Privacy policy
What the crosstype app stores, why, and how to get rid of it. The free test on this website is a different thing with almost nothing to report — §2 covers it separately.
Last changed 21 August 2026.
1 · Who is responsible
crosstype is run by one person. The data controller is Sam Chiang, as an individual, in the United States. There is no company. Questions, corrections and deletion requests go to support@crosstype.app.
2 · This website
You do not need an account to use this website and there is nothing here to sign into. The test runs entirely in your browser: your answers are scored on your own device, and anything you type into an open-response box never leaves the page you typed it on.
This site sets no cookies, writes nothing to local storage, and runs no analytics, no tracking pixels and no advertising. There is no third-party script on any page of it.
Three things are still true, and leaving them out would be the kind of overclaiming this site exists to avoid:
- Cloudflare hosts the site and, like any web host, sees the ordinary details of each request — your IP address, your browser’s user agent, and which page you asked for.
- Each page loads two typefaces from Google Fonts, so Google receives your IP address and user agent when a page loads.
- Asking us to email you your report sends your answers. The report link contains them — that is what makes it work on any device with no account and nothing stored — and §5 explains how readable that code is. So when you use that form, your email address and that link go to our Cloudflare Worker, which passes both to Mailgun to send the message. Mailgun keeps a delivery log, and the message sits in your inbox afterwards. The Worker stores neither: it builds one email and forgets both. Nothing is sent unless you use the form; taking the test and reading the result on this site sends nothing.
3 · What the app stores
All of it is stored against your account, so all of it is personal data about an identifiable person. This list is taken from the database’s own migration files rather than from a template of what an app like this usually collects.
| what | where | notes |
|---|---|---|
| Email address | auth.users | The only contact detail. Used to send you a sign-in code, and nothing else. |
| Username, display name, bio, claimed type, chosen mouth | profiles | Visible to other signed-in adults. Bio is capped at 280 characters. |
| Your test answers | test_runs.answer_blob | Readable, one digit per question — see §5. |
| Your result | test_runs | The type, both models’ fit scores, the confidence band, and whether the two schools disagreed. |
| Messages | messages.body | Public rooms and direct messages alike, stored as plain text and readable by the operator. |
| Friends and requests | friendships, friend_request_events | Who asked whom, and when. |
| Blocks | blocks | Who blocked whom. |
| Room membership | room_members | Which rooms you are in, when you last read each, and whether you muted it. |
| Reports you file or receive | reports | Your description, plus a snapshot of the reported message and the username as it stood. Survives deletion — §6. |
| Filter flags | message_flags | A copy of a message the word filter caught, and which terms caught it. Survives deletion — §6. |
| Edit log | message_edit_events | Timestamps only. It exists to enforce a rate limit, and holds no message text. |
4 · What is not collected
No location. No contacts. No health or financial data. No photos, audio, browsing history or search history. No advertising or attribution identifiers.
That is checkable rather than promised. The app has no analytics, crash-reporting or attribution library among its dependencies at all — not one — and it asks for no tracking permission, so there is no tracking to disclose.
5 · The answers you gave the test
Your answers are stored with your account as a compact code: one digit per question, 86 of them for the full test. It is not encrypted and it is not anonymous. Anyone with access to the database can decode that code and read back the individual answers you gave.
This is stated bluntly because an earlier draft of the app’s own documentation called it an opaque encoding that was not item-level, and that was simply untrue. The code is ordinary base64; decoding it takes one command and no key.
What is also true, and worth as much: the scoring happens on your device rather than on a server, and nothing on the server ever reads that code. The row is readable only by the account that owns it. Open-response free text is never uploaded at all. And if you never sign in, none of this exists anywhere but your own phone — which is the case for everyone who only ever takes the test on this website.
6 · Deleting your account
You can delete your account at any time from inside the app: Profile → Settings →
DELETE ACCOUNT, then type delete to confirm. It happens immediately, it
cannot be undone, and it is not a deactivation — the account is gone, not paused.
What goes:
- your profile, username and claimed type
- every test run on this account, and the answers stored with it
- your friends, requests and blocks
- every message you have posted — in rooms and in direct messages, for everyone, not just for you
What stays:
- reports about you, and reports you filed — each keeps the reported message and your username as they stood at the time, with the account itself detached
- sign-in records held by our authentication provider
The second list exists because a report has to outlive the account it is about. If deleting yourself also deleted every complaint about you, deleting yourself would be a way to erase the complaint.
“Detached” is not “anonymous.” A kept report still holds the message and the username as they stood when it was filed; what is removed is the link to your account. We would rather say that plainly than let the word “detached” do quiet work.
If you have already uninstalled the app, email support@crosstype.app from the address on the account and it will be done within 7 days. /delete-account has the same instructions on one page.
7 · Who else handles this data
- Supabase — the database, sign-in, and realtime messaging. Everything in §3 sits there.
- Mailgun — sends the app’s sign-in codes and, on this website, your report email and any app announcement. So it handles your email address, and its delivery logs include the address it delivered to and the message it delivered — which, for a report email, contains the link and therefore your answers. See §2 and §5.
- Cloudflare — hosts this website and holds the waitlist described in §8.
- Google — fonts only. See §2.
8 · The waitlist
If you give your email address to the waitlist, or tick the box asking to hear when the app is out, that address is the only thing stored. It is held in Cloudflare Workers KV — the same infrastructure already running this site — and it is used to tell you when the app is out, for nothing else.
Ticking that box does not put you on a list on its own. It sends you one line inside your report email asking you to confirm; until you tap it your address is held as a pending row that deletes itself after seven days, and you are on no list at all.
Mailgun sends these messages, so it handles your address and keeps its own delivery log — the same processor the app already uses for sign-in codes, named in §7. Every message we send about the app carries a one-click unsubscribe link, and one click clears your address from both this list and the waitlist, because they are two labels on one mechanism. Writing to support@crosstype.app removes you just as well. The report email itself is not a mailing and carries no unsubscribe link: it is one message you asked for, and there is no list behind it.
9 · Age
App accounts are for adults: 18 and over, everywhere, no exceptions, and the database enforces it. Taking the test on this website needs no account and asks your age not at all.
10 · Changes
The date at the top of this page is the date its wording last changed. When the app’s data handling changes, this page is part of that change — the facts above are harvested from the app’s own source and database migrations, so a change there shows up here as a difference to be read rather than as something to remember.
Written against the app source and schema, not a template. If you find a claim on this page that you can disprove, write to support@crosstype.app and it will be corrected.