Privacy policy

Who this covers

Evolution is an invite-only alpha operated by Tsvi Daphna under the Crossroads brand. This policy describes the information Evolution uses when you visit the site, sign in, or use the app. Questions about privacy can be sent to tsvi@crossroadsui.com.

Information we use

• Sign-in and access: your invited email address, verified email, name and profile image when provided by Google, the provider account identifier, and sign-in credentials and sessions. Google sign-in requests only the openid, email, and profile scopes. If you sign in by email instead, Evolution keeps a one-way hash of the password you set and, until it is used or expires, a hash of each sign-in link it sends you; neither can be turned back into the password or the link.
• What you create: seeds, options, tasks, reflections, Companion cards, Personal Map and Compass entries, and the choices you make about how Evolution may use them.
• Operating data: consent choices and content-free usage events such as counts, status, timing, and estimated AI cost. These events do not contain the words you wrote in a seed, task, or reflection.

How we use it

We use sign-in data to check invitations and maintain your account. We use what you create to show your work back to you, support the reflection and planning flow, and produce guidance you request. Operating data helps us keep the alpha working, enforce usage limits, and understand failures and provider cost. Evolution does not run a third-party analytics product or a cross-user learning system.

Optional external AI

If you grant external AI processing consent, text needed for a seed reflection, task draft, or Companion card may be sent to Anthropic for that request. The app screens each field before sending it. You can withdraw consent in Settings, under Privacy and data; without it, Evolution uses limited fixed templates instead. A separate anonymous-aggregation choice is available, but no cross-user aggregation is currently built.

Where information is processed

Google provides Google sign-in, and Resend delivers email sign-in links to the address you enter. When you choose a password, Have I Been Pwned is asked whether it has appeared in a known breach; it receives only the first five characters of a one-way hash of the password, never the password or your address. Cloudflare serves the app, Neon hosts its database, and Anthropic processes only requests you have allowed through the external AI choice. These providers handle data under their own terms. Request metadata, such as paths and status codes, may appear in operational logs; your authored content is not placed in those logs.

Storage and protection

Your authored content and stored OAuth tokens are encrypted at the application layer. The server holds the encryption key so it can show your content to you; this is protection at rest, not end-to-end encryption. Session cookies keep you signed in. Browser storage can hold an unsent draft or a local preference, which does not move automatically to another domain or device.

Retention and your controls

What you create stays until you remove it where the app offers removal or delete your account. When signed in, Privacy and data in Settings lets you export your data as JSON or delete your account and its content. An invitation linked to a deleted account remains for 30 days so you can return, then is removed. Neon's database restore history can retain deleted data for up to 30 days. Copies already downloaded by you and information processed by a provider under its own retention terms are outside that deletion.

Contact

For privacy questions or requests you cannot complete in Privacy and data, email tsvi@crossroadsui.com. For general questions, email info@crossroadsui.com.