Privacy Policy | Crossroads

CROSSROADS - PRIVACY POLICY Last updated: June 29, 2026 1. INTRODUCTION CrossRoads Digital Media ("CrossRoads," "we," "us," or "our") provides a professional networking, collaboration, messaging, media, and opportunity platform for film, television, and media professionals (the "Services"). This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you use the CrossRoads mobile application, website, dashboard, and related services. If you do not agree with this Privacy Policy, do not use the Services. 2. PERSONAL INFORMATION WE COLLECT We collect personal information from the following sources. Information you provide to us: - Account information, such as name, email address, phone number, authentication identifiers, profile photo, and account preferences. - Profile information, such as professional role, job title, company, biography, portfolio links, credits, skills, location you choose to provide, geocoded profile or availability location records where enabled, calendar or availability information, and organization membership. - User content, such as ISOs, project posts, group posts, messages, comments, replies, reports, feedback, files, images, audio, and video. - Contact information you choose to import, such as selected contacts' names, phone numbers, email addresses, photos, and professional details for your private rolodex and contact-matching features. - Communications with us, including support requests, moderation appeals, feedback, legal notices, and privacy requests. Information collected automatically: - Device and app information, such as device type, operating system, app version, browser type, language, crash data, performance data, notification tokens, and diagnostic logs. - Usage information, such as screens viewed, features used, search and discovery interactions, content viewed, message and notification events, share events, and session information. - Network and security information, such as IP address, approximate location derived from IP address, authentication events, access logs, abuse-prevention signals, and fraud/security telemetry. - Location information, such as city, state, latitude/longitude, geocoded profile location, temporary location, location claims, and location visibility/radius settings where you provide or enable those features. CrossRoads does not currently design the Services around continuous background GPS tracking. - Cookie and tracking information from our web properties, including referral cookies and local storage used for invite/deep-link attribution. See our Cookie and Tracking Technology Policy. Information from third parties: - Authentication information from identity providers such as Auth0, Apple, or Google when you sign in through those services. - Delivery and status information from communications providers used for push, email, SMS, and similar messages. - Moderation and media processing information from service providers used to host, scan, transcode, or deliver uploaded content. 3. SENSITIVE PERSONAL INFORMATION Depending on how you use the Services, we may process information that can be considered sensitive under some laws, including account log-in credentials or authentication tokens, private message content, contact data, precise content of uploaded media, and other information you voluntarily provide. We do not use sensitive personal information to infer characteristics about you. We use it only to provide the Services, secure accounts, deliver communications, moderate content, comply with law, and protect users. CrossRoads is not designed to collect government identifiers, payment card numbers, health information, genetic information, biometric identifiers for identification, or precise GPS location. Do not submit information that is not needed for professional networking or collaboration. 4. HOW WE USE PERSONAL INFORMATION We use personal information to: - Provide, operate, personalize, maintain, and improve the Services. - Create, authenticate, secure, and manage accounts. - Enable profiles, search, discovery, professional networking, connections, groups, projects, ISOs, messaging, media uploads, and collaboration features. - Maintain your private rolodex and contact import choices. - Deliver push, email, SMS, in-app, and other transactional communications based on your settings and consent. - Process user-initiated shares, invite links, referral links, and deep links. - Moderate content, review user reports, enforce our Terms, Community Guidelines, Content Moderation Policy, DMCA Policy, and Artistic Integrity Agreement. - Detect, investigate, and prevent spam, fraud, abuse, security incidents, unauthorized access, and policy violations. - Provide analytics, product measurement, crash reporting, performance monitoring, and operational dashboards. - Respond to support, legal, privacy, data export, deletion, correction, and appeal requests. - Comply with law, legal process, regulatory obligations, and enforceable government requests. - Protect the rights, safety, property, and integrity of CrossRoads, users, creators, organizations, service providers, and the public. 5. HOW WE DISCLOSE PERSONAL INFORMATION We do not sell personal information for money. CrossRoads includes active Google Mobile Ads native ad slots. Google and its partners may process device identifiers, ad events, approximate location, and related data to deliver, measure, and protect ads. CrossRoads does not sell personal information for money, but ad delivery or measurement may qualify as "sharing" or tracking under some laws depending on configuration, user/device settings, and jurisdiction. Until related self-service controls are fully verified in the app, users can submit privacy-choice and opt-out requests at privacy@crossroads.app. We may disclose personal information as follows: With other users: - Profile information and public or shared content are visible based on your settings, group memberships, organization roles, and content visibility choices. - Messages and collaboration content are visible to intended recipients and participants. - Some professional activity may be visible to organization administrators or project/group administrators when you participate in those workspaces. With service providers: We use vendors that process information on our behalf, including: - Auth0 for authentication and identity management. - Amazon Web Services for backend infrastructure, AWS Lambda, Aurora/RDS, Secrets Manager, CloudWatch, Location Service, Rekognition moderation, SES email, End User Messaging SMS, and related services. - Cloudflare for Images, Stream, R2, media delivery, CDN, and related hosting. - Firebase/Google for App Check, push messaging, Crashlytics, Analytics, Remote Config. - PostHog for product analytics and masked mobile session replay where enabled. - New Relic for mobile performance, crash, network, and operational monitoring where enabled. - OpenAI for text moderation where configured. - Anthropic for feedback analysis where configured. - SpacetimeDB for real-time messaging surfaces where configured. - Google Mobile Ads for in-feed native advertising. - Google Maps APIs for maps, geocoding, or location-related features where enabled. - Email, SMS, push, analytics, observability, and support providers as needed to operate the Services. For legal, safety, and compliance reasons: We may disclose information to comply with law, legal process, subpoenas, court orders, regulatory requests, law enforcement requests, or to protect rights, safety, property, security, and platform integrity. Business transfers: If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, personal information may be transferred as part of that transaction, subject to appropriate notice where required. With your consent or direction: We may disclose information when you ask us to do so, such as when you share content, invite contacts, connect accounts, join organizations, or use integrations. 6. CONTACT IMPORTS AND INVITES If you choose to import contacts, the selected contacts' names, phone numbers, email addresses, photos, and professional details may be uploaded and stored securely as part of your private CrossRoads rolodex. We use imported contacts to save your private rolodex, help you find people you may know, support contact sharing features you choose to use, and send invitations when you direct us to do so. You choose which contacts to import, and you can delete imported contacts where the app provides that control or by contacting support. Device-level contact permission can also be revoked through iOS or Android settings. When you use your device's native SMS composer, email composer, or share sheet, the resulting communication is sent by you through your device or provider, not by CrossRoads. When CrossRoads sends SMS or email directly through our backend, our SMS and Communications Policy applies. 7. COOKIES, SDKS, ANALYTICS, AND TRACKING Our website may use cookies and local storage for referral attribution, deep-link routing, authentication flows, security, and basic functionality. Our mobile app may use SDKs for analytics, crash reporting, session replay, push notifications, and performance monitoring. We do not use cookies or SDKs to sell personal information for money. Advertising and tracking technologies are active in the app, including Google Mobile Ads and product analytics/session replay where configured. Where those technologies trigger consent, opt-out, or notice requirements, CrossRoads provides available app, device, email, and legal-request paths and will update this Policy when additional self-service controls are released. For details about the tracking technologies we use and your choices, see our Cookie and Tracking Technology Policy. 8. CONTENT MODERATION AND AUTOMATED REVIEW We use automated systems and human review to help detect and respond to policy violations. Images and sampled video frames may be reviewed with AWS Rekognition. Text fields may be reviewed with OpenAI moderation tools. User reports may be reviewed by CrossRoads personnel or authorized service providers. Moderation metadata may be stored for safety, appeals, audit, abuse prevention, and policy enforcement. Automated systems are not perfect. They may allow, flag, blur, block, remove, or help prioritize content. See our Content Moderation Policy for more detail. 9. SECURITY We use technical and organizational safeguards designed to protect personal information, including TLS in transit, encryption at rest where supported, Auth0-based authentication, access controls, server-side secret handling, logging, monitoring, and security review processes. No electronic transmission or storage system is completely secure. You are responsible for keeping your account credentials secure and for promptly telling us about suspected unauthorized access. 10. RETENTION We retain personal information for as long as reasonably necessary to provide the Services, comply with law, resolve disputes, enforce agreements, protect safety, prevent abuse, maintain backups, and run legitimate business operations. When you choose Delete All Personal Data, CrossRoads treats that as an erasure request and attempts to remove or de-identify personal information from active systems. Some information may remain for a limited period in backups, logs, audit records, security records, legal holds, opt-out suppression lists, dispute records, or records needed to protect other users' rights. SMS opt-out records may be retained after account deletion to honor opt-out requests. Moderation, safety, security, and legal records may be retained as needed to enforce policies, protect users, and comply with law. 11. YOUR PRIVACY CHOICES Depending on your location and applicable law, you may have rights to: - Access personal information we maintain about you. - Receive a copy of your personal information in a portable format. - Correct inaccurate personal information. - Delete personal information. - Opt out of marketing communications. - Manage push, email, SMS, contact, and privacy preferences. - Object to or restrict certain processing where required by law. - Appeal or ask for human review of certain decisions where required by law. You can exercise available choices through the app settings where those controls exist, or by contacting privacy@crossroads.app. In account settings, CrossRoads may offer separate deletion paths. "Delete account only" starts an account-closure request that may retain limited continuity records if you expect to return later, along with lawful safety, opt-out, legal, dispute, and audit records. "Delete specific data" lets you identify categories of data you want deleted or de-identified while keeping your account open. "Delete All Personal Data" requests erasure or de-identification of personal information across active systems, subject to the retention limits described above. If an in-app control is unavailable, contact privacy@crossroads.app. Some privacy controls may be request-based until self-service controls are released. If an in-app control is not available, contact privacy@crossroads.app. 12. CALIFORNIA PRIVACY RIGHTS California residents may have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act. See our California Privacy Rights Notice for categories of information collected, disclosed, and retained, and for instructions on submitting a request. 13. CHILDREN AND MINORS CrossRoads is intended for professional users and is not directed to children. CrossRoads is not intended for users under 18. If we learn that we collected personal information from a person who is not eligible to use the Services, we will take appropriate steps to delete it. 14. INTERNATIONAL USERS CrossRoads is based in the United States. If you use the Services from outside the United States, your information may be transferred to, stored in, and processed in the United States and other countries where we or our service providers operate. Data protection laws may differ from those in your jurisdiction. 15. CHANGES TO THIS POLICY We may update this Privacy Policy from time to time. If we make material changes, we will provide notice through the app, website, email, or another appropriate method. The "Last updated" date shows when this draft was last revised. 16. CONTACT US Privacy requests: privacy@crossroads.app Support: support@crossroads.app Legal: legal@crossroads.app Mailing address: CrossRoads Digital Media, Los Angeles, California