Privacy notice
What the website and the waitlist collect, and what is still undecided.
This notice covers the Crossbox website and its waitlist. It does not cover the private application, which is not open to the public yet.
Notice version 2026-10-11.2
What this notice covers
The pages of this website, and the form that adds you to the Crossbox waitlist. It does not describe what the private application does with data; the Trust page does that.
What the waitlist collects
When you join the waitlist, these are stored. Only the email address is required.
- Your email address, tidied so the same address is recognised twice: spaces trimmed and letters lower-cased.
- Your name, only if you choose to give one (up to 100 characters).
- What you would use Crossbox for, only if you choose to say (up to 500 characters).
- The page you joined from, such as the overview or the pricing page.
- The version of this notice you acknowledged when you joined.
- The time the entry was added.
What is not stored
The waitlist does not store your network address. To limit repeated or abusive submissions, the server turns it into a keyed hash and keeps that hash in short-lived counters. A counter older than a day is deleted the next time someone joins, so one can outlast a day if nobody joins. The hash is used for nothing else.
The website uses no analytics and no advertising trackers.
Not decided yet
The website is delivered through Vercel, whose own request logs may record your network address. This notice does not describe that handling, because it has not been reviewed here.
Why it is collected
To keep a list of people interested in Crossbox, to understand who is interested and what they would use it for (from the optional name and note), to recognise a repeated address as the same entry, to limit abuse of the form, and to know which version of this notice each person acknowledged.
The name and the note are plain text and are not shown anywhere on the website. If the same email address joins again, the earlier entry is kept exactly as it was.
Submitting the form does not send you an email.
Where it is stored
On the server side, in a PostgreSQL database hosted by Supabase. The form is handled by the website's server code; your browser does not talk to the database.
The database is in the Sydney, Australia region (Supabase: Oceania).
Who can see it
The list is not public, and there is no page or interface that shows it. Entries are written only by the website's server code, through one database function, and the database has no public read access.
One account administers the database project at the time of this notice. The hosting and database providers' own staff access is governed by their terms, which this notice does not describe.
The provider secret the server uses has authority over the whole project; this notice does not claim it is limited to the waitlist.
How long it is kept
Nothing deletes a waitlist entry automatically today.
Not decided yet
A retention period has not been decided.
Asking for your entry to be removed
There is no verified contact address for Crossbox yet, so there is no route on this page for a deletion request. The Contact page says what is and is not published.
Not decided yet
A deletion process, and the contact that would receive such a request, are not decided or published.
This notice
This is version 2026-10-11.2. Each waitlist entry records the version it acknowledged.