privacy: what we can and can't see

crosscode syncs your uncommitted edits between checkouts, so those files pass through our coordination service. this page says exactly what that service holds.

this is the honest summary. the complete, formal notice (legal bases, retention per category, your rights and how to exercise them) is the privacy policy. alongside it: cookies and local storage, subprocessors, and the data processing agreement for personal data that sits inside the files you sync.

we hold your file contents. there is no end-to-end encryption. files are encrypted in transit (tls) and at rest, under keys we manage, which means a crosscode engineer with production access could read them. we would rather say that plainly than imply otherwise.

if that is not acceptable for a given repository, do not sync it. crosscode is opt-in per checkout and stopping it leaves an ordinary git repository behind.

what the service stores

• the files you edit while syncing: path, content, the hashes either side merged against, and whether the change was a modify or a delete. tracked files only.
• your github account identity: the account you signed in with, and the project memberships we use to decide who may sync with whom.
• your repository, as owner/repo. projects are keyed on it. if a repository's name is confidential, this is not the tool for it.
• timestamps, sizes, and sequence numbers. when you were active and how large a change was.
• presence: which branch you are on and which paths you touched recently, so a teammate's agent can answer "who is working on what". this is in memory in the websocket gateway, not in the database.
• a pending sign-in, while it is pending. signing the cli in creates a row holding a hash of the device code and the short code you type into the page. it expires in about fifteen minutes and is consumed the moment sign-in completes.

what never leaves your machine

• untracked files. only files git already tracks are ever sent.
• secrets, even when tracked. .env*, *.pem, *.key, and similar are on a hard denylist, dropped before a change is captured rather than filtered later.
• your commits, branches, index, stash, and remotes. crosscode reads and writes working-tree files and one ref of its own (refs/crosscode/shadow). nothing in crosscode pushes anywhere.

how long it is kept

about 7 days. that window is what makes offline catch-up possible: a checkout that comes back within it replays what it missed, and one that has been away longer is told to resynchronize from full content rather than handed a partial history. beyond that window, history is no longer served back to any checkout.

your repository is the durable artifact the whole time, on your disk, as ordinary git.

what we never do

• we never send your code to a third-party ai provider. crosscode has no ai features and stores no model provider credentials. the only agent involved is the one already on your machine, and it reads your files locally.
• we never push to your git remotes.
• we do not sell or share your data.

removing someone

removing a member from a project ends their access immediately: their daemon stops receiving on its next request. it cannot un-share what they already have. they had a full checkout of the repository. no product can reach into a copy someone already holds, and we would rather tell you that than let you believe otherwise.

deleting your data

ask us and we delete your account, your projects, and the change history attached to them. see support. your repositories are unaffected, because they were never ours.

your other rights (access, rectification, restriction, portability, objection) and the one-month response time are in §9 of the privacy policy. write to privacy@getcrosscode.dev for any of them.

view raw markdown · generated from docs/privacy.md at build time, do not hand-edit this page.