Privacy policy

What the crosstype app stores, why, and how to get rid of it. The free test on this website is a different thing with almost nothing to report — §2 covers it separately.

Last changed 28 October 2026.

1 · Who is responsible

crosstype is run by one person. The data controller is Sam Chiang, as an individual, in the United States. There is no company. Questions, corrections and deletion requests go to support@crosstype.app.

The app’s data is stored with Supabase in the United States, in Amazon’s data centers in northern Virginia. If you use crosstype from outside the United States, including the EU and the UK, your data is sent to and stored there.

2 · This website

You do not need an account to use this website and there is nothing here to sign into. The test runs entirely in your browser: your answers are scored on your own device, and anything you type into an open-response box never leaves the page you typed it on.

This site writes nothing to local storage and runs no tracking pixels and no advertising. Cloudflare, which hosts it, adds two things of its own to every page. Its bot protection runs a short check on each page and sets one cookie, cf_clearance, which stores the result, so that Cloudflare does not need to show you a challenge page. And Cloudflare Web Analytics counts visits: its script reports which page of this site you opened, the address of the page that sent you here, and how quickly the page loaded, and Cloudflare adds the country and the type of device, browser and operating system. That script sets no cookies and stores nothing in your browser, and Cloudflare shows us counts and averages, not a list of visits. No other company’s script runs on this site.

Three things are still true, and leaving them out would be the kind of overclaiming this site exists to avoid:

Cloudflare hosts the site and, like any web host, sees the ordinary details of each request — your IP address, your browser’s user agent, and which page you asked for.
Each page loads two typefaces from Google Fonts, so Google receives your IP address and user agent when a page loads.
Asking us to email you your report sends your answers. The report link contains them — that is what makes it work on any device with no account and nothing stored — and §5 explains how readable that code is. So when you use that form, your email address and that link go to our Cloudflare Worker, which passes both to Mailgun to send the message. Mailgun keeps a delivery log, and the message sits in your inbox afterwards. The Worker stores neither: it builds one email and forgets both. Nothing is sent unless you use that form, or the one under it that puts you on the email list in §8; taking the test and reading the result on this site sends nothing.

This site does not follow you across other sites, so it does nothing different when your browser sends a Do Not Track signal.

3 · What the app stores

All of it is stored against your account, so all of it is personal data about an identifiable person. This list is taken from the database’s own migration files — every table that holds something about you — rather than from a template of what an app like this usually collects.

what	where	notes
Email address	auth.users	The only contact detail. Used to send you sign-in codes and, if you set a password, to sign in with it and to send the codes that confirm or reset it — nothing else. If you sign in with Apple, it is the address Apple gives the app: your own, or a relay address that forwards to it if you chose to hide yours.
Sign in with Apple	auth.identities, apple_tokens	If you sign in with Apple: Apple’s identifier for you in this app, and a token Apple issues, which only our server can read. The token is kept so it can be revoked at Apple when you delete the account — §6. No name from Apple is stored.
Password	auth.users	Only if you set one. Our sign-in provider keeps it as a one-way hash, never the password itself, so no one can read it back. Once set it can be changed but not removed; it goes with the account.
Username, display name, bio, claimed type, chosen mouth	profiles	Visible to other signed-in adults, unless either of you has blocked the other. Bio is capped at 280 characters.
Adult confirmation	profiles.is_adult	A yes that you are 18 or older, set once when your profile is created — no birth date and no age. A profile cannot be created without it, and the app cannot change it afterwards. Where the app asks Apple for your age range (§9), the yes comes from Apple’s answer; everywhere else it comes from your tick. It goes with the account.
Your test answers	test_runs.answer_blob	Readable, one digit per question — see §5.
Your result	test_runs	The type, both models’ fit scores, the confidence band, and whether the two schools disagreed.
Messages	messages.body	Public rooms and direct messages alike, stored as plain text and readable by the operator. A reply points at what it quotes rather than copying it, and your first message in each room is marked `first here`.
Friends and requests	friendships, friend_request_events	Who asked whom, and when.
Blocks	blocks	Who blocked whom.
Block log	block_events	One row for each block between you and someone else, whichever of you made it: who blocked whom, when, and whether the one who blocked had an open report on the other at the time. Only the operator reads it, and only its counts reach the operator’s moderation alerts (§7). Unblocking does not remove it; it goes when either account is deleted.
Room membership	room_members	Which rooms you are in, when you last read each, and whether you muted it. Only you can read the read times. A muted direct-message thread sends you no notifications.
Reports you file or receive	reports	Your description, plus a snapshot of the reported message — or, for a reported profile, the username, display name and bio — as it stood. Survives deletion — §6.
Filter flags	message_flags	A copy of a message the word filter caught, and which listed words caught it. A caught message is held: nobody else in the app sees it until the operator has reviewed it, and the app does not mark it as held. The row records when the operator reviewed it and whether it was cleared or kept hidden from everyone but you for good. If it is edited after it is cleared and the edit is caught, or edited while held and still caught when the operator clears it, the edited version is kept as a new copy and held again. Edits to a message kept hidden are not copied. Survives deletion, detached from the account.
Edit log	message_edit_events	Timestamps only. It exists to enforce a rate limit, and holds no message text.
Slow-test answers	slow_test_answers	One row per answer: the question, the answer you gave, the answer your test run gave it, the two types it is choosing between, and the time. Readable only by you — see §5.
Question of the day	question_picks	Which side you picked each day, and when. The time never leaves the server. Once they have picked, other members who can see your profile may see your face, username and type on your side.
Directory listing	directory_listings	Whether you chose to be listed in crosstype pro’s directory. Off until you switch it on. No time is kept.
Username lookups that found nobody	profile_lookup_misses	The time of each lookup that found no one — not the name you typed. It exists to enforce a limit; rows older than a day are cleared at your next miss.
Daily-case calls	case_calls	The type you called for each day’s case, and when. Readable only by you; others see only that day’s two totals.
Calls	calls	Each type you called for a friend, and the result if they sent it back. Nothing names the friend. Readable only by you.
crosstype pro	pro_purchases, pro_periods	If you subscribe: the store’s transaction numbers, Apple’s or Google Play’s, the product, the dates of each paid period, whether it renews, and any refund. It also records whether it was a test purchase, any billing-grace date, when it was attached to your account, and the purchase token. Survives deletion, detached — §6.
Purchase token	pro_accounts	A random number given to the store, Apple or Google Play, with each purchase, so a payment can find your account. It is not your account id. Deleting your account removes it from the account; each purchase record keeps its own copy, detached — §6.
Store notices	pro_notifications	Each notice Apple or Google Play sent about a purchase: its kind, its date, which purchase, and what we did with it. Not its contents.
Founding number	founding_numbers, founding_holds	Your founding number, if you have one; anyone who can see your profile sees it. While the store’s payment sheet is open, a 15-minute hold on a seat. A number is never given to anyone else. One hold record is kept per account, with when it was taken, when it runs out, and how many holds you took in the day since your first one, to enforce a daily limit on holds. It is removed when you are given a founding number; otherwise, once the hold has run out and a day has passed since the first hold of that day, it is cleared the next time anyone holds a seat, and at the latest when the account is deleted.
Pair report	pair_reports	If you ask for one: which friend it is about, the two type codes at the time and the relation between them, which test run it was written from, the scored numbers your phone sent, the consent you gave and when, the report text once written — with the two style lines and their ratings printed beside their sections — and the model, prompt version and a hash of what was sent. Readable only by the account that asked for it, and by the operator like every row; the friend named in it cannot read it. Deleted with either account — §6.
Pair report about you	pair_reports	If a friend asks for one about the two of you: your type code is sent to Anthropic, and from the two type codes the app also sends your function stack, your romance and communication styles, the relation’s name and your seat in it, and the pair’s two ratings — §7. None of your answers are sent, and you are not asked for it or told about it. A row about you is stored, and you cannot read it. A block cancels one that is not yet written and returns the credit, and hides a written one from your friend while the block stands. An unfriend before it is written cancels it too; after it is written, the report stays readable by your friend. It goes when either of you deletes their account — §6.
Pair report payment	report_purchases, report_spends	If you buy one: the store’s transaction numbers, Apple’s or Google Play’s, the product, whether it was refunded, and which purchase funded the report. If a live paid year of crosstype pro includes it instead, the record says which year. Survives deletion, detached. A bought credit that was never spent is lost with the account; an unspent included report stays with its crosstype pro year — §6.
Push tokens	push_devices	If you allow notifications: each phone’s push token — the address Apple, or on Android Google, gives the app for that phone — whether it is an iPhone or an Android phone, and when it was registered and last seen. Readable only by you. Signing out removes that phone’s token; deleting the account removes them all.
Notification settings	push_settings	Whether friend-request and message notifications are on. Both are on until you turn one off.
Notification queue	push_outbox	One row per notification due: which kind, who it is for, who caused it, and for a message which thread and which message — never the message’s text — with whether it was sent or skipped, and why. Only the server reads it. Rows are removed after 30 days, and at once when either account is deleted.

The phone keeps a copy too: your test runs and your choices are stored on it under your account. Signing out leaves them there for when you sign back in; deleting the account clears them — §6.

The phone can also keep a mark that belongs to no account. If Apple’s answer says you are under 18 (§9), the mark says only that: no age, no range, no account. The app never sends it anywhere. While it is there, the 18+ tick is not offered on that phone. Signing out and deleting the account do not clear it; an answer of 18 or older from Apple on that phone, where Apple’s check runs, does, and so does deleting the app.

4 · Notifications, and what is not collected

No location. No contacts. No health data. No photos, audio, browsing history or search history. No advertising or attribution identifiers. No payment details: if you subscribe to crosstype pro, or buy a pair report, Apple or Google Play takes the payment and the app never sees your card.

That is checkable rather than promised. The app has no analytics, crash-reporting or attribution library among its dependencies at all — not one — and it asks for no tracking permission, so there is no tracking to disclose.

The one permission the app asks for itself is notifications. On an iPhone, if you save your card to Photos from the share sheet, the phone asks once for permission to add images to Photos. That permission is add-only: the app cannot see your photo library. Where Apple requires an age check (§9), the app also asks Apple for your age range when you tap Create my account. Apple answers that request itself, and you can decline to share it, but then your profile cannot be created.

Notifications. The daily line on your lock screen is scheduled on your phone by the app, and nothing about it reaches our server. If you allow notifications, the app also registers the phone for two kinds of push: a friend request, and a direct message. The phone’s push token is stored with your account (§3) so our server can send to it. A notification carries the sender’s username, a fixed line such as “sent you a message”, and which thread or list to open — never the message’s text, your type or your answers. A thread sends at most one until you open it, and none at all for a muted thread, between people where either has blocked the other, or for a kind you turned off in the app’s settings. None is sent for a message while the word filter is holding it (§3); if it is cleared before you have read past it, its notification can go out then, under the same rules. Public rooms never send one.

5 · The answers you gave the test

Your answers are stored with your account as a compact code: one digit per question, 86 of them for the full test. It is not encrypted and it is not anonymous. Anyone with access to the database can decode that code and read back the individual answers you gave.

This is stated bluntly because an earlier draft of the app’s own documentation called it an opaque encoding that was not item-level, and that was simply untrue. The code is ordinary base64; decoding it takes one command and no key.

What is also true, and worth as much: the scoring happens on your device rather than on a server. Nothing on the server reads that code unless you ask for a pair report — then, for that report, the server reads the one run it is written from and sends that run’s 82 closed answers to the model named in §7. The row is readable only by the account that owns it. Open-response free text is never uploaded at all. A test taken only on this website exists nowhere but your browser.

A run taken in the app while you are signed in is stored with your account. A run taken while you are signed out stays only on the phone, and only the newest one is kept; if you then create an account or sign in from its result, that run is stored with the account.

The slow test stores its answers one row per question instead of as a code. The same is true of those rows: they are not encrypted and not anonymous, they are readable only by you, and nothing on the server reads them.

6 · Deleting your account

You can delete your account at any time from inside the app: Profile → Settings → DELETE ACCOUNT, then type delete to confirm. It happens immediately, it cannot be undone, and it is not a deactivation — the account is gone, not paused. If you have not finished setting up your profile, the same DELETE ACCOUNT is on that screen.

What goes:

your profile, username and claimed type
every test run on this account, and the answers stored with it
every run this account took on this phone
your friends, requests and blocks
every message you have posted — in rooms and in direct messages, for everyone, not just for you

What stays:

reports about you, and reports you filed — each keeps the reported message, or your username, display name and bio, as they stood at the time, with the account itself detached
sign-in records held by our authentication provider

The second list exists because a report has to outlive the account it is about. If deleting yourself also deleted every complaint about you, deleting yourself would be a way to erase the complaint.

“Detached” is not “anonymous.” A kept report still holds the message, or the username, display name and bio, as they stood when it was filed; what is removed is the link to your account. We would rather say that plainly than let the word “detached” do quiet work.

Two more records stay, and neither names you: each notice the store sent about a purchase, and a founding number, which stays with its purchase.

A direct-message thread goes whole: every thread you were in is deleted for both of you, the other person’s messages included — and if someone you have messaged deletes their account, your thread with them goes the same way.

If you signed in with Apple, deleting from inside the app first asks Apple to revoke the token it issued (§3). If Apple cannot be reached, the deletion still goes ahead, and our copy of the token is deleted with the account. Your push tokens, your notification settings and any notification still queued for you go with the account too.

Deleting the account does not cancel a crosstype pro subscription. A crosstype pro subscription keeps billing through Apple until you cancel it in Settings. A crosstype pro subscription bought on Android keeps billing through Google Play until you cancel it there. Our record of each payment stays, detached from the account, so the subscription can attach to the next crosstype account signed in with the same Apple ID.

A founding number belongs to the purchase that earned it, not to the account. If you delete your account, the number stays with that purchase, and it comes back if the subscription is attached to another crosstype account. Only a refund retires it, and a retired number is never given to anyone else.

A pair report is deleted when either account it names is deleted: the reports you asked for go with your account, and a report about you goes when you delete yours. The record of what funded it stays. A credit that was already spent is not returned, and a bought credit that was never spent is lost with the account; an included report that was never used stays with its paid year of crosstype pro and re-attaches with that subscription.

If you have already uninstalled the app, email support@crosstype.app from the address on the account and it will be done within 7 days. /delete-account has the same instructions on one page.

7 · Who else handles this data

Supabase — the database, sign-in, and realtime messaging. Everything in §3 sits there.
Mailgun — sends the app’s sign-in codes and password codes and, on this website, your report email and any email from the list in §8. So it handles your email address, and its delivery logs include the address it delivered to and the message it delivered — which, for a report email, contains the link and therefore your answers. See §2 and §5.
Anthropic — writes a pair report, if you ask for one. It receives your type, your friend’s type, both function stacks and the relation between the two types, and the items the app derives from those two type codes: the relation’s own name and the friend’s seat in it, each side’s romance and communication style, and this pair’s rating on each. It also receives the scored numbers behind your result and your 82 closed answers, each with the published question it answers and the item’s published marking; a forced-choice item brings both of its options, each with its own marking. It receives no name, username, email or account id, none of your friend’s answers, and none of the written answers you type. Before anything is sent, the app asks you to tick a box naming Anthropic for that one report, and you can leave it unticked.
Apple — if you subscribe to crosstype pro, or buy a pair report, Apple takes the payment and holds your Apple ID, your payment method and your billing history; we never see them. Apple sends our server a signed notice when a purchase changes — a renewal, a lapse, a refund — and the app sends it the purchase when you buy or restore. What we keep from those is in §3. If you sign in with Apple, Apple tells our server who you are in this app and gives it your email address, or a relay address; the token it issues is kept so it can be revoked (§6). Apple’s push service delivers the app’s notifications to an iPhone: it receives the phone’s push token, the sender’s username, the fixed line and which screen to open (§4).
Cloudflare — hosts this website and holds the email list described in §8.
Discord — where the operator receives moderation alerts. An alert says how many reports are waiting, how many have waited more than a day and how long the oldest has waited, and how many blocks were made since the last alert, every one of them counted, and how many of those were made by someone who had an open report on the person they blocked. Only numbers: no account ids, names, usernames, email addresses or message text.
Google — fonts on this website (§2), and, if you subscribe or buy a pair report on Android, Google Play takes the payment and holds your Google account’s payment details; we never see them. Google sends our server a notice when a purchase changes. On Android, Google’s Firebase Cloud Messaging delivers the app’s notifications, with the same four things Apple’s push service receives.

8 · The email list

If you give your email address on the home page, or under a test result, it goes on one list. It is kept with the time you last gave it, a note if you gave it under a result, and whether you ticked the box for app news and when — nothing about you beyond that: not your type, not your answers. It is held in Cloudflare Workers KV — the same infrastructure already running this site.

The list is used to tell you when the app is out. Under a result there is a second box, never ticked for you, asking for news about the app after that. Only if you tick it is your address used for more than the launch, and the launch email asks you to confirm that before anything else is sent.

If you asked only to hear when the app is out, your address is deleted once that email has gone. Every address is deleted twelve months after it was last given. Addresses confirmed through the app line of a report email are kept on the same terms as one that asked only for the launch.

Mailgun sends these messages, so it handles your address and keeps its own delivery log — the same processor the app already uses for sign-in codes, named in §7. Every message we send from this list carries a one-click unsubscribe link, and one click removes your address from it entirely. Writing to support@crosstype.app removes you just as well. Giving your address under a result again with the app news box unticked turns app news off; you stay on the list for the launch.

The report email is not a mailing and carries no unsubscribe link: it is one message you asked for, and sending it puts you on no list.

9 · Age

App accounts are for adults: 18 and over, everywhere, no exceptions. You confirm it when you set up your profile after you first sign in, with the 18+ tick or, where Apple requires an age check, through Apple (below), and the database refuses a profile without that confirmation. The app does not otherwise verify your age. Taking the test on this website needs no account and asks your age not at all.

On an iPhone with iOS 26.4 or later, where Apple tells the app that the law requires an age check, the app asks Apple for your age range when you tap Create my account, in place of the 18+ tick. The check happens on the phone: the app reads only whether the range starts at 18 or older, and not how Apple knows it. The range is never sent to our server and never stored; what reaches our server is the same yes the tick gives (§3). Everywhere else, and on Android, you confirm with the tick. If Apple cannot answer, no profile is created until you try again and it does.

If Apple’s answer is under 18, or you decline to share it, no profile is created. Your sign-in account already exists by then (§3: its email address and, if you signed in with Apple, what Apple gave us); it stays until you delete it, which you can do from that same screen (§6). After an under-18 answer, the phone keeps the mark described in §3.

10 · Changes

The date at the top of this page is the date its wording last changed. When the app’s data handling changes, this page is part of that change — the facts above are harvested from the app’s own source and database migrations, so a change there shows up here as a difference to be read rather than as something to remember.

Written against the app source and schema, not a template. If you find a claim on this page that you can disprove, write to support@crosstype.app and it will be corrected.