CrossBorders

Privacy Policy

Last updated: September 7, 2026DE·EN

1. Controller

Alexander Burkhard, Münsterlandstraße 68, 10317 Berlin, Germany. Email: [email protected].

No data protection officer is appointed (not legally required, § 38 BDSG).

2. What we process

  • Questionnaire answers: your preferences (e.g. climate, cost, pace, priorities), country of origin, citizenships, income details (range / portable income), spoken languages, household details and moving timeline. In the final web quiz step, you declare a destination country and move intent or explicitly choose that you have no country in mind yet. This destination and move intent do not affect your ranking. We use them to show relevant guidance and the relocation-help invitation on your results page; this alone does not create a request or share data with a provider. Voluntary city shortlists submitted in earlier quiz versions remain recorded as such and are not reinterpreted as new country intent. You do not need to give your name to get a result.
  • Result snapshots: the computed, immutable ranking that powers your shareable results page.
  • Shared result links. A share link exists only if you create one from your results page. You choose what it shows: the default link contains your city ranking and general fit notes only; the "everything" link additionally shows what your results page shows, including household, origin and priorities. Share links use unguessable addresses, are excluded from search engines, and can be revoked by you at any time from the same page — after revoking, the page is no longer available, but previews already posted in chats may persist as images. Share links are deleted when you delete your data.
  • If you pair your results with a partner using a combine code, we compute and store a combined analysis derived from both profiles. Each partner can delete their own results or the combined analysis at any time; deleting either person's results also deletes the combined analysis.
  • A combine code is single-use and expires after 72 hours. Anyone you give it to can pair with you and, after unlocking, see how your results compare — including which of your preferences rule cities out.
  • Anyone holding a combined-results link can view it (preview, or in full once unlocked).
  • Values preference: the question “How important is a secular / liberal public culture?” captures a preference about the destination, not your own beliefs. We use the answer only to compute city fit, never for advertising or profiling.
  • Payment and entitlement data: for a web purchase we store the checkout email address, order and payment references, product, order amount recorded in EUR, payment/refund status, the timestamp of immediate-delivery consent, and links to the result or combined analysis, offer context and random browser access identifier. These let us deliver the purchase, preserve access and personal retakes, and restore access using a link emailed on request. We store restore tokens with their expiry and use status. For an app purchase, RevenueCat processes the Apple or Google purchase state under an anonymous purchase identifier. The payment provider also processes the checkout currency and payment details; we do not store card or bank account details.
  • Purchase confirmations: for new web purchases we store the prepared confirmation with checkout email, actual charged amount and currency, purchase reference, result link, recorded consent and applicable Terms version, plus submission status and the email provider message identifier. This keeps retry content unchanged; a sending failure does not remove paid access.
  • Feedback: your answers in the feedback section, if you submit it.
  • Newsletter sign-up, only where offered and separately chosen: your email address plus the time and confirmation of the sign-up (double opt-in), so we can evidence the consent. If you sign up from a results page or the Android app, we link the sign-up to the relevant entitlement record. This is a consent and unlock record, not a CrossBorders account or login. A purchase or restore request does not subscribe you to the newsletter and does not require newsletter double opt-in; any existing newsletter consent remains separate.
  • Server logs: IP address, timestamp, user agent and technical error information.
  • Advertising measurement (only on visits that come from one of our own ads): a first-party context identifier, any advertising click identifier contained in the link, your approximate country and any Global Privacy Control signal. For a resulting sign-up, submitted relocation-help request or purchase, we send Reddit a SHA-256-hashed email address. Consultation conversions include only the event and matching identifiers, not your destination, citizenship, phone number or quiz profile. The hash is pseudonymised personal data, not an anonymous identifier. We do not send the request IP address through our Conversions API implementation. We use this solely to measure whether our advertising works (see sections 3, 6, 7 and 8). Organic visits are not tracked for advertising.
  • If the relocation-help pilot is offered and you expressly submit a request, results visitors and verified subscriber-email visitors may see safe existing declared data prefilled from their eligible context; direct visitors start with empty fields. The subscriber-email landing link carries short-lived HttpOnly, SameSite=Lax context cookies scoped to /relocation and /api/relocation; the landing URL contains no email, subscriber, unsubscribe or snapshot identifiers. All fields remain editable, and the declaration submitted with the request is authoritative. Request consent is separate from newsletter consent. We process your declared destination and planning context, your selected stage in the relocation process, selected services, email, optional phone, consent record and operational status to handle that specific request. CrossBorders contacts you first. We share these details with a named provider only after you give separate confirmation for that specific introduction. You may withdraw consent and request erasure at any time. CrossBorders retains the pilot request for at most 90 days; after an authorized introduction, the provider's own retention applies. For product measurement, PostHog receives the selected destination country and planning intent from the website quiz, plus campaign, destination, planning intent, journey stage and selected help categories when a request is submitted. This excludes contact details: not email, phone, citizenship, the full quiz profile or a request identifier.
  • Subscriber relocation handoff cookies: the signed opaque value is carried in short-lived HttpOnly cookies scoped to /relocation and /api/relocation so the existing request form can be checked server-side; neither cookie contains an email, subscriber, unsubscribe or snapshot identifier.
  • Relocation-help contact attempts and campaign slots: the pilot's minimal email-linked contact and send history is kept for no more than 90 days and then deleted. The one-time campaign contact marker remains under the subscriber consent and unsubscribe record's retention rule so the same campaign cannot be sent again; erasing the subscriber also erases that marker.
  • No data sale: we do not sell your personal data.

3. Purposes and legal bases

  • Providing the ranking, purchase fulfilment, access and personal retakes, requested restoration and related transactional emails: Art. 6(1)(b) GDPR (contract / pre-contractual measure).
  • Product analytics via PostHog on the website (cookieless: no device storage, server-side daily-rotating hash) and in iOS and Android (forwarded server-side, identifier valid for one app session only): Art. 6(1)(f) GDPR (legitimate interest in improving the service). As no device storage is accessed for this purpose, § 25 TDDDG does not apply.
  • Sending the CrossBorders newsletter where separately offered and chosen (such as the Android unlock or an earlier web signup): Art. 6(1)(a) GDPR (consent, confirmed by double opt-in). The consent also covers selecting which newsletter content we send you based on your questionnaire answers and your result ("matched to your results"); the values-question answer (see section 2) is never used for this. The current web offer optionally lets you unlock the full city ranking free with a verified newsletter email. You can withdraw at any time with future effect (unsubscribe link in every email); an unlock you already have stays.
  • Handling an expressly submitted relocation-help request in the offered pilot, including CrossBorders’ first contact: Art. 6(1)(a) GDPR (consent). You may withdraw that consent at any time with future effect. We share the request with a named provider only after your separate confirmation for that specific introduction.
  • Advertising measurement via the Reddit pixel and Reddit Conversions API, only on visits that come from one of our ads: in the EU, EEA, UK and Switzerland on the basis of your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG), which we obtain through the banner shown on ad-led visits before any advertising cookie or identifier is set; everywhere else on the basis of our legitimate interest in measuring our advertising (Art. 6(1)(f) GDPR), where we honour a Global Privacy Control signal as an objection. Reddit acts as an independent controller for the data it receives, not as our processor. You can withdraw your consent or object at any time with future effect via "Ad preferences" (in the footer or the consent banner); an unlock you already have stays.
  • Stability, error analysis, abuse prevention and product improvement: Art. 6(1)(f) GDPR (legitimate interest).
  • Retention of payment and invoice records: Art. 6(1)(c) GDPR (commercial and tax-law obligations).

4. Pricing

On the website, CrossBorders Pro costs €1.99 once, including applicable VAT. There is no subscription. The preview withholds #1, shows #2–#4 readably and #5–#10 as teasers; a verified newsletter email unlocks the full city ranking free. Pro adds Life Scenarios, region filters, category radars, full fit explanations, the full Partner Combine ranking and unlimited personal web retakes. It does not include a separate generated report or promise future products.

The earlier web offer with ranks #4 onward free cost €4.99 once. The earlier paid Full Unlock web offer cost €5.99 once. These historical prices do not describe the current web offer.

Under the previously displayed newsletter offer, CrossBorders Pro cost €2.99; the city ranking could be unlocked free with a verified newsletter email. A separate combined-results unlock cost €2.99 in that offer. This historical offer remains effective for already issued unlock promises and access already earned; no second purchase is required for access you already have. New purchases are governed by the offer displayed at checkout; a purchase does not include newsletter sign-up or double opt-in.

In the iOS app, the unlock costs €3.99 as a one-time purchase through Apple. On Android, it is free with a verified newsletter email or available as a one-time Google Play purchase at the €1.99 German base price. These are separate store offers, not a change to native billing or a promise of cross-store restoration. Where offered, the separate in-depth relocation report costs €19 and also unlocks the full list. Prices are not personalized. In other countries and currencies, the local total displayed by the relevant checkout or store, including applicable taxes, applies.

In the paid web offer, shared results are included when at least one partner has qualifying Pro access. This does not give the other partner a separate personal Pro entitlement. Previously purchased combined results remain accessible under their purchase terms.

5. Recipients and service providers

The exact legal role varies: Supabase, Resend, PostHog and Sentry are used as processors where applicable; Reddit is an independent controller; Stripe is the merchant of record under the active Managed Payments arrangement.

  • Supabase Inc. (USA, Daten gespeichert in der EU / data stored in the EU): PostgreSQL database for result snapshots, orders, feedback, purchase entitlements and restore tokens, newsletter consent records, mobile entitlement records and, where the pilot is offered, the relocation-help request ledger.
  • Stripe Payments Europe, Ltd. (Irland / Ireland): Stripe Managed Payments processes web purchases, with Link shown as merchant of record in Checkout. The checkout identifies the seller and applicable transaction terms. Stripe/Link handles payment, receipts, refunds and applicable taxes; we receive purchase status and checkout contact details to provide access. We do not receive full card details.
  • PostHog (EU-Instanz / EU instance, eu.posthog.com) (EU): Cookieless product analytics: no cookies, no device storage; visitor counting via a server-side hash that changes daily (the IP address is processed only transiently for this and is not stored). Website events include an approximate country that our CDN (Cloudflare) derives from your IP at the edge; PostHog does not store the IP address itself. Mobile events from the iOS and Android apps do not include a country. They are forwarded by our server only: the apps themselves never connect to PostHog, and carry an identifier valid for a single app session.
  • Functional Software, Inc. (Sentry) (USA): Error detection and analysis to keep the service stable (website, iOS and Android apps).
  • RevenueCat, Inc. (USA): Purchase and entitlement management for the iOS and Android apps: processes Apple App Store and Google Play purchases under an anonymous purchase identifier and confirms unlock status. Payment data stays with Apple or Google.
  • Expo (650 Industries, Inc.) (USA): Delivery of app updates for the iOS and Android apps (EAS Update): when an app checks for updates, Expo sees the IP address and technical app/update metadata.
  • Resend (USA): Delivery of result-access, purchase-confirmation and requested restore emails, plus internal operational notifications about submitted requests. Separately, where the newsletter is offered and chosen, delivery of newsletter messages and confirmation emails (double opt-in). Stripe/Link sends its own payment receipts.
  • Discord (USA): Internal operational notifications about service activity and submitted requests.
  • Google Cloud (Cloud Run) (USA, Hosting in Frankfurt / hosting in Frankfurt): Application hosting.
  • Cloudflare, Inc. (USA): DNS, CDN and abuse protection; sees visitors’ IP addresses in the process.
  • Google (Gemini Developer API / Google AI Studio) (USA / EU): AI generation of the personalized prose in the paid €19 report. Only the non-directly-identifying profile/result data needed for this is processed; on the paid API tier, inputs are not used to train the models (Google Cloud Data Processing Addendum).

6. Third-country transfers

Where providers process data in the USA, this is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) or certification under the EU-US Data Privacy Framework.

For advertising measurement (section 3), conversion data is transmitted to Reddit (Reddit Netherlands B.V., Amsterdam, and Reddit, Inc., USA). Reddit is an independent controller for this data and processes it under its own privacy policy, not as our processor; the transfer to the USA relies on the same EU Standard Contractual Clauses or EU-US Data Privacy Framework basis.

7. Retention

  • Result snapshots and raw feedback: A locked web result is deleted when the access opportunity in its final reminder expires without confirmation. If there is no recorded unlock attempt, we delete the locked web result after 96 hours. Web results with a started but unfinished unlock, server-side native app results, and other unpaid results are deleted after no more than 30 days. Associated raw feedback is deleted with the result. These deletion periods apply only where no purchase, earned-access or valid issued-credential protection exists. A snapshot linked to a paid web order and personal retakes covered by paid owner access are kept while that access exists and we operate the service, without the newsletter run limit. Newsletter-based owner access protects the first 10 linked runs; original results referenced by a confirmed subscriber or an already-earned mobile unlock also remain protected. A still-valid issued confirmation protects its original result until redemption or expiry. Results belonging to a purchased combined analysis, or one covered by a partner’s paid access, are also retained while that protection exists. Your deletion rights are unaffected.
  • Anonymous aggregate statistics (counts only, no personal data): kept indefinitely, as they contain no personal data.
  • Newsletter sign-up: Pending newsletter confirmation attempts that have never been verified are automatically deleted after 30 days, together with associated pending confirmation links and mobile claims. Confirmed subscriptions are kept until consent is withdrawn; the minimum unsubscribe record is then retained so we do not contact that address again.
  • Relocation-help contact attempts and campaign slots: the pilot's minimal email-linked contact and send history is kept for no more than 90 days and then deleted. The one-time campaign contact marker remains under the subscriber consent and unsubscribe record's retention rule so the same campaign cannot be sent again; erasing the subscriber also erases that marker.
  • Advertising-measurement data (the first-party context identifier, any advertising click identifier, and the consent record): kept only for the advertising attribution window (up to 90 days) and then deleted; delivered conversion records are pruned after a short retention period. Reddit stores the data it receives under its own retention policy.
  • Payment and invoice records: per statutory retention periods (up to 10 years, § 147 AO).
  • The saved purchase-confirmation copy stays associated with the order record. On confirmed data erasure we remove its recipient, content and result links; a minimal cancellation record tied to the order reference prevents repeat payment events from resending it.
  • Server logs: typically 30 days.
  • Error reports (Sentry): typically 30 days.

8. Cookies and local storage

Recommendations may be organic or affiliate recommendations. Organic recommendations are ordinary links for which we do not receive a commission; affiliate links are marked as such and may result in a commission from the provider. Not every recommendation is paid. Clicking any recommendation takes you to the provider; from that click onward, the provider’s own privacy policy and cookie rules apply. We do not transmit your questionnaire answers, profile or ranking to the provider. Affiliate status and commercial terms never influence city scores, rankings or their order. CrossBorders does not provide tax, banking or insurance advice.

Technically necessary storage is kept in your browser’s local storage so your in-progress answers are not lost. Where the newsletter unlock prompt is offered, we remember there whether you have seen it. A necessary access cookie (__Host-cb_owner, or legacy cb_owner; up to one year, HttpOnly) holds a random identifier used to associate your quiz runs, purchase access and personal retakes with this browser. It is not an advertising identifier; use Restore purchase on another browser or after losing it. Only if you open a partner discount link or enter a discount code in the unlock dialog do we set a cookie (“cb_ref”, 30 days), used solely to apply that discount at checkout: without that action, this discount cookie is not set. Discounts apply only where the displayed offer permits them. Analytics (PostHog) is cookieless: it sets no cookies and uses no device storage; recognition uses a server-side hash that rotates daily and is pseudonymous rather than a direct identity. We additionally record an approximate country that our CDN (Cloudflare) derives from your IP at the edge; the IP address itself is not stored. Affiliate links to accommodation, connectivity and VPN, remote-work, moving, international money, insurance and, where offered, language-learning or tax-service providers are ordinary links. We do not transmit your profile or questionnaire answers to these providers. Only when you click do you leave CrossBorders and reach the provider; from then on, the provider can see the request and its own privacy policy and cookie rules apply. We embed no provider code on our pages and load no images from their servers: accommodation photos are fetched by us and served from our own domain, so nothing is stored on your device by them, and they do not see your IP address, while you are here.

One exception applies only if you arrive through one of our own ads: to measure whether that ad led to a sign-up, relocation-help request or purchase, we set a Reddit advertising cookie or identifier ("_rdt_uuid") and Reddit may set its own cookies. In the EU, EEA, UK and Switzerland this happens only after you agree via the consent banner; elsewhere it happens on the basis of our legitimate interest unless you have Global Privacy Control enabled. This is the only case in which an advertising cookie is set, it never happens on organic visits, and you can withdraw at any time via "Ad preferences". Reddit can see network data when its consented browser pixel loads. For a resulting sign-up, submitted relocation-help request or purchase, we send Reddit a SHA-256-hashed email address. Consultation conversions include only the event and matching identifiers, not your destination, citizenship, phone number or quiz profile. The hash is pseudonymised personal data, not an anonymous identifier. We do not send the request IP address through our Conversions API implementation.

9. Mobile apps (CrossBorders for iOS and Android)

  • No account: the apps work without a CrossBorders registration or name. An email address is needed only if you voluntarily choose the newsletter unlock on Android. A confirmed newsletter email is a consent and unlock record, not a login account. Unsubscribing stops future newsletter messages but does not remove ranking access you already earned.
  • Questionnaire and results: your answers are sent to our server (crossborders.io) to compute your ranking, as described above. Saved runs (“Past runs”) live only on your device and can be deleted in Settings at any time (“Delete all local runs”). Server-side result snapshots created from the app are automatically deleted after 30 days; results that are part of a purchased combined analysis are kept while that purchase is active. Your deletion rights are unaffected.
  • In-app purchases: on iOS the unlock is a one-time €3.99 purchase through the Apple App Store; Apple is the seller and payment processor. The Android app is only distributed in countries/regions where Google is the merchant of record under the then-current Google Play terms. Its one-time purchase at the local price shown (German base price €1.99) uses Google Play Billing only; the Android app does not offer alternative billing or user-choice billing. Google processes the purchase and issues the receipt there. We never receive payment details. RevenueCat manages both purchase states under an anonymous purchase identifier and confirms the entitlement status.
  • Local credentials: our server verifies the purchase or confirmed newsletter unlock. iOS stores a device-scoped access token in the device keychain. Android stores the access token, a random installation credential, and any pending email-confirmation claim in Android secure storage (SecureStore).
  • Crash reports: on app errors, technical crash data is sent to Sentry (see recipient list); sensitive fields are removed before sending.
  • App updates: on launch the app checks Expo (EAS Update) for updated content (see recipient list).
  • Usage measurement: iOS and Android measure anonymous usage: for example how far into the questionnaire people get, to find where the apps are confusing. They contain no analytics SDK and no advertising SDK, including no PostHog SDK: events go to our own server, which forwards them to PostHog; the apps themselves never contact PostHog and never transmit your answers, income figures or free text. Nothing is stored on your device for this purpose. The identifier is valid for a single app session, generated fresh each time you open the app, and discarded when you close it, so sessions cannot be linked to each other or to website visits.
  • No tracking: the app does not track you across apps or websites on either iOS or Android, uses no advertising identifier, and requests no device permissions (no location, no camera, no contacts).

10. No automated decision under Art. 22 GDPR

The ranking is an explainable decision aid with no legal or similarly significant effect. There is no solely automated individual decision within the meaning of Art. 22 GDPR.

11. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Arts. 15–21 GDPR), and the right to withdraw consent at any time (Art. 7(3) GDPR). Contact [email protected] to exercise them.

You can start the deletion of your data yourself at any time at /delete-data: we email you a one-time confirmation link and then delete the newsletter subscriber record, mobile newsletter claim and newsletter entitlement records, as well as email-linked purchase entitlements, restore links, owned results and associated shared/combined links. Deleting access records also removes the ability to restore that access. Payment and order records are kept with the email address and owner identifier removed; payment-provider references remain for statutory tax and commercial-law reasons.

12. Right to complain

You may lodge a complaint with a supervisory authority, e.g. Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin.

13. Changes

We may update this policy when features or the legal situation change. The version published here applies.