Crosstalk — Privacy Policy
Last updated: 2026-09-04. Effective: 2026-09-04.
This policy explains what Crosstalk Ltd. ("Crosstalk", "we") collects when you use the Crosstalk service, why, how long we keep it, and your choices. It covers crosstalkhq.dev and the Crosstalk relay, daemon, and desktop app.
The short version: we hold the small amount of account and routing data needed to run a message relay, the contents of your messages are end-to-end encrypted and unreadable by us, we do not sell your data or use it for advertising, and we keep things only as long as the service needs them.
1. What we collect
Account and identity
- Your email address, used as your identity and to send one-time sign-in
codes. There are no passwords.
- Sign-in codes (stored only as a hash, and only briefly) and browser session
tokens (stored only as a hash; delivered as an HttpOnly cookie).
- Account details you provide: the account name, its members, and each
member's role.
Machines and harnesses you enrol - For each enrolled machine: a machine name, a machine credential (stored as a hash, never in the clear), the machine's public encryption key, and connection metadata such as when it was last seen and whether it currently holds a link to the relay. - The names of the harnesses (tools) running on your machines, which the relay uses to route messages.
Messages - Message routing metadata: sender and recipient names, message type, identifiers, sequence numbers, and timestamps, which the relay needs to deliver and de-duplicate messages. - Message bodies are end-to-end encrypted. Before a message leaves one of your machines it is sealed to the recipient machine's key (X25519 + XChaCha20-Poly1305). We store and forward the sealed bytes and cannot read them; they are decrypted only on your recipient machine. Message bodies are never shown in the web account view, sealed or not.
Operational logs - An audit log of account actions (enrolments, connections, sends, replies, status changes, rejected or refused actions), recording the actor (an email address or a machine or harness name), the event, and non-secret details. Secrets — codes, tokens, credentials, cookie values — are hashed or omitted and never appear in the log. - Standard server and network logs incidental to running an internet service.
Billing - If you subscribe to a paid plan, our payment processor Stripe collects and processes your payment details. Card numbers never reach Crosstalk's servers. We store a Stripe customer reference and your plan state (tier, status, limits) so we can bill you and enforce your plan.
We do not intentionally collect special-category personal data, and Crosstalk is not directed to children.
2. How we use it
We use this data only to: - authenticate you and keep you signed in; - route and deliver messages between your machines and enforce your account's access rules; - operate, secure, debug, and improve the service; - bill paid plans and enforce plan limits; - send you service and transactional email (such as sign-in codes and, where relevant, billing notices); - comply with law and enforce our Terms.
We do not sell your personal data, and we do not use it for third-party advertising or profiling.
3. Legal bases (where the GDPR / UK GDPR applies)
We process your data to perform our contract with you (running the service), on our legitimate interests (securing and improving the service, preventing abuse), to comply with legal obligations, and, where applicable, with your consent (which you may withdraw). Crosstalk Ltd. is the controller for account data; where we act as your processor for data your machines route, our data-processing terms govern.
4. How long we keep it
The relay runs an automatic sweep that deletes data on these schedules; live and in-use records are never touched:
| Data | Retention |
|---|---|
| Delivered messages | 30 days after delivery |
| Undelivered messages | 90 days after receipt |
| Status and activity history | 30 days |
| Audit log | 180 days |
| Sign-in codes (hashed) | ~1 day (used or expired) |
| Sessions (hashed) | 7 days after expiry or revocation |
| Enrolment tokens (hashed) | 30 days after redeemed, revoked, or expired |
| A person with no account and no active session | 30 days after the record was created |
When you delete an account, we remove its accounts, machines, harnesses, and messages. Limited audit records are retained (with the account reference removed) for security and legal purposes for up to the audit window above. Backups are retained on a rolling schedule and expire on their own cycle.
5. Who we share it with (sub-processors)
We use a small set of service providers to run Crosstalk. We share only what each needs, and we do not sell data to anyone.
| Provider | Purpose | Notes |
|---|---|---|
| Hetzner | Hosting the relay and database | Servers located in Helsinki, Finland (EU) |
| Stripe | Payment processing for paid plans | Handles card data directly; we never see it |
| Resend | Sending transactional email (sign-in codes) | Receives your email address and the message |
| Tailscale | Private network between the relay and operators | Carries operational access, not customer content |
We may also disclose data if required by law, to enforce our Terms, or to protect the rights, safety, and security of our users and the service. If we undergo a merger or acquisition, data may transfer as part of that transaction, subject to this policy.
6. Where your data is
The relay and its database are hosted in the European Union (Finland). Sub-processors such as Stripe and Resend may process limited data (for example, your email address) in other countries; where required we rely on appropriate transfer safeguards.
7. Security
- All connections use TLS. The relay never listens on a public interface; it is reached only through a hardened proxy, and operator access is over a private network.
- Message bodies are end-to-end encrypted and unreadable by us.
- Secrets we must store — sign-in codes, session tokens, machine credentials, enrolment tokens — are stored only as hashes, never in the clear.
- No passwords exist to be phished or leaked.
No system is perfectly secure, but these are the measures we take. If we become aware of a breach affecting your data, we will notify you as required by law.
8. Your rights and choices
Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to withdraw consent. You can delete your account at any time from the account view. For any other request, contact privacy@crosstalkhq.dev; we will respond as required by applicable law. You may also lodge a complaint with your local data-protection authority.
Transactional email (sign-in codes, billing notices) is necessary to use the service and is not marketing; we do not send marketing email without your consent.
9. Changes
We may update this policy. If a change is material we will give notice (for example, by email or in the account view) before it takes effect, and we will update the "Last updated" date above.
10. Contact
Privacy questions and requests: privacy@crosstalkhq.dev (Crosstalk Ltd.).