PRIVACY POLICY

Last modified: Jul 6th 2026

- - -

At Cross Subject LLC ("Cross Subject") we take personal data protection seriously. We want you to know how we collect and use the data that you provide to us over the course of your use of our "Hide and Pic" mobile app ("App"). We encourage you to read this Privacy Policy as well as our Terms of Use (referred to throughout as our "Terms").

1. WHAT IS PERSONAL DATA AND OTHER RELATED TERMS USED IN THIS PRIVACY POLICY?

In this Privacy Policy we use the following terms:

• "personal data" ("personal information") with respect to EEA residents means any information relating to an identified or identifiable natural person ("data subject"); with respect to US residents personal data refers to any data that identifies, relates to, or could reasonably be linked to you or your household, directly or indirectly;
• "data subject" means a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

While using our App you are considered to be a data subject.

• "processing" means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
• "controller" means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by European Union or Member State law, the controller or the specific criteria for its nomination may be provided for by European Union or Member State law;

We are the controller of your personal data. You may find more information about us in Chapter 3 of this Privacy Policy.

• "processor" means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
• "third party" means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data;
• "consent" of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;
• "CCPA" refers to California Consumer Privacy Act as of 2018 with any further amendments;
• "GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
• "Business", for the purpose of the CCPA refers to the legal entity that collects consumers' personal information and determines the purposes and means of the processing of consumers' personal information, or on behalf of which such information is collected and that alone, or jointly with others, determines the purposes and means of the processing of consumers' personal information, that does business in the State of California;
• "Consumer", for the purpose of the CCPA means a natural person who is a California resident. A resident, as defined in the law, includes (1) every individual who is in the USA for other than a temporary or transitory purpose, and (2) every individual who is domiciled in the USA who is outside the USA for a temporary or transitory purpose.

2. WHAT KIND OF PERSONAL DATA DO WE COLLECT, WHY AND ON WHAT BASIS?

Please note that we don't collect any information from your gallery or camera. Pictures you take while using the App are kept on your device — we don't upload them to our servers, and we don't have access to them.

How can I provide my consent?

By accepting this Privacy Policy, you provide us with your consent to collect and process your personal data (whenever we use consent as a basis for collection/processing).

We may also use the following as a basis for collection/processing of your personal data:

• If our company is subject to a legal obligation by which a processing of personal data becomes necessary, such as for the fulfillment of tax obligations, the processing is based on Art. 6 I lit. c GDPR - processing is necessary for compliance with a legal obligation to which the controller is subject.
• Finally, processing operations could be based on Art. 6 I lit. f GDPR - processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Processing operations that are not covered by any of the aforementioned legal bases are based on this legal basis if the processing is necessary to protect a legitimate interest of our company or a third party, provided that the interests, fundamental rights and freedoms of the data subject are not overridden. Such processing operations are permitted to us in particular because they were specifically mentioned by the European legislator. In this respect, it took the view that a legitimate interest could be assumed if the data subject is a customer of the controller.

Our App is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe we have collected information from your child, please contact us. Use of the App by anyone under the age of 13 is prohibited.

3. WHO COLLECTS YOUR PERSONAL DATA?

The controller of the personal data within the meaning of the General Data Protection Regulation and the Business within the meaning of CCPA is:

Cross Subject LLC
City Business License: GENL-046406 (City of Pleasant Hill, CA)
Contact: support@crosssubject.com

If you have any questions, comments, or concerns about how we handle your Personal Data, then you may contact us through support@crosssubject.com.

You may always reach us by sending an electronic message to our email or via phone call. For any of these, you should use the contact information above.

4. HOW DO WE COLLECT YOUR PERSONAL DATA?

We begin collecting your personal data as soon as you confirm you are 13 years of age or older and start interacting with our App, even if you have not registered for an account. Specifically, we collect your data in the following ways:

• When you interact with our App, for instance by navigating between pages, using features, or when you register for an account.
• When you communicate with us

Please note that regardless of your email settings, we may send you messages pertaining to the performance of our App, such as a revision of our Terms or this Privacy Policy or other formal communications relating to the App.

• When we comply with Legal Requirements or Obligations, Law Enforcement, and for Public Safety Purposes

5. CAN WE SHARE YOUR PERSONAL DATA?

We may share your personal information in the following situations:

Operation and Improvement of App and User Experience

Internally by Cross Subject LLC to operate, maintain, and improve the App and user experience (e.g., analytics, debugging, security), and to conduct Cross Subject's own marketing and advertising.

Cross Subject LLC controls how personal data is processed. We do not authorize third parties to use personal data for their own purposes. We host and analyze telemetry using cloud providers acting only as our service providers (processors).

To Service Providers and Vendors

We may share anonymized or aggregated data with business partners, marketing partners, and vendors to provide, improve, and personalize the App. We do not share your personal data (such as your name, email, or IP address) with marketing partners. Any data shared with third parties is de-identified or aggregated so that it does not, on its own, reasonably identify you.

For Certain Analytics and Improvement

With certain companies for purposes of analytics and improvement of the App.

For Legal Compliance, Law Enforcement, and Public Safety Purposes

With law enforcement, government or regulatory bodies, lawful authorities, or other authorized third parties in order to comply with laws, regulations, court orders, or other legal obligations or to assist in an investigation, to protect and defend our rights and property, or the rights or safety of third parties, to enforce our Terms of Use, this Privacy Policy, or agreements with third parties, or for crime-prevention purposes.

In the event of an actual or contemplated sale.

With prospective or actual purchasers, investors, or successor entities in connection with a contemplated reorganization or an actual reorganization of our business, in connection with financing, a sale, or other transaction involving the disposal of all or part of our business or assets, including for the purpose of permitting the due diligence required to decide whether to proceed with a transaction, pursuant to assurances of sufficient data handling practices and safeguards.

Please note that in no case do we sell your personal data. As defined in the CCPA, "sell" and "sale" mean selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer's personal information by the business to a third party for valuable consideration.

If you are located outside of the United States, please be aware that personal data we collect will be processed and stored in the United States (the data protection and privacy laws in the United States may offer a lower level of protections than in your country/region).

By using our App and submitting your personal data, you agree to the transfer, storage, and/or processing of your personal data in the United States. Where and as required, we will seek your explicit consent as outlined in this Privacy Policy.

If we decide to transfer your data to other countries or international organizations, we will obtain your consent for the transfer to be made and we will take steps to ensure that your personal data continues to receive a standard of protection that is at least comparable to that provided under the applicable laws.

If you are EEA resident, we will transfer your data to another country (outside EEA) only if it is ensured that the recipient of the data guarantees an adequate level of data protection and that there are no other interests worthy of protection against the data transfer.

6. HOW LONG DO WE STORE YOUR PERSONAL DATA?

We delete your personal data as soon as it is no longer needed for the purposes pursued with the collection and processing and as far as no legal storage obligations stand in the way.

When you request deletion of your account and personal data, your account will enter a 48-hour grace period during which you may cancel the request. After that period, we will delete your personal data without undue delay, and in any event within 30 days, except where we are permitted or required to retain it (for example, residual copies in backups for a limited period, or to meet legal obligations).

We will retain and use your personal data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.

Please note that we may also retain anonymized versions of your personal data for our internal statistics and research purposes. Such anonymized data is not subject to the privacy commitments in this Policy, to the extent permitted by applicable law.

7. DATA COLLECTION AND ANALYTICS

We collect diagnostic and usage information to help us improve our App and provide better user experience. This includes technical data that helps us understand how the App performs and how users interact with it.

We use Microsoft Azure Application Insights to collect diagnostic information from the app, including crash logs, error reports, IP address, device OS version, device model, screen resolution, and other device characteristics. The user identifier allows us to correlate technical issues with specific user accounts for support purposes. This data is collected for analysis, issues tracking, troubleshooting, to see what features are in demand, and to improve user experience in future versions of the App. This data helps us identify and fix issues, improve app performance, and understand how users interact with our features.

The logging data will be uploaded to Azure Insights in Microsoft Azure portal while the app is running (in the background). Azure's privacy policy: Microsoft Azure Privacy.

8. WHAT ARE YOUR RIGHTS WITH RESPECT TO PROTECTION OF YOUR PERSONAL DATA?

Your rights concerning your personal data depend on the applicable law. Thus, this section is divided into 2 subsections for the residents of US and EEA respectively.

FOR US RESIDENTS:

• The right to notice. You have the right to be notified which categories of personal data are being collected and the purposes for which the personal data is being used.
• The right to request. Under CCPA, you have the right to request that we disclose information to you about our collection, use, sale, disclosure for business purposes and share of personal information. Once we receive and confirm your request, we will disclose to you:
  • The categories of personal information we collected about you
  • The categories of sources for the personal information we collected about you
  • Our business or commercial purpose for collecting or selling that personal information
  • The categories of third parties with whom we share that personal information
  • The specific pieces of personal information we collected about you
  • If we sold your personal information or disclosed your personal information for a business purpose, we will disclose to you the categories of personal information sold and the categories of personal information disclosed
• The right to delete Personal Data. You have the right to request the deletion of your Personal Data, subject to certain exceptions. Please note that since your personal data is essential for account functionality, exercising your right to deletion will also result in the permanent deletion of your account. Once we receive and confirm your request, we will delete (and direct our Service Providers to delete) your personal information from our records, unless an exception applies. We may deny your deletion request if retaining the information is necessary for us or our Service Providers to:
  • Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you.
  • Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
  • Debug products to identify and repair errors that impair existing intended functionality.
  • Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
  • Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et seq.).
  • Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information's deletion may likely render impossible or seriously impair the research's achievement, if you previously provided informed consent.
  • Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
  • Comply with a legal obligation.
  • Make other internal and lawful uses of that information that are compatible with the context in which you provided it
• The right not to be discriminated against. You have the right not to be discriminated against for exercising any of your consumer's rights, including by:
  • Denying goods or services to you
  • Charging different prices or rates for goods or services, including the use of discounts or other benefits or imposing penalties
  • Providing a different level or quality of goods or services to you
  • Suggesting that you will receive a different price or rate for goods or services or a different level or quality of goods or services

FOR EEA RESIDENTS:

• The right to be informed - that's an obligation on us to inform you how we use your personal data (and that's what we're doing in this Privacy Notice)
• Right of access - The Controller offers you access to your personal data we process. This means you can contact us and request from us a confirmation whether or not your personal data are being processed and if so, you have the right to request access to your data, which we will provide to you in the form of a so-called "registry" (stating, in particular, purposes, categories of personal data, categories of recipients of personal data, storage periods or criteria for determining storage periods).
• Right to rectification - You have the right to have inaccurate personal data we have stored about you rectified.
• Right to erasure - You may also ask us to erase your personal data from our systems. Please note that since your personal data is essential for account functionality, exercising your right to deletion will also result in the permanent deletion of your account. We will comply with such requests unless we have a legitimate ground to not delete your personal data.
• Right to restriction of processing - You may request us to restrict certain processing of your personal data. If you restrict certain processing of your personal data, this may lead to fewer possibilities to use our App.
• Right to data portability - You have the right to receive your personal data from us in a structured, commonly used and machine-readable format in order to transmit the personal data to another controller.
• Right to object - that's a right for you to object to us processing your personal data (for example, if you object to us processing your data for direct marketing).
• Rights in relation to automated decision-making and profiling - that's a right you have for us to be transparent about any profiling we do, or any automated decision-making.
• Right to withdraw Consent — that's the right to revoke any consent you may have previously given us at any time, if we have collected and processed your personal information with your consent. Withdrawing your consent will not affect the lawfulness of any processing we conducted with your consent prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent.

How to use your rights - You may exercise your rights above in writing by sending an email to the contact details in How to Contact Us. To request account and data deletion, you may use the option within the App, visit our dedicated page at https://crosssubject.com/account-deletion, or email us directly. You will not have to pay a fee to exercise any of your rights unless your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances. We may require confirmation of your identity depending on your request. We respond to all requests we receive from individuals wishing to exercise their data rights in accordance with applicable data protection laws.

9. CAN THIS PRIVACY POLICY BE AMENDED?

Yes.

We may amend this Privacy Policy from time to time. The new version will come into force upon its publishing in our app. You may always find out whether our privacy policy was amended by checking the "last modified" legend on the top of the page.