Cookie & Local Storage Policy
1.The app doesn't use cookies
Cookies are a browser technology. Crossroutes is a native app with no embedded browser and no web view in its sign-in or account flows, so there's nothing that could set or read a cookie in the first place (the one exception, an optional Strava connection, is covered in section 4). What follows is a plain account of what the app does store on your device, since that's the closest equivalent and deserves the same transparency.
The web version at web.crossroutes.de does run in a browser, but it doesn't set or read cookies either - its sign-in works with a token, not a cookie. What it keeps in your browser's storage instead is listed separately at the end of section 2.
2.What the app stores on your device
| What | Purpose | Can you turn it off? |
|---|---|---|
| Encrypted session token | Keeps you signed in between app launches | Removed automatically when you sign out |
| Offline cache of your Crossroutes, friends, and profile | Lets the app show your data instantly and work briefly offline | Cleared automatically on sign-out; can be cleared any time via your OS's own app storage settings |
| Map cache | Keeps map data you've already viewed (map tiles, fonts and symbols) on the device so the map loads faster and doesn't download the same data again (kept up to 30 days, at most about 100 MB) | Can be cleared any time via your OS's own app storage settings ("clear cache") |
| Map access token | Lets our map service recognize a signed-in account (by a pseudonym, not your name or ID) so it can generate new map areas for you | Removed automatically when you sign out |
| App preferences (theme, units, notification settings) | Remembers your choices between sessions | Changeable any time in Settings |
| Push-notification registration token | Lets Google's Firebase Cloud Messaging deliver notifications to your specific device - see the privacy policy | Yes - disable notifications entirely, or per category, in Settings; your OS's own notification permission can also be revoked system-wide |
| Member subscription/purchase state (Android only) | Lets Google Play Billing verify and restore your active Member subscription across app restarts, the same way any Play-billed subscription works | Managed entirely by Google Play - cancelling your subscription in the Play Store app's own subscription settings clears this |
The web version (web.crossroutes.de)
The web version doesn't set cookies either. It keeps the same kinds of information in your browser's own storage for crossroutes.de (local storage and IndexedDB), which only crossroutes.de can read:
| What | Purpose | Can you turn it off? |
|---|---|---|
| Session token, plus your user ID and username | Keeps you signed in between visits | Removed automatically when you sign out; also by clearing this site's data in your browser |
| Map access token | Lets our map service recognize a signed-in account (by a pseudonym, not your name or ID) so it can generate new map areas for you | Removed automatically when you sign out; also by clearing this site's data in your browser |
| Offline copy of your Crossroutes, friends, and profile, the app's own notices (route reversal, weather windows, disruptions on your routes, dismissed suggestions) and changes queued while offline (IndexedDB) - only with your consent | Lets the page show your data instantly on the next visit. Without consent the web version keeps this data in memory for the open tab only | Yes - it is off until you choose "Accept" in the consent banner; change or withdraw your choice any time via "Cookie settings" at the bottom of the sidebar (on a phone: Settings → Legal) (withdrawing deletes the stored copy). Also cleared on sign-out |
| Your consent decision | Remembers your choice in the consent banner so it isn't asked again on every visit | Change it any time via "Cookie settings"; cleared with this site's data |
| Whether you closed the “use full screen” hint (phones only) | So the tip on adding Crossroutes to your home screen is shown only once | Deleted with this site's data in your browser; the hint then shows once more |
| App preferences and language | Remembers your settings and chosen language between visits - including a setting you just changed, until it has been sent to our server | Changeable any time in Settings |
| Time of the last background check (sync, Weather Windows, traffic disruptions on your routes) | So that reopening the page doesn't repeat a check that ran only minutes ago - the same schedule the app keeps on your phone | Only used for checks you've enabled; cleared with this site's data |
| Push subscription and notification service worker | Lets your browser receive and show the notifications you've enabled - only set up after you allow notifications for crossroutes.de; see the privacy policy | Yes - per category in Settings, or entirely by revoking the notification permission in your browser's site settings |
The map data (map sections plus the map's fonts and symbols) is kept in your browser's normal cache (the same one every website uses for its files) for up to 30 days, so the map doesn't download it again. This is strictly necessary to display the map you asked for and needs no consent (§ 25(2) No. 2 TDDDG); you can clear it via your browser's settings.
Search and the "Open route" dialog store nothing in your browser; a GPX file you download is saved by your browser wherever it saves downloads, like any other file.
3.When we ask for consent
Under EU and German law (the ePrivacy rules, implemented in Germany through the TTDSG), storing information on your device only needs your separate consent if it isn't strictly necessary for a feature you've actively asked for. Every item above, in the app and in the web version, exists purely to run a feature you're using - signing in, seeing your Crossroutes offline, remembering your settings, or receiving notifications you've opted into. None of it is used for advertising, cross-app tracking, or behavioural profiling, so none of it needs a separate consent popup. We'd rather be straightforward about what's stored and why than add a checkbox that doesn't actually give you a meaningful choice.
The web version is the one exception: its offline copy makes later visits faster but isn't needed for anything you asked for, so it is only stored with your consent (§ 25 (1) TDDDG; Art. 6 (1) (a) GDPR for the data in it). The consent banner offers "Decline" and "Accept" as two equal buttons, nothing is pre-selected, and "Details" shows each category. Declining changes nothing about what you can do in the web version - it only means your data is loaded fresh on each visit.
4.Third parties and local storage
Google services (which handle Firebase Cloud Messaging and, if you use it, Google Sign-In) manage some of their own device-level identifiers as part of the Google-provided components themselves - this is standard for any app using these components, on both Android and iOS, and is documented by Google directly, not something Crossroutes controls independently. If you connect your Strava account (Settings), that opens your device's real, ordinary browser on strava.com - any cookies or local storage it sets there are governed by Strava's own policies, not this one.
5.Contact
Questions about this policy: [email protected].