Privacy Policy

Who we are

Crosscast (“we”, “us”) is a service for publishing and scheduling videos to social platforms, operated at crosscast.app. For any privacy question or request, contact privacy@crosscast.app.

Data we collect

• Account data: your email address and a hashed password, managed by our authentication provider (Supabase).
• Connected platform data: when you link a YouTube, TikTok or Instagram account we store the account's ID, display name, handle, avatar and the OAuth access/refresh tokens the platform issues. Tokens are encrypted at rest and used only to publish content you explicitly create and to show basic account information inside the app.
• Content: the video files, titles, captions and scheduling settings you upload. Files are stored with our storage provider (Cloudflare R2) until you delete them.
• Technical logs: standard server logs (IP address, timestamps, request metadata) kept for security and debugging.

How we use it

Solely to run Crosscast: authenticating you, storing your videos, publishing and scheduling posts to the platforms you connect, and showing you the status of those posts. We do not sell your data, we do not use it for advertising, and we do not use your content or platform data to train AI models.

Third-party platforms

Crosscast connects to third-party platforms only with your explicit authorization via each platform's official OAuth flow. You can revoke access at any time from the app (Accounts → Disconnect) or from the platform's own security settings.

• YouTube: Crosscast uses YouTube API Services. By connecting a YouTube channel you agree to the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy. You can revoke Crosscast's access via Google security settings. Crosscast's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• TikTok: publishing uses TikTok's Content Posting API under TikTok's Terms of Service.
• Instagram: publishing uses Meta's Instagram Platform API under Meta's Platform Terms.

Storage & retention

Videos and post data are kept until you delete them or delete your account. When you disconnect a platform account, its OAuth tokens are deleted immediately. When you delete your Crosscast account, all associated videos, posts, tokens and profile data are permanently removed within 30 days.

Your rights

Depending on your location (including under the GDPR), you may have the right to access, correct, export or erase your personal data, and to object to or restrict processing. Email privacy@crosscast.app and we will respond within 30 days.

Changes

We will update this policy as the service evolves and note the date at the top. If a change is material, we will notify you by email or in-app before it takes effect.