Privacy Policy
Last updated: not yet in force
Crossbook has no accounts and almost nothing to collect. This describes exactly what it does handle, and what it deliberately does not.
The only thing you can submit to Crossbook is an email address, and only if you choose to join the mailing list. There are no user accounts and no way to post anything.
What is collected
Three things, and nothing else:
- Your email address, if you submit it to the mailing list. Stored with the date, and a short label recording which form on the site it came from.
- Anonymous usage analytics. Page views, the referring site, approximate country, and device type. Not tied to a name or an account, because there are none.
- A rate-limiting fingerprint. When you use search, a keyed one-way hash of your IP address is stored briefly so one visitor cannot exhaust the service for everyone. The address itself is never written down, and the hash cannot be reversed to recover it.
What is NOT collected
Stated affirmatively, because these are the questions worth asking:
- No local storage. Crossbook does not use
localStorage,sessionStorage, or any browser-side database. Nothing is kept on your device. - No advertising or tracking cookies. The only cookies set are first-party session cookies, and only for the operator's own login. A visitor is never issued one.
- No IP addresses in logs. Server logs record errors. They do not record IP addresses or user agents.
- Nothing you type reaches a language model. The models Crossbook uses to write forecasts receive market titles, settlement rules and prices published by the venues. No visitor input is ever part of that.
- Search terms are not sent to analytics. Search queries appear in the page URL, and the query string is stripped before any analytics event leaves the browser.
- No sale of data, ever. There is nothing to sell and it is not for sale.
Cookies and storage
| What | Purpose | Lifetime |
|---|---|---|
__Host-authjs.csrf-token | Protects the operator's sign-in form. Set on any visit, used only by the login flow. | Session |
__Secure-authjs.callback-url | Returns the operator to the right page after signing in. | Session |
__Secure-authjs.session-token | The operator's own login. Only ever issued to the single allowlisted account. | 90 days |
| localStorage / sessionStorage | Not used at all. | — |
Who else is involved
These are the services Crossbook itself relies on. Each has its own privacy policy governing what it does with what it receives.
| Service | What it receives |
|---|---|
| Vercel (hosting, analytics) | Requests to the site, and anonymous page-view analytics with the query string removed. |
| Neon (database) | The mailing list, the forecast record, and hashed rate-limit keys. |
| Resend (email) | The address of anyone the mailing list is sent to. |
| GitHub | The operator's own sign-in. No visitor data. |
| Moonshot AI, Anthropic | Market titles, settlement rules and prices from the venues. No visitor data. |
| Kalshi, Polymarket, CoinGecko | Requests from Crossbook's servers for public market and price data. Your browser never contacts them and they receive nothing about you. |
Crossbook loads no external fonts, no advertising networks and no third-party embeds. Its content security policy blocks requests to any other origin outright.
How long it is kept
- Email address — until you unsubscribe. The row is then marked unsubscribed rather than deleted, so that a later re-import cannot silently put you back on a list you left. Ask and it will be deleted outright.
- Rate-limit hashes — swept roughly hourly, and never longer than that.
- Analytics — retained by Vercel under its own policy. Crossbook keeps no separate copy.
Your choices
Every mailing-list email carries a one-click unsubscribe link that works without signing in to anything. Beyond that, write to crossbookdetroit@gmail.com to ask what is held about you, to correct it, or to have it deleted. In practice the answer is your email address or nothing at all.
Children
Crossbook is not for anyone under 18 and does not knowingly collect anything from them. See the terms.
Where it is processed
Crossbook is operated from the United States and the services above process data there and in other countries. Using the site means accepting that.
Changes
This policy will change if the app does. Material changes move the date at the top of this page.
Contact
Crossbook (pending company formation) — crossbookdetroit@gmail.com.