Privacy Policy
1. Privacy at a Glance
General Information
The following information provides a simple overview of what happens to your personal data when you visit this website and use the CrossVocab application. Personal data is any data that can be used to personally identify you.
Data Collection on This Website
Who is responsible for data collection on this website?
Data processing on this website is carried out by the website operator. You can find their contact details in the "Information about the responsible party" section of this privacy policy.
How do we collect your data?
Your data is collected when you provide it to us (e.g., during registration). Other data is automatically collected or collected with your consent by our IT systems when you visit the website. This is primarily technical data (e.g., internet browser, operating system, or time of page access).
What do we use your data for?
Some of the data is collected to ensure error-free provision of the website. Other data may be used to analyze your user behavior (with your consent).
Data Transfers to the USA and Other Third Countries
We use tools from companies based in the USA (for example, for hosting, authentication, and databases). If these tools are active, your personal data may be transferred to and processed on servers in the USA. Please note that the USA is generally considered to provide an adequate level of data protection under the EU Commission adequacy decision (EU-US Data Privacy Framework). Where providers we use are not certified under this framework, data transfers are based on the EU Commission's Standard Contractual Clauses (SCCs) to ensure contractual safeguards for your data.
2. Hosting and Content Delivery Networks
Hosting with Cloudflare Pages
We host our frontend application on Cloudflare Pages. The provider is Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA.
Cloudflare provides a globally distributed content delivery network (CDN). In this context, data traffic between your browser and our website is routed through Cloudflare infrastructure to optimize loading times and protect the site against attacks. For technical reasons, your IP address is processed.
The use of Cloudflare is based on our legitimate interest in secure, reliable, and efficient delivery of our service (Art. 6(1)(f) GDPR). Data transfers to the USA are based on the EU-US Data Privacy Framework or, where applicable, Standard Contractual Clauses (SCCs).
Authentication and User Management (Clerk)
We use Clerk for registration, login, and secure user account management. The provider is Clerk, Inc., San Francisco, CA, USA.
When you create an account or log in, Clerk processes your login data (e.g., email address, passwords in encrypted form, profile information) and, where relevant, billing-related data. This processing is required to provide your user account and fulfill the user contract with you (Art. 6(1)(b) GDPR). Data is stored on servers in the USA. Data transfers are based on the EU-US Data Privacy Framework or Standard Contractual Clauses (SCCs).
Backend and Database (Convex)
To store content you create (e.g., vocabulary lists, crosswords) and process your learning progress, we use backend services from Convex. The provider is Convex, Inc., San Francisco, CA, USA.
All content you generate in our app is stored on Convex servers in the USA. This processing is essential to provide the core CrossVocab functions (storing and retrieving learning content) and is based on contract performance under Art. 6(1)(b) GDPR. Data transfers to the USA are based on the EU-US Data Privacy Framework or Standard Contractual Clauses (SCCs).
3. Information about the Responsible Party
The responsible party for data processing on this website is:
David Schwab
Draisstraße 24
79106 Freiburg
Germany
Email: info@crossvo.cab
4. Your Rights
You have the following rights regarding your personal data:
- Right of Access (Art. 15 GDPR)
- Right to Rectification (Art. 16 GDPR)
- Right to Erasure (Art. 17 GDPR)
- Right to Restriction of Processing (Art. 18 GDPR)
- Right to Data Portability (Art. 20 GDPR)
- Right to Object (Art. 21 GDPR)
5. Cookies
Our website uses cookies. Cookies are small data packages and do not cause any damage to your device. We use technically necessary cookies and analytics cookies (only with your consent).
6. Analytics with PostHog
To improve our app, we use the analytics tool PostHog (provider: PostHog, Inc.). We have configured PostHog in a privacy-friendly way so that analytics data is processed and stored exclusively on servers within the European Union (EU). No data transfer to the USA takes place for these analytics purposes.
Collection of your usage behavior is disabled by default and only takes place if you provide explicit consent through our cookie banner (Art. 6(1)(a) GDPR). You can revoke this consent at any time with effect for the future.
Last updated: February 2026