Privacy Policy

This policy describes what personal data Crosspine collects when you use the service, why we collect it, who processes it, and the rights you have over it. Crosspine is operated by Nicolas Laforet, a sole proprietorship (micro-entreprise) registered in France, who is the data controller for the personal data described here.

We store only what the service needs to operate:

• Account data: your name, email address, and a salted password hash (never the password itself), plus workspace membership and role.
• Sign in with Google or GitHub: if you choose a social sign-in, the provider sends us your name, email address, and profile picture to create or match your account. We request no other data from those accounts and never post to them.
• Connected-account credentials: OAuth tokens for the social accounts you connect, encrypted at rest with AES-256-GCM. Disconnecting a channel deletes its tokens.
• Content: your drafts, scheduled posts, and uploaded media, retained until you delete them or your account.
• Billing: subscription plan and status. Payments are processed by Stripe; card numbers never touch our servers.
• Operational logs: request metadata (timestamps, request ids, status codes) for reliability and abuse prevention. Secrets are redacted from logs.

To operate Crosspine: authenticate you, publish the posts you schedule to the networks you selected, process your media into the formats each platform requires, send transactional email (verification, password resets, invitations), and bill your subscription. We do not sell personal data and we do not use your content for advertising.

• Social platforms: the content you schedule is transmitted to each network you selected, under that network's own terms and privacy policy.
• Stripe: payment processing and fraud screening. Stripe receives your email address and billing details; card numbers are entered on Stripe's pages and never reach our servers.
• Resend: transactional mail delivery, processed in the European Union (Ireland).
• Anthropic: only when you use the optional AI assistant, your prompt and the draft text you asked it to work on are sent to Anthropic to generate the response.
• Hetzner Online: hosting. Our servers, database, and media storage run in Hetzner data centres in Germany, so your data is stored in the European Union.

Crosspine uses YouTube API Services to publish to the YouTube channels you connect. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service, and Google's own handling of your data is described in the Google Privacy Policy.

• What we access: the connected channel's id, name, and avatar, so you can see which channel is connected; the view, like, and comment counts of videos Crosspine published for you, shown in your analytics; and upload access, used only to publish the videos you scheduled with the title, description, and visibility you chose. We do not read your other videos, comments, playlists, or subscriptions.
• How we store and share it: access tokens are encrypted at rest as described in section 2, and channel details and statistics are stored in our database in the European Union. This data is shared only with the processors listed in section 4 as needed to run the service; it is never sold or used for advertising.
• Revoking access: disconnecting the channel in Crosspine deletes its tokens and the channel data we stored. You can also revoke Crosspine's access at any time from your Google security settings; Crosspine then can no longer read or post to the channel and marks it as disconnected until you reconnect or remove it.

Crosspine's use and transfer to any other app of information received from Google APIs, including Sign in with Google and YouTube, adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Account data is kept until you delete your account. Posts and media are kept until you delete them; uploads that never complete are removed automatically. Channel tokens are kept until you disconnect the channel. Operational logs are kept for at most 30 days and then discarded. Billing records are kept for as long as French accounting law requires.

Channel credentials are encrypted at rest with a dedicated key, all traffic is encrypted in transit with TLS, and passwords are stored only as salted hashes. Access to production systems is restricted to the operator of this deployment.

You can access and update your account data in Settings, and delete posts, media, and channels at any time from the app. Under the GDPR and similar laws you may also request access to, correction of, export of, or erasure of your personal data: contact support@crosspine.io and we will respond within 30 days. You may also lodge a complaint with your supervisory authority; in France that is the CNIL.

Crosspine uses only the session cookies required to keep you signed in. There are no advertising or cross-site tracking cookies.

Crosspine is not directed at children and requires users to be 16 or older.

We may update this policy; material changes will be announced in the app or by email before they take effect. The date above always reflects the current version.

Privacy questions and data requests: support@crosspine.io. See also our Terms of Service.