Privacy Policy
This Privacy Policy explains how BlueMind Software Yazılım ve Bilişim Teknolojileri Ticaret Limited Şirketi, a company organised under the laws of Turkey (“CrossIQ”, “we”, “us”), collects, uses, shares, and protects your personal data when you use the CrossIQ app and website (the “Service”). We act as the data controller for the personal data described here.
We comply with the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and, where applicable, the EU General Data Protection Regulation (“GDPR”) and other data-protection laws.
Contents
1. Data We Collect
| Category | Examples |
|---|---|
| Install identifier | CrossIQ has no sign-in and no accounts. We do not ask for, and never receive, your name, email address, or a password. When you first open the app it generates a random identifier for that install and stores it in your device’s keychain; this identifier is what links your puzzles, progress and hint balance together. Because it is held in the keychain, it survives deleting and reinstalling the app. Deleting your data in Settings discards it and generates a new one. |
| Profile | Your display handle, any bio or editor details, and titles/achievements you earn. |
| Content you create | Topics you submit, puzzles you generate and choose to publish, and your solving attempts. |
| Gameplay & progress | Puzzle attempts, completion stats, streaks, achievements, and your hint-credit (“✦”) balance and ledger. |
| Community & safety | Reports you file, users you block, and account-deletion feedback you choose to share. |
| Notifications | If you enable reminders, a device push token and your reminder preferences. |
| Technical & usage | Device and app information, log data, approximate region inferred from IP, and diagnostic information needed to operate and secure the Service. |
| Product analytics | Which screens you open and a coarse record of what you do in the game — puzzles started and solved, hints spent, when a hint was wanted but unaffordable, and the outcome of a rewarded ad. Recorded against your install identifier. See section 6. |
| Advertising | If you choose to watch a rewarded ad, our advertising provider receives device and diagnostic information and your approximate location, as described in section 6. |
| Purchases | Records of in-app purchases. Payment is processed by Apple; we do not receive your full payment-card details. |
2. Topics & AI Processing
When you create a puzzle, the topic text you enter is sent to one or more third-party artificial-intelligence providers to generate the words and clues. The specific provider or model used may change over time. We send only the topic text and the technical information required to generate a puzzle; we do not send your identity to the AI provider for this purpose beyond what is necessary to operate the feature.
Please avoid entering personal or sensitive information in topic fields, as generated content may be stored and, if you publish it, shown to other users.
3. How We Use Data
- To provide the Service: create and store your account, generate puzzles, save progress, run streaks, achievements, and hints.
- To enable community features: publishing, browsing, leaderboards, reporting, and blocking.
- To send notifications you have enabled, such as daily reminders.
- To show rewarded ads you choose to watch, and to credit the hints you earn from them.
- To understand how the app is used in aggregate, so we can improve it.
- To moderate content and keep the community safe.
- To maintain, secure, debug, and improve the Service.
- To comply with legal obligations and enforce our Terms.
4. Legal Bases (KVKK / GDPR)
- Performance of a contract — to provide the Service you request.
- Legitimate interests — to secure, debug, improve, and protect the Service and our community, balanced against your rights.
- Consent — for optional features such as push notifications, and, in the EEA and UK, for advertising as described in section 6; you can withdraw consent at any time.
- Legal obligation — where we must process data to comply with applicable law.
5. Sharing & Service Providers
We do not sell your personal data. We share data only with service providers (processors) who help us run the Service, under appropriate agreements. We engage providers in the following categories:
| Category | Purpose |
|---|---|
| Cloud hosting & database | Storing your account and content, authentication, and running our backend. |
| Content delivery & security | Serving the website and app traffic securely and reliably. |
| Artificial-intelligence providers | Generating puzzles and clues from the topics you submit. |
| Advertising (Google AdMob) | Serving the optional rewarded video ads you choose to watch. See section 6. |
| Product analytics (PostHog) | Measuring how the app is used, so we can improve it. Hosted on PostHog’s EU Cloud. See section 6. |
| App platform (Apple) | App distribution, push notifications, and in-app purchases. |
We may also disclose data where required by law, to protect our rights or users’ safety, or in connection with a merger, acquisition, or asset sale (with continued protection of your data).
6. Advertising & Analytics
Rewarded ads
CrossIQ shows rewarded video ads, and only rewarded video ads. They are never interstitial and never interrupt a puzzle: the only way to see one is to open the “earn hints” screen and choose to watch a video in exchange for hint credits. If you never tap it, you will never see an ad.
Ads are served by Google AdMob (Google Ireland Limited / Google LLC). To serve and measure an ad, Google’s SDK receives technical information from your device, which according to Google’s own disclosures includes device and diagnostic information, performance data, and your approximate (coarse) location. We do not send Google your topics, your puzzles, or your hint balance.
We do not ask for permission to track you across other companies’ apps and websites — CrossIQ does not present Apple’s App Tracking Transparency prompt and does not use the device advertising identifier for cross-app tracking. Ads are correspondingly less personalised, which is a deliberate choice.
Every ad request is non-personalised, everywhere, for everyone. That is true even where you have consented and we would be permitted to personalise: the request carries Google’s “non-personalised ads” flag regardless of your region or your answers.
If you are in the EEA, the UK, or Switzerland, we still ask for your consent before ads are served at all, using Google’s consent management platform, and you can change or withdraw that choice at any time from the app.
Product analytics
We use PostHog, hosted on its EU Cloud, to understand how the app is used. Our Supabase database is likewise hosted in the EU, so the two systems holding your data stay in one jurisdiction.
What we record is deliberately coarse — roughly a dozen events in a session, not every tap. It covers which screens you open, when a puzzle is started and solved (with elapsed time and hints used), when a hint is spent, when you wanted a hint and could not afford one, the outcome of a rewarded ad, and taps on purchase buttons. We do not record what you type, the letters you enter into a grid, or the contents of your puzzles.
These events carry your install identifier so they can be joined to your own records, but we do not create marketing profiles from them, we do not use them to target advertising, and we do not share them with advertisers. Session replay and screen recording are switched off.
7. International Transfers
Some of our providers are located outside Turkey and the EU/EEA, including in the United States. Where personal data is transferred internationally, we rely on appropriate safeguards permitted under KVKK and the GDPR (such as standard contractual clauses and, under KVKK, explicit consent or other lawful transfer conditions).
8. Data Retention
We keep personal data for as long as your account is active and as needed to provide the Service. When you delete your account, we delete or anonymise your personal data within a reasonable period, except where we must retain certain data to comply with legal obligations, resolve disputes, or enforce our agreements. Content you published and that others have interacted with may persist in anonymised form.
9. Your Rights
Subject to applicable law, you have the right to: access your data; correct inaccurate data; delete your data; restrict or object to certain processing; data portability; and withdraw consent. Under KVKK, you also have the right to learn whether your data is processed, request information about processing, and request that third parties to whom data was transferred be notified of corrections or deletion.
You can delete your account and associated data directly in the app under Settings → Delete account. To exercise any other right, contact us at contact@crossiq.app. You also have the right to lodge a complaint with your local data-protection authority (in Turkey, the Kişisel Verileri Koruma Kurumu; in the EU, your national supervisory authority).
10. Children’s Privacy
The Service is not directed to children under 13, and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact us and we will take steps to delete it. Where a higher age of digital consent applies, that age governs.
11. Security
We use technical and organisational measures designed to protect personal data, including encryption in transit, access controls, and database-level security rules. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will revise the “Last updated” date and, for material changes, provide additional notice where appropriate.
13. Contact
Data controller: BlueMind Software Yazılım ve Bilişim Teknolojileri Ticaret Limited Şirketi
Registered address: Zerdalilik Mah., Burhanettin Onat No: 84, İç Kapı No: 3, Muratpaşa / Antalya, Türkiye
Privacy contact: contact@crossiq.app