Privacy Policy

Last updated: August 8, 2026

cross-post ("we", "us", "our") operates the cross-post.app website and service. This Privacy Policy explains how we collect, use, and protect your information when you use our service.

1. Information We Collect

Account Information: When you sign up, we collect your name, email address, and password (stored as a bcrypt hash). If you sign in with Google, we receive your Google profile information (name, email, profile picture).

Social Account Data: When you connect social media accounts, we store platform usernames, display names, and profile pictures. We do not store your social media passwords. OAuth tokens are managed by our third-party provider (Late API).

Content Data: We store the posts you create, including captions, media URLs, scheduling information, and publishing status.

Usage Data: We collect basic usage information such as post counts, login timestamps, and IP addresses for rate limiting and security purposes.

2. How We Use Your Information

• To provide and maintain the cross-post service
• To publish and schedule your content to connected social media platforms
• To manage your account and subscription
• To send transactional emails (password resets, account notifications)
• To enforce rate limits and prevent abuse
• To improve our service

3. Third-Party Services

We use the following third-party services to operate cross-post:

• Zernio — Social media account connection and content publishing. Your connected-account credentials are stored and managed by Zernio for these operations.
• Polar.sh — Payment processing for subscriptions. We do not store credit card information; all payment data is handled by Polar.
• Google OAuth — Optional sign-in method. We receive only your basic profile information.
• SendGrid — Transactional email delivery.
• Crisp — Optional customer support chat. Crisp is not loaded until you select Support. If you use chat, Crisp processes your messages and the technical data needed to provide the conversation. We do not automatically send your cross-post account name or email address to Crisp.
• Hetzner — Server hosting located in Europe.

4. Data Storage and Security

Your data is stored on secure servers hosted by Hetzner in Europe. We use HTTPS encryption for all data in transit, bcrypt hashing for passwords, and prepared SQL statements to prevent injection attacks. Access to production systems is restricted to authorized personnel.

5. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days. Post data and media references may be retained in backups for up to 90 days.

6. Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and data
• Export your data
• Disconnect any social media account at any time

7. Cookies and Local Storage

We use a session cookie (smp_session) to keep you signed in. This cookie expires after 30 days. We also store your theme preference in localStorage. If you choose to open Support chat, Crisp may use cookies and browser storage to maintain the conversation; no Crisp request is made until you select Support.

8. Children's Privacy

cross-post is not intended for users under the age of 13. We do not knowingly collect personal information from children under 13.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on this page and updating the "Last updated" date.

10. Contact

If you have questions about this Privacy Policy, open Support chat or email kolagames07@gmail.com.