Privacy notice
Last updated: · This is a translation: where it differs from the Italian text, the Italian text prevails.
1. Controller
The controller is Giovanni Sanna, Via Paolo de Muro 1, 07100 Sassari, Italy, VAT number IT02997740903. For any request about your data, write to privacy@cruciverso.app.
2. What data we process, why and for how long
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Account: email; if you sign in with Google, the identifier, first name and last name Google provides to us; access codes and sessions | To create your account and let you sign in | Contract | As long as you have the account |
| Profile: first name, last name, date of birth, gender, username, preferences | To provide the service; to check that you are at least 14 | Contract; for age, legal obligation | As long as you have the account |
| Content: documents and photos you upload, public-source articles you choose, requests to Nona, your library (volumes, crosswords, progress) and your record in "Catch the Letter" | To provide the service | Contract | Uploaded files: deleted after processing, within 48 hours. Text of chapters not yet built: until they are built or the volume is deleted. Requests to Nona that don't become a volume: 7 days. Library and record: as long as you have the account; for a deleted volume, only a technical reference without content remains, for 180 days |
| Purchases: a pseudonymous identifier, the products, the subscription status, gem movements, the purchase notifications we receive from Google Play through RevenueCat, and the device and operating system type detected by its library in the app | To credit purchases and gems; to prevent abuse | Contract; for abuse, legitimate interest | Subscription status and welcome bonus: as long as you have the account; movements and notifications: 180 days |
| Consents and acceptances: what you accepted, which version and when | To demonstrate consents and acceptances | Legal obligation; legitimate interest | As long as you have the account |
| Promotional emails: your address | To send you news and tips about Cruciverso | Consent, which you can withdraw at any time from your Profile | Until you withdraw it |
| Reports and messages you send us: content, reason, note, identifier, email address | To handle reports and requests; to correct content | Legal obligation; legitimate interest | 12 months at most |
| Technical data: requests to our servers, including the IP address and the approximate location derived from it, identifier, errors, status of build jobs, use of artificial intelligence services | Security, prevention of abuse and fraud, operation and cost control of the service | Legitimate interest | Up to 90 days; usage data up to 180 days |
| Backups of the database | To restore the service after a failure | Legitimate interest | Up to 35 days |
Our legitimate interests are the security of the service, the prevention of abuse and fraud, its operation and its continuity.
3. Artificial intelligence
To read photos and generate terms, clues and texts, the necessary content is processed with Anthropic's artificial intelligence, which acts on our behalf.
4. Who we share data with
The following process data on our behalf, as processors: Microsoft (Azure cloud services, including service email), Anthropic (artificial intelligence), RevenueCat (purchase management) and Google (Google Workspace: email). Google processes data as an independent controller when you sign in with Google and when you buy on Google Play. We disclose data to authorities when the law requires it.
5. Transfers outside the European Economic Area
Some of these providers may process data in the United States. Transfers are based on the adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR), for the providers certified under it, and on the standard contractual clauses approved by the European Commission (Art. 46(2)(c) GDPR). You can ask for a copy at privacy@cruciverso.app.
6. Security
We protect data with appropriate technical and organisational measures, including encryption of communications and of stored data, and access restricted to the systems and people who need it.
7. Deleting your account
You can delete your account in the app, from your Profile, or by writing to privacy@cruciverso.app. Deletion becomes final after 30 days, during which you can cancel it by signing in again. After that, only the data in backups, technical data and reports remain, until the deadlines above, and for another 30 days the account's internal identifier and dates. The details are on the Deleting your account page.
8. On your device
The website does not use cookies. The app stores on your device only what it needs to work, such as sign-in credentials and your library, and uses no tracking, analytics or advertising tools. It uses the camera and photos only when you choose to photograph or upload pages, and notifications only for review reminders.
9. Required data
Email and profile data are needed to create the account and use the service: without them, you cannot sign up. Consent to promotional emails is optional.
10. Your rights
You can ask for access to your data, rectification, erasure, restriction of processing and portability, and withdraw a consent at any time, without affecting earlier processing. You can make many of these requests directly in the app, from your Profile; for the others, write to privacy@cruciverso.app. You can lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or with the authority of the country where you live.
Right to object. You can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest, by writing to privacy@cruciverso.app.