Privacy policy

Last updated: November 3, 2026. This is a plain-language summary intended for review by counsel before launch.

Two audiences

Customers are website owners and developers with a CrossUpload account. Visitors are people who upload files through a customer’s website. Visitors never create a CrossUpload account.

What we process for visitors

• The files they choose to upload, on behalf of the customer whose form they are using.
• Technical metadata needed to deliver the service: file name, size, type, timestamps and the upload source (device or phone).
• Short-lived security data such as IP addresses for rate limiting, kept in memory.

We do not use file contents for analytics or advertising. Our funnel analytics record only stage names (for example “picker opened” or “file ready”).

What we process for customers

Account email, hashed password, workspace name, project settings, usage records and billing state. Payments are processed by Stripe; we never see full card numbers.

Retention

Uploaded files are kept for the retention period of the customer’s plan and project, then deleted together with all stored versions. Customers can delete files earlier.

Contact

Questions or requests: [email protected]. Visitors should contact the website they uploaded to first; that website controls their files.