Privacy Policy

Crossed Paths AI LLC

Last Updated: October 9, 2026

1. Introduction

Crossed Paths AI LLC ("we," "us," "our," or the "Service") operates the CrossedPaths iOS app and website. CrossedPaths reads the location data already embedded in the photos on your device to find moments when your path crossed with someone you choose to connect with. This Privacy Policy explains how we collect, use, store, share, and protect your information.

By using our Service, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy.

2. Information We Collect

2.1 Photo Location Data (processed on your device)

Your photos never leave your device.

When you grant photo access, the app reads the EXIF metadata your camera already saves — on your device. Only the following is sent to our servers:

GPS coordinates (latitude/longitude) from photos that have them
The timestamp of each such photo
The photo's filename (used as a reference label) and a flag for estimated timestamps

The photos themselves — pixels, faces, content — are never uploaded, never collected, and never seen by us.

2.1a Connection Information

Information you provide about your connection: the names you enter, your relationship to them, and the date you met. Your connection uses their own app and uploads their own coordinates the same way.

2.2 Account Information

Email address
Username/password (hashed)
Profile information you provide

2.3 Automatically Collected Data

IP address and browser type (user agent) — received with requests and recorded at signup; used for security, rate limiting, and abuse prevention. On our website, our host (Vercel) also uses them to count visits (see 2.4). We never use them for advertising.
Standard server request logs (timing and errors, for performance and security monitoring)
Browser local storage to keep you signed in and remember your display preferences — we set no tracking cookies (see Cookie Policy)

2.4 Website Analytics

Our website uses Vercel Web Analytics to count visits. It sets no cookies. We see only totals: which pages were viewed, which site sent the visitor, and the visitor's country, type of device, browser and operating system.

2.5 Apple Search Ads Attribution

We advertise on the App Store through Apple Search Ads. When you first open the app, it asks Apple for an attribution token. After you sign in, the app sends that token to our server. Our server sends it to Apple, and Apple tells us whether one of our ads led to the install and, if so, which campaign, ad group, keyword and ad it was. We save that answer with your account so we can tell which ads work.

This does not use your device's advertising identifier (IDFA). It does not track you across other companies' apps or websites, and we never sell it or share it with anyone else.

3. How We Use Your Data

We use collected data to:

Provide, operate, and improve the Service
Compare your coordinates and timestamps with your connection's to find crossed paths
Communicate with you regarding the Service
Measure which of our Apple Search Ads bring people to the app (see 2.5)
Comply with legal obligations

3.1 What We Never Do With Your Data

We do not sell your data. Not raw, not aggregated, not de-identified — not to advertisers, not to data brokers, not to anyone.

We do not use your data to train machine learning models. We do not license your data to third parties. The analytics we run (counting how many people completed setup, totals of website visits, and which of our ads led to installs) are for us alone. They are never sold, and never shared beyond the providers that run them for us.

4. License to Operate the Service

You own your data. You grant us only the limited, non-exclusive license needed to operate the Service for you: to store your coordinates and timestamps, compare them with your connection's, and display the results to the two of you.

This license ends when your data is deleted under Section 7. Nothing survives it.

5. Data Sharing and Disclosure

We may share your data with:

Your Connection: The person you link with sees only the times and places your paths crossed — never your full location history
Service Providers: Third parties performing services on our behalf (cloud hosting, email delivery, website analytics, security) — bound to process data only for us
Apple: the attribution token goes to Apple only so Apple can tell us which ad, if any, led to your install (see 2.5)
Business Transfers: In connection with merger, acquisition, or sale of assets
Legal Requirements: When required by law, subpoena, or government request
With Your Consent: When you direct us to share

6. Data Security

We implement commercially reasonable security measures. However, no system is completely secure. You acknowledge and accept that:

We cannot guarantee the security of data transmitted to or stored by the Service
You upload data at your own risk
We are not liable for unauthorized access, data breaches, hacks, or security incidents, whether caused by our negligence or otherwise
You are solely responsible for maintaining copies of your data

7. Data Retention and Deletion

We retain your data for as long as your account is active.

When you delete your account (in Settings, or by contacting us):

Immediately: your account is deactivated, your data stops being processed, and all marketing communication to you stops
Recovery window: your data is retained for up to one year from your deletion request, so you can recover your account by contacting support if you change your mind
Permanent deletion: your data is scheduled for permanent deletion one year after your request — coordinates, timestamps, results, everything. This cannot be undone
Sooner on request: if you want permanent deletion without the recovery window, email privacy@crossedpaths.ai and we will erase your data without waiting out the year, subject to legal retention requirements

8. Your Rights

Depending on your jurisdiction, you may have rights to access, correct, delete, or port your data. To exercise these rights, contact us at privacy@crossedpaths.ai. We will respond within the timeframe required by applicable law.

9. International Users

Your data may be transferred to and processed in the United States or other countries. By using the Service, you consent to such transfers.

10. Children's Privacy

The Service is not intended for users under 18. We do not knowingly collect data from minors.

11. Third-Party Services

The Service may contain links to third-party services. We are not responsible for their privacy practices.

12. Changes to This Policy

We may update this Policy at any time. Continued use of the Service after changes constitutes acceptance.

13. Contact

For privacy inquiries: privacy@crossedpaths.ai

BY CREATING AN ACCOUNT OR USING THE SERVICE, YOU CONFIRM THAT YOU HAVE READ, UNDERSTOOD, AND AGREE TO THIS PRIVACY POLICY IN ITS ENTIRETY.