Privacy Policy

Crosspath is operated in the United Kingdom by Graeme Descoteaux, trading as Crosspath, who is the data controller for this private beta. Contact support@crosspath.travel about privacy or your information rights.

This beta notice must be reviewed again if the legal operator, business structure or service changes.

• Account information, including your email address and authentication records.
• Profile information you provide, such as your name, photo, country, travel preferences, biography and interests.
• Trip information, including destinations, regions, dates, preferences, saved itineraries and sharing choices.
• Content and social activity, including connections, messages, meetups, journal entries, feedback and uploaded images.
• Technical and security information, such as device, browser, IP address, timestamps, diagnostic logs and actions needed to protect the service.
• Information you send when asking for support or exercising your rights.

• To provide Crosspath: create your account, save trips, generate itineraries, show route overlaps and enable features you request. Our basis is performance of our agreement with you.
• To support social features: show information to other travellers only as allowed by your settings and actions. Our basis is performance of our agreement and your choices.
• To keep people and Crosspath safe: prevent abuse, investigate reports, enforce rules and secure accounts. Our basis is our legitimate interests and, where relevant, legal obligations.
• To operate and improve the beta: diagnose failures, understand feature performance and respond to feedback. Our basis is our legitimate interest in developing a reliable service.
• To send service emails: confirmation, password reset, security and essential beta messages. Our basis is performance of our agreement and security interests.

We do not sell personal information or use it for third-party advertising.

If you choose to enable Trip-timed emails in your profile, Crosspath uses your saved Trip dates and completion state to send occasional reminders and suggestions. We record when and where you opted in and the notice version. Signing up alone does not enable these emails.

You can turn them off in your profile or unsubscribe using any lifecycle email. We retain delivery and suppression records to prevent duplicate or unwanted messages. This choice is separate from essential confirmation, password-reset and security emails.

With your consent, we measure browsing sessions, broad traffic sources, device categories, public landing pages and steps from signup to a first saved trip. A random session cookie expires after 30 minutes of inactivity or 24 hours. If you create and confirm an account in that session, we link its internal account ID to the session to measure successful signup and first-trip saving. This is pseudonymous information, not fully anonymous data. We do not collect form contents, messages, private trip IDs or URL query strings in this session report.

Choose Allow analytics or Decline when asked, or use Analytics preferences at the bottom of any page to change your choice. Your choice is remembered for six months. Declining does not affect your account or trip planning. We also respect browser Do Not Track and Global Privacy Control signals. Optional visitor analytics, Vercel Analytics, Speed Insights and the Metricool tracker load only when allowed.

Session records are kept for up to 30 days plus an hourly cleanup interval. For abuse prevention, we use a daily-changing keyed hash of the network address, retained for up to two days plus the cleanup interval; the session-report tables do not store raw IP addresses. Reports are restricted to authorised administrators. This optional measurement uses consent; essential account, security and successful beta activity records remain separate.

We use Metricool to measure visits to Crosspath and understand how our social content brings people to the website. Metricool receives technical visit information, including the page viewed and IP address, which it uses to estimate country. Its website tracker does not set cookies. This website measurement is separate from the account and feature activity we use to understand the beta.

When you ask Crosspath to build a trip, your planning brief and relevant trip preferences are sent to OpenAI to generate a proposed itinerary. AI output may be inaccurate and is checked separately before a location is saved. Do not include sensitive personal information in a planning brief.

We use service providers to run Crosspath, including Supabase for authentication, database and storage; Vercel for hosting; OpenAI for itinerary generation; Mapbox for location verification; Google Maps services for place imagery and attribution; Resend for account and optional Trip-timed email; and Metricool for website analytics.

Other travellers receive profile, trip, meetup, journal or message information only through the relevant feature and your sharing choices. We may disclose information where required by law or necessary to protect people, rights or the service.

Some providers process information outside the UK. We rely on the provider's applicable contractual and legal safeguards for international transfers.

We retain information while your account is active and afterwards only for as long as reasonably needed for the purposes above, dispute resolution, safety, fraud prevention and legal obligations. Content you delete may remain temporarily in protected backups until normal backup cycles expire.

We use access controls, encryption in transit and provider security measures. No online service can guarantee absolute security, so please use a unique password and tell us promptly about suspected misuse.

You control trip discoverability, sharing and blocked travellers inside Crosspath. Depending on the circumstances, UK data-protection law may give you rights to access, correct, erase, restrict or receive your information, and to object to some uses.

Email support@crosspath.travel to exercise a right or request account deletion. We may need to verify your identity. You may also complain to the UK Information Commissioner's Office at ico.org.uk.

Crosspath's private beta is for people aged 18 or over. We may update this notice as the beta develops and will show a new effective date when changes are material.