive your data in a portable, machine-readable format.
• Withdraw consent: where we rely on consent, withdraw it at any time without affecting processing already carried out.

To exercise any of these rights, email hello@digisulit.com. We will respond within one month. If you believe we have mishandled your data, you have the right to complain to your local supervisory authority. In France this is the Commission Nationale de l'Informatique et des Libertés (CNIL), www.cnil.fr; in the United Kingdom it is the Information Commissioner's Office (ICO), www.ico.org.uk.

9. California privacy rights

If you are a California resident, the California Consumer Privacy Act, as amended, gives you specific rights. In the past twelve months we have collected the categories of personal information described in the What we collect section, for the purposes described in How we use it.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

You have the right to know what we collect, to request deletion, to request correction, and not to be treated differently for exercising these rights. To make a request, email hello@digisulit.com. We will verify your request using your account email.

10. How we protect your data

We take reasonable measures to protect your personal data, including:

• Encryption of data in transit using HTTPS and TLS.
• Access controls, so data is reachable only by the systems and people that need it.
• Keeping all third-party keys and secrets on our servers, never in the mobile app.
• Uploading profile photos through short-lived, single-use links, and removing location metadata from images.
• Removing personal identifiers from crash and error diagnostics.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

11. Children

Croisée is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has given us personal data, contact us at hello@digisulit.com and we will delete it.

12. Changes to this policy

If we make a meaningful change to this policy, we will update this page and the date at the top. Where the change is significant, we will take reasonable steps to let you know. Continuing to use Croisée after a change takes effect means you accept the updated policy.

13. Contact

Croisée is operated by Thomas Cosialls, France. For any privacy question, or to exercise your rights, email hello@digisulit.com.