Privacy Policy
This Privacy Policy (the “Policy”) describes how Cross Button (the “Service Provider”) handles your information in the applications it develops and provides (individually and collectively, the “Application”).
1. Scope and Covered Applications
1.1 Scope: This Policy applies only to the Applications provided by the Service Provider. For how third-party services handle information, please refer to their own privacy policies, listed in Sections 3 and 4.
1.2 Covered Applications: The Applications covered by this Policy, and how information is handled in each, are as follows:
1.3 Additional Applications: If the Service Provider releases a new Application, it will be added to the list above. If an Application handles information substantially differently, a separate privacy policy may be published for it.
2. Information Stored on Your Device
2.1 Stored Information: The content you enter into the Application is stored in a database on your device.
2.2 No External Transmission: The Service Provider does not transmit this information to any server and does not collect it. The Service Provider cannot access it.
2.3 Deletion: Because this information exists only on your device, it is deleted in its entirety when you uninstall the Application.
3. Information Sent Externally
The Service Provider does not use analytics tools in the Application and does not itself collect your usage activity, browsing history, or location. The information sent externally when you use the Application is as follows. Information relating to in-app purchases is described in Section 4.
3.1 Advertising: The Application displays advertisements using Google AdMob, an advertising service provided by Google as a third-party provider. In connection with the delivery of advertisements, Google may collect:
- your IP address;
- device information such as device type and operating system;
- advertising identifiers and other identifiers; and
- information about the display of and interaction with advertisements.
3.2 App Updates: The Application checks for updates using the distribution infrastructure provided by Expo. In connection with these checks, your IP address and device and application version information are sent to Expo.
3.3 Approximate Region: The recipients of the information described in the preceding two subsections may infer your approximate region from your IP address. The Service Provider does not collect precise location data such as GPS coordinates.
3.4 Tracking: The Application does not request iOS App Tracking Transparency permission and does not collect the advertising identifier (IDFA).
3.5 Advertising Personalization: Where required by applicable law, the Service Provider delivers personalized advertising only after obtaining your consent. To stop all transmission of information by the Application, uninstall it.
3.6 Third-Party Privacy Policies: Each recipient described in this Section handles information under its own privacy policy. For details, please refer to:
4. Information Collected Through In-App Purchases
4.1 Application of This Section: This Section applies to those Applications that offer in-app purchases (purchases of paid features). The Applications concerned are identified in the list in Section 1.
4.2 Information Collected: If you make a purchase, the Service Provider collects the following information in order to manage and restore your purchase:
- a user identifier assigned to you by the Application or RevenueCat that does not contain your name or a similar direct identifier (the App User ID);
- technical information such as device type, operating system, application version, IP address, and last active time;
- App Store receipt data and purchase and transaction identifiers; and
- the item purchased, the date and time of purchase, and the status of the purchase (for example, active or refunded).
4.3 Payment Information: Payment details such as credit card numbers are processed by Apple. The Service Provider neither collects nor retains them.
4.4 Use of a Purchase Management Provider: The Service Provider uses RevenueCat, Inc. (“RevenueCat”) to validate receipts, manage purchase status, and restore purchases. RevenueCat acts as a contractor processing the information described in Section 4.2 on behalf of the Service Provider, and stores that information on servers located in the United States. This constitutes entrustment as described in Section 7 and does not constitute provision to a third party.
4.5 Retention: The information described in this Section is retained for as long as necessary to provide the purchased feature and for any period required by law.
4.6 RevenueCat Privacy Information: For general information about how RevenueCat handles information in its services, please refer to the RevenueCat Privacy Policy.
5. Information Collected Through Inquiries
5.1 Information Collected: If you contact the Service Provider at the address in Section 14, the Service Provider collects your email address, the content of your inquiry, and any information you choose to provide.
5.2 Voluntary Provision: Providing this information is voluntary. However, without an email address the Service Provider may be unable to respond.
5.3 Retention: The information described above is stored in the email service used by the Service Provider. The Service Provider deletes it once your inquiry has been resolved and retention is no longer necessary.
6. Purposes of Use
The Service Provider and third-party advertising providers use the information described in this Policy for the following purposes:
- providing and maintaining the operation of the Application;
- delivering updates to the Application;
- delivering, optimizing, and measuring advertisements, and preventing fraud;
- managing and restoring in-app purchases and preventing their misuse;
- responding to inquiries and investigating and fixing defects in the Application; and
- complying with legal obligations.
7. Provision to Third Parties
7.1 General Rule: The Service Provider does not provide personal data to third parties without your prior consent.
7.2 Exceptions: Notwithstanding the preceding paragraph, the Service Provider may provide personal data without your consent where permitted by the Act on the Protection of Personal Information or other laws, specifically:
- where required by law;
- where necessary to protect the life, body, or property of a person and it is difficult to obtain your consent; or
- where it is necessary to cooperate with a national or local government body, or a party entrusted by one, in performing duties prescribed by law, and obtaining your consent would impede the performance of those duties.
7.3 Cases Not Constituting Provision to a Third Party: The following do not constitute provision to a third party:
- entrusting all or part of the handling of personal data to a contractor, within the scope necessary to achieve the purposes of use; and
- provision of personal data in connection with a business succession, including a merger.
8. Requests for Disclosure and Related Rights
8.1 Available Requests: You may request notification of the purpose of use, disclosure, correction, addition, or deletion of content, suspension of use, erasure, or suspension of provision to third parties, with respect to personal data held by the Service Provider.
8.2 How to Make a Request: Please submit such requests by email to the address in Section 14. The Service Provider will respond without delay in accordance with applicable law, after verifying your identity.
8.3 Fees: No fee is charged for a request for notification of the purpose of use or for disclosure.
8.4 Information on Your Device: The information described in Section 2 exists only on your device and is not held by the Service Provider. Because it is erased entirely when you delete the Application, it is not subject to the requests under this Section.
9. Children’s Privacy
9.1 Age: The Application is not directed to children under the age of 13. The Service Provider does not knowingly collect personal information from children under 13, and does not market to them.
9.2 Deletion: If the Service Provider learns that a child under 13 has provided personal information, it will delete that information immediately. If you are a parent or guardian and you are aware that your child has provided personal information, please use the contact address in Section 14.
10. Security Measures
10.1 Data Minimization: The Service Provider designs the Application so that the content you enter is stored only on your device, and does not hold that content on any server. The personal data the Service Provider handles on servers is the in-app purchase information described in Section 4 and the inquiry information described in Section 5. Keeping the information it collects to the minimum necessary is the Service Provider’s basic approach to security.
10.2 Other Measures: Details of the other security measures taken by the Service Provider will be provided upon request to the contact address in Section 14.
11. Users in the United Kingdom and the EU (UK GDPR / GDPR)
This Section applies to users residing in the United Kingdom or the European Economic Area (EEA) and describes how information is handled under the UK General Data Protection Regulation (UK GDPR) and the EU General Data Protection Regulation (GDPR).
11.1 Controller: The Service Provider is the controller of the personal data described in this Policy. Contact details are set out in Section 14.
11.2 Legal Bases for Processing: The Service Provider processes personal data on the following legal bases:
- performance of a contract: providing and restoring purchased features (Section 4);
- legitimate interests: maintaining the operation of the Application, preventing misuse, investigating and fixing defects, and responding to inquiries;
- consent: advertising personalization after consent has been obtained; and
- compliance with legal obligations.
11.3 Your Rights: You have the right to access, rectify, and erase your personal data, to restrict processing, to data portability, and to object to processing. Where processing is based on consent, you may withdraw your consent at any time (this does not affect the lawfulness of processing carried out before the withdrawal). To exercise these rights, please use the contact address in Section 14.
11.4 International Transfers: The information described in Sections 3 and 4 may be processed in the United States or other countries by Google, Expo, and RevenueCat. These transfers use mechanisms adopted by the relevant provider under applicable law, such as the Data Privacy Framework, standard contractual clauses, and the UK Addendum.
11.5 Retention: The information described in Section 3 is retained by the relevant provider for as long as necessary for service delivery, fraud prevention, and the other purposes described in that provider’s privacy policy. Retention periods for the information described in Sections 4 and 5 are set out in those Sections.
11.6 Complaints to a Supervisory Authority: You have the right to lodge a complaint with a supervisory authority, such as the UK Information Commissioner’s Office (ICO) or the authority in your country of residence. You may do so directly, whether or not you have contacted the Service Provider.
12. California Residents (CCPA / CPRA)
This Section provides supplemental disclosures for residents of the State of California, informed by the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).
The categories and sources of personal information collected are described in Sections 3 through 5, the purposes of use in Section 6, the recipients in Sections 3, 4, and 7, and the retention periods in Sections 4, 5, and 11.5. The Service Provider does not knowingly collect sensitive personal information or use it to infer characteristics about you.
12.1 Your Rights and How to Exercise Them: You have the right to know about, delete, and correct the personal information collected about you. To exercise these rights, please email the contact address in Section 14. The Service Provider will respond after verifying your identity and will not discriminate against you for exercising your rights.
12.2 “Sale” and “Sharing” of Personal Information: The Service Provider does not “sell” your personal information in exchange for money or other valuable consideration. Personalized advertising delivered through Google AdMob may constitute “sharing” (disclosure of personal information for cross-context behavioral advertising) as defined by the CCPA/CPRA.
12.3 Opt-Out: Before beginning any processing that constitutes “sharing” as described above, the Service Provider will provide an opt-out mechanism within the Application and update this Policy. Until then, the Service Provider does not engage in such processing.
13. Changes to This Policy and Language
13.1 Changes and Notice: The Service Provider may update this Policy from time to time, and will notify you of any changes by posting the updated Policy on this page. If a change to the Application’s functionality changes how information is handled, the Service Provider will update this Policy in advance.
13.2 Continued Use: If you continue to use the Application after a change takes effect, you are deemed to have accepted the updated Policy.
13.3 Language: The Japanese version of this Policy is the authoritative version. Versions in English and other languages are provided for reference only, and the Japanese version prevails in the event of any discrepancy.
14. Contact Us
14.1 Contact Point: Questions about this Policy, the requests described in Section 8, and complaints regarding the handling of personal information are all received at hello@crossbutton.com.
14.2 Disclosure of Business Details: The Service Provider’s name and address will be provided without delay upon request to the contact address above.