Skip to content

DRAFT for the owner's review. Not legal advice. Not yet in force.

Owner must check: every [OWNER TO CONFIRM] item below, and get a solicitor to review before this goes live.

Crossmith Privacy Notice

Last updated: 20 October 2026

This notice explains what personal data Crossmith keeps, why, who else handles it, how long we keep it and what your rights are. It is written in plain English. You never need an account to use the editor, library and player: they work in your browser.

1. Who we are

Crossmith is run by PVT Digital Ltd, company number 17520180, registered office 20 Wenlock Road, London, N1 7GU, England and Wales. We are the controller of the personal data described here. Contact us for anything about your data at hello@crossmith.com.

Our sites are crossmith.com (the site and app), crossmith.app (short share links only) and crossmith.co.uk (which redirects to crossmith.com).

2. What we collect, why, and our lawful basis

  • Your account. Your email address, and your name and profile picture address if you use Continue with Google. We use them to sign you in and to run your account. Lawful basis: contract (providing the service you asked for).
  • Sign-in records. Each sign-in creates a session record that includes the IP address and browser details, and a short-lived emailed code. We use them to keep you signed in and to keep accounts secure. Lawful basis: contract, and legitimate interests (security).
  • Your work. Puzzles saved to your account (grids, answers, clues, explanations, private notes, titles, settings), templates, saved grids, settings, personal word scores, your spelling dictionary and your clue database. We use them for cloud saving and syncing between your devices. Lawful basis: contract.
  • Short links. A frozen copy of the puzzle as you shared it, the title and how many times it has been opened. Lawful basis: contract.
  • Public profile and published puzzles. Your handle, display name, bio, up to three links, and the series and puzzles you publish, including answers and explanations. We show them on the public site. Lawful basis: contract.
  • Likes, follows and difficulty ratings. If you are signed in, we record these against your account so that counts and follower lists work and so we can send follow alerts. Lawful basis: contract for follows and alerts; legitimate interests for counts.
  • Reports and moderation. If you report something, we keep the reason, your words and your account id, or, if you are signed out, a hashed version of your IP address (not the address itself). We also keep a log of moderation decisions. Lawful basis: legitimate interests (keeping the site safe and fair) and legal obligation (our duties as an online service, including under the Online Safety Act 2023).
  • Use of AI suggestions. We count the requests you make (kind, number of answers and time) to apply a monthly allowance and to stop misuse. Lawful basis: contract and legitimate interests.
  • Plan and payments. Your plan, your Stripe customer and subscription details, and the dates of payments and failed payments. We never see your card details. Lawful basis: contract, and legal obligation (accounting and tax records).
  • Daily grid-generation counts. Used for the free plan reminder. Lawful basis: contract.
  • Emails. Sign-in codes and follow alerts (see section 7), and records that they were sent. Lawful basis: contract for sign-in codes; follow alerts are sent because you chose to follow a setter, and you can switch them off at any time (see section 7).
  • Ordinary web requests. Our hosting provider sees each request: IP address, browser details and the page asked for. Lawful basis: legitimate interests (running and securing the site).
  • When you contact us. Your email address and what you tell us. Lawful basis: legitimate interests (answering you), or legal obligation where the law requires a reply.

Our own tables hold no names or email addresses: they refer to you by an account id. Your name and email address sit in the sign-in service.

3. Who else handles your data

We use these providers (processors) to run Crossmith. They handle data only on our instructions, except where they say otherwise in their own terms.

  • Vercel hosts the site. Our functions run in London. Vercel sees every request and keeps runtime logs.
  • Neon runs our database (in London) and Neon Auth, the sign-in service.
  • Resend sends our emails: sign-in codes and follow alerts.
  • Stripe takes payments. Stripe receives your email address and account id, and card details you type on Stripe's own page. Stripe keeps payment records for its own legal and tax duties, even after you delete your account.
  • Anthropic provides AI suggestions. Only when you ask for a suggestion, we send it the answers, your instructions (up to 300 characters), the theme description and earlier suggestions. We do not send your account id or email address.
  • Google handles Continue with Google. It tells our sign-in service your name, email address and picture address.

We do not sell your personal data. We do not use advertising or analytics services.

We may also share data where the law requires it, for example with the police or a court, or to protect people from serious harm.

4. Transfers outside the UK

Vercel, Stripe, Anthropic, Google and Resend may process data outside the UK. Where they do, the transfer relies on the UK adequacy regulations, the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU standard contractual clauses, as the provider offers. [OWNER TO CONFIRM the exact mechanism for each provider.]

5. How long we keep things

  • Deleted puzzles, items and clues. When you delete one, it is marked deleted. Thirty days later a daily clean-up empties its content (title, grid, clues, answers, thumbnail). The id and dates stay, so your other devices learn it was deleted. [OWNER TO CONFIRM how long these markers stay.]
  • Short links. You can turn a link off, which keeps the copy, or delete it outright, which removes it and its copy at once.
  • Pages a moderator removed. You cannot delete a page that a moderator removed or is holding. We keep its content for the moderation log until your account is deleted. You can ask for a review.
  • Your account. If you delete your account (Account, then Delete account), we delete your puzzles, templates, clues, short links, profile, series and published puzzles, likes, follows, ratings, billing records and sign-in record. We keep the moderation log, and the reports about your content, as set out below. Stripe keeps its payment records, and Neon's short history window (below) still holds older copies for a time.
  • Reports and their details. [OWNER TO CONFIRM: recommended 12 months.] The hashed IP address on a signed-out report: [OWNER TO CONFIRM: recommended 30 days.]
  • Moderation log. [OWNER TO CONFIRM: recommended 2 years, including after an account is deleted.]
  • AI request records. [OWNER TO CONFIRM: recommended 13 months.]
  • Email send records. [OWNER TO CONFIRM how long.]
  • Neon's history. Neon keeps a point-in-time history of the whole database for a short window (6 hours on our current plan), so data we have deleted can still be restored from it for that long. [OWNER TO CONFIRM the window for the production project.]
  • Logs at our host. Vercel keeps runtime logs for the period set by its plan. We log errors and counts, not your puzzles.

6. Public content

Puzzles you publish, your handle, display name, bio and links are public. Anyone can see them, and search engines may index them and keep copies we cannot recall. Unlisted puzzles are not listed and ask search engines not to index them, but anyone with the link can open them. Please do not put anything private in a public or unlisted puzzle.

Solvers' progress (letters, marks and time) stays in their browser. We do not receive it.

7. Email

We send two kinds of email:

  • Sign-in codes. When you sign in with email, Neon Auth sends you a code (through Resend).
  • Follow alerts. If you follow a setter, we email you when they publish a puzzle, at most one email per setter per day. Every alert has a one-click unsubscribe link. You can also change this in Account, then Email.

We send no marketing email.

8. Cookies and local storage

We use only the cookies needed to run the site: the sign-in session cookies set by our sign-in service. They are first-party, and they keep you signed in. We use no analytics, advertising or third-party cookies, and our fonts are served by us. Because we use only these essential cookies, we do not show a cookie banner.

The site also uses your browser's local storage (including IndexedDB) to save your puzzles, settings and progress on your device. It stays on your device and is not sent to us, unless you sign in and sync. When you sign out, we ask whether to keep a copy of your puzzles, templates and clues on that device (the default is No). If you use a shared computer, answer No. You can also clear this data any time in your browser settings.

9. Your rights

Under UK data protection law you can ask us to:

  • tell you what we hold about you and give you a copy (access);
  • correct anything wrong (rectification);
  • delete your data (erasure);
  • limit how we use it (restriction);
  • give you your data in a usable form (portability);
  • stop using it for our legitimate interests (objection); and
  • stop anything based on your consent, which you can withdraw at any time.

To use these rights: use Account, then Delete account to erase your account; use Back up all on the Puzzles page to download your work; or email hello@crossmith.com. We reply within one month. We may ask you to prove who you are. Some rights have limits, for example where we must keep a record to meet a legal duty.

10. Children

Crossmith is not aimed at children. You must be at least [OWNER TO CONFIRM minimum age] to create an account. If you think a child has given us personal data, email hello@crossmith.com and we will deal with it.

11. Complaints

If you are unhappy with how we handle your data, please tell us first at hello@crossmith.com. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

12. Changes to this notice

We may change this notice. We will update the date at the top, and for important changes we will tell you on the site or by email. See also our Terms of Use and Moderation and Complaints Policy.