Privacy Policy

1. Introduction

CrossCode ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service, including our CLI tool, mobile app, and web application.

2. Information We Collect

Account Information

When you create an account, we collect:

• Email address
• Name
• Profile image (optional)
• Password (stored in hashed form)

Session Data

When you log in, we automatically collect:

• IP address
• User agent string
• Session token
• Login timestamps

API Keys

When you generate an API key for CLI authentication, we store the key associated with your account. API keys are prefixed with cc_ and can be regenerated at any time.

Waitlist Information

If you join our early access waitlist, we collect your email address.

OAuth Data

If you sign in using a third-party provider (e.g., GitHub, Google), we may receive:

• Access tokens and refresh tokens
• Account ID from the provider
• Scope of permissions granted

3. How We Use Your Information

We use the collected information to:

• Authenticate your identity and manage your account
• Provide and maintain the Service
• Generate and validate API keys for CLI access
• Send verification emails and OTP codes
• Communicate with you about updates and early access
• Monitor for security threats and abuse
• Improve the Service

4. How Your Data Flows

When you run npx crosscode, the CLI:

• Starts a local OpenCode server on your machine
• Establishes a secure tunnel via Cloudflare
• Validates your API key against our database

Your code and files never leave your machine. The tunnel only exposes the OpenCode server interface to your mobile app for remote control.

5. Data Storage

Your data is stored in a PostgreSQL database hosted on Neon. We implement appropriate security measures to protect your data, including:

• SSL/TLS encryption for database connections
• Password hashing using industry-standard algorithms
• Session tokens with expiration
• Connection pooling with idle timeouts

6. Email Communications

We send emails for:

• Email verification during sign-up
• One-time password (OTP) codes for authentication
• Early access notifications (if you join the waitlist)

Emails are sent via SMTP. You can opt out of non-essential communications at any time.

7. Data Sharing

We do not sell, trade, or rent your personal information to third parties. We may share data:

• With Cloudflare for tunnel establishment (technical necessity)
• With OAuth providers during authentication (only what you authorize)
• When required by law or to protect our rights

8. Data Retention

We retain your data for as long as your account is active. You can request account deletion by contacting us. Session data is automatically cleaned up based on expiration policies.

9. Your Rights

You have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data
• Export your data
• Opt out of communications
• Revoke API keys at any time

10. Security

We implement security measures including encrypted connections, hashed passwords, session expiration, and API key validation. However, no method of transmission over the Internet is 100% secure.

11. Children's Privacy

CrossCode is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected such data, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date. Continued use of the Service constitutes acceptance of the updated policy.

13. Contact

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us at crosscode@sish.work.