Privacy policy
Crossly is a crossword game. It needs an email address to give you an account and it records how you did on each level. That is very close to all of it, and this page is the long version.
Last updated 26 August 2026
The short version
- You can play the whole game without giving us anything at all.
- An account stores your email address, a display name, and your scores.
- We do not sell your data, and we do not run behavioural advertising.
- There are no analytics or tracking scripts on this site.
- You can delete your account and everything attached to it by asking us to.
Crossly is operated by the Crossly team, who is the data controller for everything described here.
What we collect
If you create an account
| Data | Where it comes from |
|---|---|
| Email address | You, at signup. Used to sign in, confirm the account and reset a password. |
| Password | You. Stored only as a bcrypt hash — we cannot read it, and neither can anyone who obtained a copy of the database. |
| Display name | You. Shown on the leaderboard, so choose accordingly. |
| Profile picture | You, if you upload one. Optional. |
| Game record | Generated as you play: which levels you completed, when, how long each took, your score and how many words you revealed. |
| Sign-in dates | Recorded automatically when you sign in. |
Whether or not you have an account
- Your IP address, briefly. Sign-in, signup and password-reset attempts are counted against the address they came from, to stop the forms being used for password guessing or bulk signups. The counters are short-lived and are not used to build a profile of you.
- Standard server logs kept by our hosting provider, containing the usual request information.
- Ad break outcomes. When an advert fails to load or is closed early, we record that it happened, on which level, and whether the player was a guest — so we can tell how often people are blocked by an advert that will not play. It is not tied to anything identifying for guests.
If you use the contact form
Your name, your email address and your message, kept so that we can answer you and see whether the same problem has been reported before.
Why we hold it
Under UK and EU data protection law we need a lawful basis for each use. Ours are:
- Performing our contract with you — your account, your saved progress, your leaderboard position. Without these there is no game to give you.
- Our legitimate interests — keeping the accounts and the leaderboard secure and honest, blocking abuse of the forms, and understanding how often ad breaks fail. We keep this to the minimum that achieves it.
- Your consent — for anything optional, such as a profile picture. You can withdraw it by removing the picture.
We do not use your data to train machine-learning models, and we do not sell or rent it to anybody.
Playing as a guest
A guest gives us nothing. Which levels you have finished is written to your browser's session storage, which is wiped when the tab closes and is never sent to us. There is no guest record in our database, no guest identifier, and nothing to delete.
That is also why guest play is not scored and does not appear on the leaderboard: we have deliberately not built the thing that would be needed to track a guest between visits.
Cookies and local storage
We set no advertising or analytics cookies. What is stored is:
| Name | Kind | Purpose |
|---|---|---|
| Session cookie | Cookie | Keeps you signed in. Strictly necessary — an account cannot work without it. HTTP-only, so scripts on the page cannot read it. |
crossly-theme | Local storage | Remembers whether you chose light or dark. |
crossly-cbsafe | Local storage | Remembers the colour-blind-safe board setting. |
crossly-guest | Session storage | A guest's progress through the levels. Cleared when the tab closes. |
Because none of these is used for advertising or measurement, no consent banner is required for them — but you can clear them at any time in your browser settings. Clearing the session cookie signs you out; clearing the rest only forgets your preferences.
Who else sees it
We use a small number of suppliers to run the service. They process data on our instructions and for no purpose of their own:
| Supplier | What they handle |
|---|---|
| Vercel | Hosting, request logs, and storage for uploaded profile pictures. |
| Neon | The database holding accounts and game records. |
| Resend | Sending account email — confirmation links, password resets. They see the address the message is going to. |
Some of these operate outside the UK and EEA. Where they do, transfers are covered by the standard contractual clauses in our agreements with them.
We will also disclose data where the law requires it, and to protect the service against fraud or abuse.
Advertising
The game is free and is paid for by adverts shown between levels and in exchange for revealing a word.
Our intention is contextual advertising — adverts chosen by what the game is, not by who you are. If that ever changes, it will be described here first and you will be asked before any tracking begins.
How long we keep it
- Your account and game record: for as long as the account exists. If it goes unused for 24 months we may delete it after warning you at the address on file.
- Password reset and confirmation links: minutes to hours. Only a hash of the token is ever stored, and it is single-use.
- Rate-limit counters: a rolling window measured in minutes.
- Contact messages: as long as we need them to deal with what you wrote about, and then a reasonable period as a record of the exchange.
- Server logs: per our hosting provider's retention, typically a few weeks.
Deleting your account removes it, your scores and your leaderboard entry. Where a score has already been aggregated into a published ranking, the underlying record still goes.
Your rights
You can ask us to:
- give you a copy of what we hold about you;
- correct anything wrong — a display name is editable in your profile directly;
- delete your account and everything attached to it;
- restrict or object to a particular use;
- hand your data to you in a portable format.
Use the contact form and say which of these you want. We will answer within one month. There is no charge, and you do not have to explain why.
If you think we have handled your data badly, you can complain to your national data protection authority — in the UK, the Information Commissioner's Office at ico.org.uk. We would rather you told us first.
Children
Accounts are for people aged 13 and over. Anyone of any age can play as a guest, because guest play collects nothing whatsoever.
If you believe a child under 13 has created an account, tell us and we will remove it.
Changes
When this policy changes, the date at the top changes with it. If a change materially affects how we use your data — a new advertising partner, a new purpose — we will tell account holders by email before it takes effect, not after.