CrosshireContact
CR Crosshire

Privacy Policy

Effective: 2026-08-07

1. Who we are

Crosshire is operated by Darshan Singh, a sole proprietor based in the European Union. Contact: darshansingh@crosshire.ch. We are the data controller for personal data processed across the Crosshire surfaces listed below.

This policy is the master privacy notice for Crosshire as a parent brand. It covers four distinct surfaces, each with its own data shape:

  • Consulting — the parent site at crosshire.ch.
  • Blogs — the journal at blogs.crosshire.ch.
  • Learn — the courses surface at learn.crosshire.ch.
  • FitScore — the CV ↔ JD matching product at fitscore.crosshire.ch.

2. What each surface collects

2.0 All four surfaces — our own pageview tracker

Every page you open on any Crosshire surface is recorded by our own first-party tracker. This replaced the third-party Plausible analytics script in June 2026. It is not cookieless-by-design in the way Plausible was, and it is not aggregate-only: we store one row per page load, and that row identifies your device more precisely than the old setup did. In full, each row holds:

  • Your IP address, stored raw (not truncated, not hashed).
  • Your full browser User-Agent string.
  • Approximate location derived from the IP: city, region, country.
  • Your network operator and its ASN (e.g. your ISP's name, or the hosting provider if you use a VPN or proxy).
  • The surface and the exact page path, and the timestamp of the load.
  • The full referring URL — the address of the page you arrived from, including any query string it carried.
  • A random session ID generated per browser tab and held in sessionStorage. It is not a cookie and it is discarded when you close the tab.

Cross-surface linking. We stitch these rows into a single visit using the combination of IP address and User-Agent — not IP alone — splitting on a two-hour gap of inactivity. The practical effect is that a journey across our domains (for example crosshire.ch → learn.crosshire.ch → fitscore.crosshire.ch) is recognised as one visitor rather than three, even though each surface generates its own session ID.

Third-party IP lookup. To resolve the location and network fields above, your IP address is sent to ipwho.is, an external lookup service (see §5). The result is cached for 24 hours so a repeat visit within that window does not trigger a second lookup.

This data is visible only to the operator, through a single hidden dashboard on crosshire.ch protected by an unguessable URL. It is not published, not exposed through any public endpoint, and not linked to your account even where you have one — including on FitScore. It runs on all four surfaces regardless of whether you are signed in, and it is not gated behind a consent prompt; see §3 for the legal basis and your right to object, and §4 for how long the rows are kept.

2.1 Consulting (crosshire.ch)

  • There is no contact form. The site links a plain email address; if you write to us, we hold your email and whatever you chose to put in it, in an ordinary mailbox.
  • The application sets no cookies of its own on this surface.
  • The pageview tracker described in §2.0.
  • No AI processing touches anything you send us here.

2.2 Blogs (blogs.crosshire.ch)

  • No account, no login, no forms — the journal accepts no input from you at all.
  • A theme preference (cream / coffee) in your browser's local storage. It never leaves your device.
  • The learn_lead_seen cookie described in §2.3 is readable here, because it is scoped to the whole crosshire.ch domain. Blogs never sets it.
  • The pageview tracker described in §2.0.
  • No user data is ever sent to a language model from this surface. AI is used only when writing posts, before they are published.

2.3 Learn (learn.crosshire.ch)

Learn is anonymous — there is no account and no sign-in. But its practice tools accept work you produce and send it to third-party AI services to be marked, so the data involved is more substantial than the surface's lack of an account suggests:

  • Written submissions — the German text you write for a Schreiben task, and your side of any conversation with the AI speaking partner. Sent to Anthropic to be graded. Not stored on our servers.
  • Photos of your handwriting, and PDFs or images you upload to a writing task. Sent to Anthropic for transcription and grading, held in memory for the duration of the request only, and never written to disk.
  • Voice recordings for the Sprechen tools. These are transcribed by a third-party speech-to-text service — OpenAI Whisper, or NVIDIA's hosted ASR, depending on our configuration (§5) — and the transcript is then graded by Anthropic. Unlike the photos, your audio is saved to our server so you can play back what you submitted and so we can investigate grading complaints. It is stored without your name or any account link, under a random identifier, and is retrievable by anyone holding that identifier. See §4 for what we can and cannot promise about how long it stays.
  • URLs and documents you paste into the Reader tool. We fetch the page server-side; images go to Anthropic for text extraction, and the resulting text goes to Anthropic to be annotated.
  • Your email address, only if you enter it at one of the two optional prompts. Stored with the date first seen and last seen. Submitting it sets learn_lead_seen, a first-party cookie lasting 90 days and scoped to the whole crosshire.ch domain, so we do not ask again.
  • Your IP address, held briefly in our cache to enforce daily limits on the AI tools (they cost money to run).
  • Course progress and preferences in your browser's local storage. They stay on your device.
  • The pageview tracker described in §2.0.

2.4 FitScore (fitscore.crosshire.ch)

  • Email address (magic-link authentication).
  • CV content — the file you upload, plus the structured profile we parse from it (work history, education, skills, languages, location). The original file is kept in third-party object storage (§5); the extracted text and parsed profile are kept in our database.
  • Job descriptions you paste or upload.
  • Match results, Summaries, and Crosshire Scores generated by our AI pipeline.
  • Sensitive fields contained in CVs: parsed work history, language fluency, and location may be considered sensitive depending on your jurisdiction; we treat them as personal data under GDPR.
  • What goes to AI providers: your CV text and the job-description text are sent to Anthropic for parsing, analysis and Summary generation, and separately to OpenAI to be converted into embeddings (numeric vectors used for search and ranking). Both are listed in §5.
  • The pageview tracker described in §2.0, which on this surface also records the paths of pages you visit while signed in — though the rows are not linked to your account.

3. Legal basis (GDPR Article 6)

  • Pageview tracker (§2.0) — legitimate interest in understanding how our own sites are used and where visitors arrive from (Art 6(1)(f)). We do not ask for consent before it runs. Because the basis is legitimate interest, you have an unconditional right to object under Art 21; email us and we will add your IP to the exclusion list that removes your traffic from the dashboard.
  • Consulting enquiries — pre-contractual measures at the data subject's request (Art 6(1)(b)) and legitimate interest in responding to inquiries (Art 6(1)(f)).
  • Blogs — legitimate interest in operating the site (Art 6(1)(f)); consent for any non-essential cookie (Art 6(1)(a)).
  • Learn practice tools — performance of the service you asked for (Art 6(1)(b)): you submit a piece of work and ask for it to be marked, which cannot happen without sending it to the AI services in §5. Legitimate interest (Art 6(1)(f)) for the per-IP rate limits that keep the tools affordable to run.
  • Learn email signup — consent (Art 6(1)(a)).
  • FitScore — contract performance for matching, account auth, and Summary delivery (Art 6(1)(b)); legitimate interest for anonymized quality improvement (Art 6(1)(f)); consent where we ask for it explicitly.

4. Retention

  • Pageview tracker rows (§2.0) — 180 days, then deleted. This is enforced by a job that runs every night and removes rows older than the limit, not by an intention to tidy up. The IP-to-location cache expires after 24 hours.
  • Consulting enquiry emails — 12 months from last interaction, unless an engagement is opened (then per the statement-of-work retention clause). This is a mailbox-hygiene commitment, not something a system enforces.
  • Learn written submissions, photos, PDFs — not retained by us at all. They exist only for the length of the request that grades them. What the AI providers in §5 do with a copy is governed by their own retention policies, linked there.
  • Learn voice recordings — no automatic deletion is currently implemented. We would rather say that plainly than quote you a number nothing enforces: stored audio remains on the server until it is removed manually. If you want a recording deleted, email us with the playback link you were given and we will delete it. We intend to add an automatic expiry and will update this page with the actual period when we do.
  • Learn email list — kept until you ask us to remove you; email us and we will delete the entry. We are not sending anything to this list today, so there is no unsubscribe link to click yet; if that changes, every message will carry one.
  • FitScore CVs and JDs — kept until you delete them or close your account. Requesting deletion runs immediately and cascades across matches, Summaries, embeddings, usage records and the account itself; we allow up to 30 days for the request to be fully honoured, including the stored copy of your original CV file in object storage, which is removed as a separate step.
  • FitScore account email — retained while the account is active; deleted within 30 days of account closure.
  • Aggregated, anonymized usage metrics — retained indefinitely; they do not identify you.

One consequence worth stating outright: deleting a FitScore account removes your FitScore data, but it does not remove the tracker rows in §2.0. Those are keyed to an IP and a browser, never to an account, so nothing links them to you for us to find. They age out on the 180-day schedule above. The same is true of the Learn email list and stored Learn audio, which live on the anonymous surface and have no account to be attached to — ask us and we will delete either by hand.

5. Sub-processors

We rely on a small list of sub-processors, each handling only the data its function needs. Where a provider offers a data-processing agreement we enter into it and rely on the terms in their notice below. One entry is different and we would rather name it than bury it: ipwho.is is consumed as a public lookup endpoint, so there is no negotiated processing agreement behind it — an IP address is sent, a location comes back. If you would rather that did not happen for your traffic, §3 explains how to object.

  • Anthropic — LLM inference for FitScore CV / JD parsers, the matcher, and Learn content generation. US-based. anthropic.com/legal/privacy
  • OpenAI — two separate jobs. On FitScore, converting CV and job-description text into embeddings for search and ranking. On Learn, transcribing voice recordings from the speaking tools (Whisper), where that is the configured transcription backend. US-based. openai.com/policies/privacy-policy
  • NVIDIA — hosted speech recognition for Learn voice recordings, as the alternative transcription backend to Whisper. Exactly one of the two is active at any time, depending on our configuration; both are listed because we will not make you guess which. US-based. nvidia.com/privacy-policy
  • ipwho.is — IP-address lookup that resolves the location and network fields in §2.0. Your IP is sent to this service on your first pageview and then cached by us for 24 hours. ipwho.is
  • Google Cloud — the virtual machine that runs all four sites, the API, the database and the cache. There is no content-delivery network or edge platform in front of it; requests reach our server directly. cloud.google.com/terms/cloud-privacy-notice
  • Cloudflare — R2 object storage holding the original CV files uploaded to FitScore. cloudflare.com/privacypolicy
  • Infomaniak — magic-link sign-in email for FitScore. Swiss-hosted. infomaniak.com
  • Twilio SendGrid — other transactional FitScore email: the welcome message and workspace invitations. US-based. twilio.com/legal/privacy

Our database and cache are not a separate provider: they run in containers on the same Google Cloud machine as everything else, so they are covered by the entry above rather than by a managed-database vendor of their own.

No longer used. Plausible Analytics was our analytics provider until June 2026 and appeared in earlier versions of this policy. It has been removed from all four surfaces and replaced by the first-party tracker in §2.0. No Plausible script runs on any Crosshire site.

We do not sell, rent, or trade your personal data. We do not share data with advertisers.

6. International transfers

Several of the sub-processors in §5 are established in the United States — Anthropic, OpenAI, NVIDIA, Cloudflare, Google and Twilio SendGrid among them. Transfers to them rely on Standard Contractual Clauses approved by the European Commission, and, where the provider holds a current certification, on the EU-US Data Privacy Framework as a complementary safeguard. We do not restate each provider's certification status here, because it can change without our knowing; the authoritative source is the public Data Privacy Framework list and each provider's own notice, linked above.

What actually crosses a border is worth being concrete about: your CV and job descriptions (Anthropic, OpenAI, Cloudflare), your German written work and voice recordings on Learn (Anthropic, and OpenAI or NVIDIA), and your IP address on every pageview (ipwho.is, for the lookup in §2.0). Transfers last as long as the request that causes them, after which the data is subject to the processor's own retention policy rather than ours.

7. Job descriptions and CVs (FitScore)

JDs and CVs you submit to FitScore are processed by Anthropic to generate your Summary. The content remains yours: we do not share it with the company whose JD you submitted, we do not establish any business relationship with that company on the basis of your submission, and we do not contact the original JD author. If your employer or a third party originally authored the JD, you remain responsible for ensuring you have the right to submit the content for screening purposes. See the FitScore EULA and our Terms for the full clauses.

8. Your rights (GDPR Articles 15–22)

  • Access — request a copy of the personal data we hold about you.
  • Rectification — ask us to correct inaccurate or incomplete data.
  • Erasure — request deletion of your personal data where there is no overriding legal basis to retain it.
  • Portability — receive your data in a structured, machine-readable format.
  • Restriction — ask us to restrict processing while a dispute is resolved.
  • Objection — object to processing based on legitimate interests.
  • Withdraw consent — where processing is based on consent, you can withdraw it at any time.
  • Lodge a complaint — with your national supervisory authority.

To exercise any of these rights, email darshansingh@crosshire.ch. We respond within 30 days.

9. Automated decision-making and AI grading

FitScore uses automated processing — large language models — to generate fit scores and Summary outputs. This constitutes automated processing under GDPR Article 22. FitScore is a decision-support tool: outputs are advisory and probabilistic, built to help you decide quickly whether a match is worth a conversation. They are intended to inform your own decision-making, not to replace it. You retain the right to obtain human review, contest a result, and request the principal factors behind it by emailing darshansingh@crosshire.ch.

Learn's grading is automated in the same sense: the band, the score and the corrections you get back on a piece of writing, a recording or a photographed handwritten text are produced by a language model without a human reading your work first. It carries no legal or similarly significant effect — it is practice feedback, not an examination result, and it certifies nothing. Treat a mark you disagree with as the model being wrong, which it sometimes is; write to us and we will look at it.

10. AI-generated content

Much of what you read on Crosshire was written with AI assistance, and we label it rather than leave you to wonder. Learn's German course material — reading texts, vocabulary, grammar explanations and exercises — carries a standing notice on the page itself (“Die Inhalte … wurden mit Hilfe von KI erstellt”) stating that it was produced with AI against the CEFR levels it targets. Blog posts may likewise be AI-assisted; that use is editorial and involves no reader data. Where content is AI-assisted it has been reviewed before publication, but it can still be wrong — see §4 of the Terms, and tell us when you find an error.

11. Security

HTTPS in transit, encrypted storage at rest where the underlying provider supports it, access controls limited to the operator, and rate-limiting on public endpoints. We keep dependencies patched and the sub-processor list short to reduce attack surface. No system is perfectly secure; if you spot a vulnerability, report it to darshansingh@crosshire.ch.

12. Children

Consulting, Blogs and FitScore are not directed at children; FitScore is for adult job-seekers and recruiters only.

Learn is different and we should say so clearly. Its Bildung section carries Klasse 3 and 4 curriculum material — mathematics and German for children of about nine and ten — and we offer it to schools. It is built to be used by a child alongside a parent or a teacher, and that adult is the one who decides whether the child uses it. Two things follow that an adult should know before saying yes:

  • Reading the lessons sends us nothing beyond the pageview record in §2.0, which applies to every visitor including a child.
  • The practice tools do more. A photographed answer, a written sentence or a spoken recording is transmitted to the AI providers in §5, all outside the EU, and voice recordings are stored on our server (§4). Nothing forces a child to use those tools — the lessons work without them.

We do not knowingly collect a child's name, and none of the Learn tools ask for one. If a child has submitted something you would rather we did not hold — a recording, an email address — write to darshansingh@crosshire.ch and we will delete it. The same applies to any other surface where you believe a child under 16 has provided personal data.

13. Changes to this policy

We may update this policy from time to time. Material changes will be highlighted on this page with a new effective date. Continued use of any Crosshire surface after the effective date constitutes acceptance of the revised policy. Older versions are available on request.

14. Contact

Data controller: Darshan Singh, sole proprietor, EU.
Email: darshansingh@crosshire.ch

A list of EU national supervisory authorities is available at edpb.europa.eu/about-edpb/about-edpb/members_en.

This document is an operator-drafted policy for transparency. Consult a lawyer for legally binding interpretation in your jurisdiction.