Privacy Policy

Updated 1 October 2026.

This Policy describes what happens to data in Crossia. The general part is the same for every Artia club app; the section “What applies to this app” is about Crossia.

Operator

E-com solutions OÜ · Registry code 16662128
Ida-Viru maakond, Lüganuse vald, Oandu küla, Allika, 42314, Estonia
Data protection contact: privacy@artia.club

Where the app runs

In the browser: https://crossia.artia.club/. The app opens at this address — there is nothing to install.

What data is processed

• Sign-in. Two ways: guest — an anonymous record with a random identifier, no name or email asked; email — the address and a password hash are stored. Google and Apple sign-in are not enabled in the club apps.
• Progress: what has been coloured, assembled or laid out, how far, and how long it took.
• Points and achievements: awards, badges, position in the weekly ranking.
• Purchases made with points: what you took from the shop and which access it granted you — for example, the limit on your own pictures being lifted, and until when.
• Shared rooms: who took part and which elements they placed, plus the temporary name used inside the room.
• Messages to us — the text you send through “Write to us”.
• Server technical records: request path, time, response code. They exist so we can fix breakages.

What applies to this app

Your own photo

This app does not accept uploads of your own photographs.

Why it is needed

Progress and points let you continue where you stopped, on any device. Shared rooms let people see each other’s work. Messages let us answer you.

Account deletion

You can delete the record in the app itself: “More” → “Account”.

How long we keep it

Access ends immediately when the confirmed request succeeds: email, password hash, Apple/Google sign-in identifiers and the guest device identifier are cleared, sign-in sessions are revoked, and configured progress, points history, own-picture records, room contributions and support records in our database are deleted. The residual account row, which can still contain the player name, and linked purchase, device/push-token and other records remain for 30 days. They are physically deleted by the next scheduled cleanup, normally within a further 6 hours while the service is running. This is not a recovery period.

Anonymous aggregate counters remain without an account ID and have no automatic expiry. Catalogue submissions can retain a source photo, author name and publication/licence history after the account link is removed; request removal separately. Shared rooms, reaction history, usage events, copies already delivered to support and backups are not all erased by account deletion. These remaining records have no single configured automatic deletion period and may be retained indefinitely; contact privacy@artia.club about removal. Web logs rotate daily with 14 archives retained, rather than a guaranteed 14-day lifetime for every request. Deleting the server account does not remove every local copy on every device or records held by Apple/Google under their own policies.

Your rights

You can request a copy of your data, its correction, deletion, or a restriction on processing. You can delete the record in the app itself: “More” → “Account”. Or write to us.

Children

The app does not ask for age and does not collect data that identifies a child. Guest sign-in needs neither a name nor an email.

Who we share with

Nobody, for advertising or sale. The data sits on our server; disclosure is possible only when the law requires it.

Changes

If the Policy changes, a new date appears at the top. Material changes will be announced in the app itself.