Privacy
Crossed Paths helps you notice travel overlaps with people you have agreed to connect with. You control whether those connections can also see your current country, optional city or upcoming trips.
Updated 15 October 2026. Questions: info@crossedpaths.world.
What we store
| Your profile name and photo | Visible only to people you have both agreed to connect with. |
|---|---|
| Your account identity | Your login email and authentication identifiers, managed privately through Supabase Auth. Never shown to connections. |
| Your optional WhatsApp number | A self-entered contact number, separate from account login. We do not verify ownership or WhatsApp availability. Only accepted, unblocked connections can obtain its WhatsApp destination. You can change or remove it in Settings. |
| Your current location | A single country value, overwritten each time it changes. If you turn on City tracking, we also store the current city in that same single row. We do not keep previous locations. |
| Trips you add | A country, optional city, and date range, only if you choose to add one. |
| Your connections | Who you have agreed to connect with, and the note about where you met. |
| Matches and preferences | Overlap countries and dates, accepted connections, blocks and your privacy/notification choices. |
| Notification devices | A push token and device information needed to send the notifications you enable. |
Signing in with Google, Apple or email
If you choose Google, Google shares your account identifier, email address and basic profile information, which may include your name and profile picture, with our authentication provider, Supabase. These details are used to authenticate your account and stored in private account records. Google profile information is not automatically copied into the profile shown to connections; you set that profile yourself. Crossed Paths does not request access to your Gmail messages, Google contacts, Drive files or calendar, and does not sell Google user data or use it for advertising.
Apple sign-in provides an account identifier and the email address Apple supplies, which can be a private relay address. Email sign-in sends a verification code through Resend. Your email is used for account access and is never shown to connections.
What we never store
- Your GPS coordinates. Your phone turns them into a country, and optionally a city, then discards them.
- A continuous history of where you have been. Match records retain the country and dates of an overlap.
- Your address book. We never ask for it.
- Anything at all from WhatsApp — not messages, contacts, or your profile.
What other people can see
By default, connections only learn about a match in the same country. You can explicitly grant individual accepted connections proactive access to both your current location and upcoming trips, and choose country or city detail for each of them. City tracking controls only collection of your live city; a city you deliberately add to a trip is shared only through that trip permission. No one can browse your location history. Your phone number is not exposed in profiles or general APIs; it is provided only as a destination in an authorized WhatsApp handoff. Appearing hidden or blocking someone revokes proactive access immediately; blocks also cannot be bypassed with a new invite.
Notifications
Match notifications come from Crossed Paths through Expo and the device platform's push service, never through WhatsApp. Notification text can contain a connection's name and an overlap country, and your phone may show it on the lock screen.
Crash reports
If the app hits an error, it sends us a short technical report: the error message, the screen it happened on, the app and operating-system version, and whether the app closed. Reports are not linked to your account, and the app removes locations, phone numbers, email addresses and invite links before sending. We keep them for 90 days to fix bugs.
Service providers and third-party apps
Supabase operates our account authentication and database, Resend delivers verification emails, and Expo and device-platform services deliver push notifications. They process the information needed for those functions. Our website is hosted by Netlify. Choosing to open WhatsApp hands control to WhatsApp; we cannot see the conversation. Your operating system's own location services are separate from Crossed Paths.
Deleting your account
Settings › Delete my account removes your profile, your phone number, your current country, your trips, your connections, your matches, notification devices and account authentication record from the active service. It cannot be undone, and it also removes the matches other people held with you. Service providers may retain operational logs or backups under their own retention policies.