Privacy Policy · Crosscheck

Version 2026-11. This policy takes effect on 16 October 2026.

This Privacy Policy explains how GJU Software LLC, a Florida limited liability company doing business as Crosscheck ("Crosscheck," "we," "us" or "our"), collects, uses, shares and protects personal information when you use crosscheckmed.com, Crosscheck's account features, the Crosscheck app for iPhone and iPad, the Crosscheck Fill-in browser extension, and the emails and texts we send (together, the "Service"). It also explains the choices and rights you have. If anything in it is unclear, email privacy@crosscheckmed.com.

This policy describes our practices. It is not a contract and it is not part of our Terms of Use. When you create an account, you confirm that you have read it.

Your health information is also covered by our Consumer Health Data Privacy Policy, which describes the consent you give for it and your rights over it. Where the two documents differ about consumer health data, the Consumer Health Data Privacy Policy applies.

1. The short version

The general tools, such as Check a medication, Check a condition and Find an examiner, work without an account, and we do not keep what you search for in them beyond the short-term service logs in Section 3.2.
If you create an account, we hold your email address, your password (stored only as a one-way hash), your mobile number, which two-step sign-in requires on Plus and Pro and while records from a paid plan are kept, and your plan.
Your records are encrypted on your device before they are stored, and they are not available to Crosscheck staff through normal support or administrative tools. Section 6 explains this, including its limits.
A few things must be readable on our systems for a feature to work, such as the date of a reminder so that we can send it, and a review you choose to publish. Each is listed in this policy.
We do not sell personal information, use it for targeted advertising, or use it to train artificial intelligence models. We never use health information for advertising or marketing.
Wherever you live, you can see, export, correct and delete your information, and withdraw your consent (Section 17).

2. Who we are and how to contact us

GJU Software LLC, doing business as Crosscheck, 7901 4th St N #36361, St. Petersburg, FL 33702, USA. Telephone: (954) 569-6920. Privacy questions and requests: privacy@crosscheckmed.com. Other help: support@crosscheckmed.com. Security reports: security@crosscheckmed.com.

Crosscheck is not affiliated with or endorsed by the Federal Aviation Administration (FAA).

3. The information we collect

3.1 Information you give us

Information	When	Why	Where it is kept, and how
Your email address and password	When you create an account	Signing you in, account notices, helping you recover your account	Our database host. The password is kept only as a one-way hash; we do not store or log the password itself
If you sign in with Apple or Google: the email address it gives us (with Apple, this can be a private address that forwards to you), and that your Apple or Google account is linked to your Crosscheck account	When you choose Continue with Apple or Continue with Google	Signing you in, account notices, helping you recover your account	Our database host
Your mobile number	When you set up two-step sign-in, or change your phone in Account & privacy	Texting you sign-in codes; checking whether the number can get reminder texts; reminder texts if you turn them on (Section 7)	Our database host, and our messaging provider for delivery
Your records: your certificate class, exam dates, limitations and special-issuance details; doctor visits; medications; conditions and checklists; exam-prep progress; your own dates and the reminders you set on them; saved examiners; Certification Assistant plans; FAA letters you add and the lines you keep from them; and documents you add	When you use My records	Keeping and showing your records, working out your dates, and the features you use	Our database host, encrypted on your device before it is sent (Section 6). Document files are kept, encrypted, in our database host's private file storage
Your MedXPress profile, if you keep one: the certificate and class you are applying for; your name suffix, address and telephone number; date of birth, citizenship, sex, and hair and eye color; certificates held, occupation, employer and flight time; whether an FAA medical certificate was ever denied, suspended or revoked, and when; the date of your last FAA medical application; and your own answers to MedXPress's questions about medication, contact lenses, visits to health professionals and medical history, including those about arrests and convictions, with your comments; and, after you submit, your MedXPress confirmation number and its dates	Only if you fill in My MedXPress Profile, or Crosscheck Fill-in brings back your confirmation number	Keeping your own answers for your MedXPress application, and filling it in when you ask (Section 8)	Our database host, encrypted
Reminder details: the day and time to send, the date it is about, whether it comes by email or text, when it was set and changed, your reminder time zone and delivery status, and for your automatic medical reminder your medical class	For a reminder you set, and for your automatic medical reminder once you add your medical details, unless you turn it off	Sending the reminder email, and the reminder text if you chose one	Our database host, in readable form. What any other reminder is for stays encrypted in your records
Whether each encrypted record belongs to a paid area of Crosscheck, which encrypted items are documents, how many documents you hold and how much storage they use, and when each encrypted item was last changed (never what a record says)	When you save a record or add a document	Making the features of your plan work, keeping your devices in step, and applying your plan's storage limit	Our database host, in readable form
A review of an aviation medical examiner: your rating, your words, the price you paid and whether that included an EKG, the class of exam and the month of your visit	Only if you write one on Find an examiner	Publishing it for other pilots, and working out typical prices (Section 9)	Our database host, in readable form, with your account attached so that you can change it or take it down
Your plan: which plan, monthly or yearly, its status and renewal date, and our payment processor's reference numbers for you	When you choose a paid plan	Billing, and making your plan's features work	Our database host. Your card details go to our payment processor on its own page (Section 10)
Your agreements and choices: which of our documents you accepted, the version, the exact words of each box you ticked, and when; your choices about marketing emails and news and updates; your agreement to reminder texts; and your agreement to a paid plan's automatic renewal	When you make them	Doing what you chose, and being able to show what you agreed to	Our database host. Section 15 says how long each is kept
Messages you send us	When you email us, or write on the Contact page	Answering you	Our support mailbox provider
Information you give us with a privacy request	When you make one	Answering it, and keeping a record of it	Our support mailbox provider

3.2 Information collected automatically

We do not use advertising trackers, social-media embeds, session-replay tools, fingerprinting, or any other tool that tracks your behavior across other sites. What is collected automatically is limited to what running and protecting the Service needs:

Sign-in records. Our account service records your signed-in sessions and your sign-ins, with the time, your IP address and your browser's description.
Security logs related to access to your records. We maintain security logs related to access to your records for security and incident-response purposes. They hold details such as the time, the type of browser and the reason, and nothing you stored.
Service logs. Our hosting provider and our database host keep short-term technical logs of requests to the Service, such as the time, the address of the request, the page or function requested, whether it succeeded and how long it took. Some also include your IP address and browser type, and for some requests your account's internal identifier. They do not include the contents of your records or your password.
Error reports. If a page or an app screen breaks, your browser or the Crosscheck app sends us a short note of what broke and on which page or screen, with your browser type, or the app's version and that it is the iOS app. It is designed to remove personal details before it is sent and to leave out the contents of a page, what you typed and your account.
Visits to our public pages. On the public pages of our website, such as the home page, the FAA guide and Check a medication, we use Cloudflare Web Analytics to count page visits and measure how quickly pages load. Cloudflare describes it as not using cookies and not tracking you across sites. It is not used on the sign-in pages, in your account area or in your records, and we do not send it your account or anything you store.
Map requests. When you move the examiner map, your browser asks our site for the map images of that area, as any web map does.
Rate limits. To stop abuse, our hosting provider counts some requests, such as messages sent from the Contact page, by IP address. We do not store those counts.

3.2A In the Crosscheck app for iPhone and iPad

The Crosscheck app uses the same account and the same encrypted records as our website. What is different on a phone or tablet:

Your records. They are decrypted only in the app's memory while you are signed in, and they are not stored readable on the device, except a copy you choose to export or download, which is kept only until the share sheet closes.
Staying signed in. The app keeps your sign-in on the device, in a sealed file whose key is kept in the device's Keychain for this device only, so a backup or a copied file cannot open it. It also keeps the time of your last activity. Fifteen minutes without activity sign you out. If you turn on Sign in with Face ID, those fifteen minutes lock the app instead, and Face ID opens it again; your password, and a texted code if your account uses one, are asked again at least every 30 days. Face ID is handled by your device: Crosscheck never receives your face data or fingerprint.
Documents you add. When you scan a page, take a photo, or choose a photo or file, only what you pick reaches the app. A readable copy is kept in the app's temporary storage only until it is encrypted and sent, or until you leave the screen, and is then deleted; any copy left by an app that closed early is deleted the next time Crosscheck opens or your records lock. A PDF or a large picture you are reading is a short-lived file, deleted when you close it.
Reminder alerts. If you turn them on, your device shows your reminders as its own alerts. The device schedules them from the reminders already in your account; an alert names only the date, and nothing more is sent to anyone.
Near me. If you ask for examiners near you, the app asks your device for your approximate location. Your location itself is not sent to Crosscheck. To draw the map, the app then loads the map of the area around you from our site.
Choices kept on the device. The app's appearance (light or dark), whether reminder alerts are on, and, only if you tick Remember my email, the email address you sign in with.
The MedXPress window. The app can open the FAA's MedXPress site in a window of its own and fill in your application there, in the same way as Crosscheck Fill-in (Section 8). What you type there goes to MedXPress. The window keeps no MedXPress sign-in, cache or form data after it closes, and the answers it fills are forgotten when it closes or the app locks.
App updates. Each time it opens, the app asks Expo, the service that delivers updates to the app's screens, whether a newer version is available. Expo receives the request's IP address, the app's version and update channel, the device's platform (iOS), a random identifier the update software creates for this installation, and, if an update made the app close with an error, a short description of that error. It receives nothing from your account or your records.
Error reports. The app sends the same short, scrubbed error notes as our website (Section 3.2).

3.3 Sensitive information

Much of what you can store in Crosscheck is sensitive: health information (including reproductive or sexual health information, if you enter any); citizenship; date of birth; answers about arrests and convictions; and your sign-in details. We collect it only to provide the features you use, with your consent where the law requires it (the Consumer Health Data Privacy Policy explains that consent).

3.4 Information we do not collect

We do not collect your precise location, your contacts, photos other than documents you choose to add, biometric information, or information from health platforms such as Apple Health or Google Health Connect. We do not ask users of the Service for, and do not want, your Social Security number.

4. Where information comes from

You, when you enter it, add a document or send us a message.
Your own browser, which works out dates from the details you enter, such as when each class of your medical certificate ends, and the class and date for your automatic medical reminder.
The FAA's MedXPress page, through Crosscheck Fill-in or the app's MedXPress window: after you submit your application while Fill-in is running, it reads your MedXPress confirmation number and its dates from MedXPress's page (Section 8).
Our payment processor, which tells us your plan, its status and renewal date, and whether a payment succeeded.
Apple, if you buy a plan in the Crosscheck app, which tells us the purchase, its plan, dates and status, whether it will renew, and its reference numbers (Section 10).
Our messaging provider, which tells us whether a text was delivered, passes on your replies to our reminder number (such as STOP, START and HELP), tells us which country your sign-in phone number belongs to, and provides a daily list of U.S. numbers that mobile carriers report as disconnected (Section 7).
Our email delivery provider, which tells us when someone unsubscribes from marketing emails or news and updates using the link in one of those emails.
Apple or Google, if you choose to sign in with them, which tell us the email address on your account with them and confirm that it is you.
Our account service, which records sign-ins.

We do not obtain information about you from data brokers, advertisers, health care providers, insurers or health platforms.

5. How we use information

We use personal information only for these purposes:

Providing the Service you asked for: your account, your records on every device where you sign in, your documents and your exports
Working out your dates, and sending your automatic medical reminder unless you turn it off and the other reminders you set, by email and, if you choose, by text
Running Crosscheck Fill-in and the Certification Assistant when you use them
Publishing reviews you choose to publish, and working out typical prices
Sign-in, security, fraud prevention, and keeping the Service working
Billing, receipts and the notices about your plan's renewal and price
Answering your messages and requests, including support-assisted account recovery
Sending account notices, such as password, security and plan notices and notices of changes to this policy
Sending marketing emails and news and updates, only if you choose them
Keeping proof of what you agreed to and consented to
Meeting our legal obligations, enforcing our Terms of Use, and establishing or defending legal claims

If you choose to receive marketing emails or news and updates from Crosscheck, we use your email address to send them through our email delivery provider. You can unsubscribe at any time, using the link in any of those emails or in Settings and my data. These emails are never chosen or written from your records.

Apart from the marketing emails and news and updates you choose to receive, we do not use your information for advertising, and we do not use it for profiling or for automated decisions that produce legal or similarly significant effects about you.

If we want to use personal information for a purpose that is not reasonably necessary for, or compatible with, the purposes above, we will ask for your consent first.

6. Your health information and My records

My records is the part of Crosscheck where you keep your own medical information. It holds nothing until you write something in it. What you write is encrypted on your device before it is sent, and our database host stores the encrypted result, together with encrypted information needed to securely access and recover your records. Your records become available only after you sign in, and in normal operation they are decrypted only in the open tab or the open Crosscheck app. They are cleared from the tab when you sign out, close it, or leave it untouched for 15 minutes, and on our website those 15 minutes also sign you out, so getting back in takes your password again. In the Crosscheck app, if you turn on Sign in with Face ID, those 15 minutes lock the app instead and Face ID opens it again (Section 3.2A). Nothing readable from your records is kept in your browser's storage, or in the app's except as Section 3.2A describes.

Crosscheck operates the systems used to provide the Service, so we do not represent that technical access to user records is impossible. Crosscheck does not provide staff with a routine interface for viewing readable user records, and accessing user records is not part of normal staff operations. We maintain security logs related to access to your records for security and incident-response purposes.

Some information has to be readable on our systems for a feature to work, and we keep it to what that feature needs:

reminder details, including the medical class named by your automatic medical reminder (Section 7);
whether each encrypted record belongs to a paid area of Crosscheck, which encrypted items are documents, how many documents you hold and how much storage they use, and when each encrypted item was last changed, none of which says what a record contains;
reviews you write, which are written to be published (Section 9); and
your account, plan and agreement details (Section 3.1).

When you add an FAA letter, the Certification Assistant reads it on your own device. A submission packet is also built on your device.

If Crosscheck ever needs to re-encrypt your records under a new key for security reasons, your own browser does the work the next time you sign in. Your records can be unavailable until it finishes, and any item that cannot be moved is kept aside, still encrypted, for 90 days and then deleted.

7. Reminders by email and text

Reminder emails. If you set a reminder, its email says that an important Crosscheck date is coming up and gives that date. It does not say what the date is for or include condition or document names. Your automatic medical reminder is an email on the 1st of the month your medical privileges end, worked out from your medical details; it names your medical class and the date those privileges end, and you can turn it off in Settings and my data. It is set while your records are open, after you add or change your medical details, and only if that 1st of the month is still ahead then. To send reminders, we store in readable form the day and time to send, the date it is about, whether it comes by email or text, when it was set and changed, your reminder time zone and delivery status, and for your automatic medical reminder your medical class. What any other reminder is for stays encrypted in your records.

Reminder texts are optional and start off. They are part of the paid plans. You turn them on in Settings and my data by ticking a box that starts empty, and Crosscheck works the same without them. They go only to the phone you sign in with, and only if it is a number in the United States, Puerto Rico, the U.S. Virgin Islands, Guam or American Samoa. To check that, when you open Settings and my data and we have not yet checked your sign-in phone, we ask our messaging provider which country the number belongs to, and we keep its answer while that number is your sign-in phone. Changing your phone number turns reminder texts off.

What the texts say. After one text confirming that they are on, reminder texts come only on a day and at a time you set a reminder to come by text, in your reminder time zone. Each one says that you have an upcoming Crosscheck date, gives that date, and asks you to sign in at crosscheckmed.com to review the details. Like the email, it does not say what the date is for. Message frequency varies with the reminders you set. Message and data rates may apply. Reply STOP to end reminder texts, or HELP for help. We answer STOP, START and HELP with one text each. If you turn texts off in Settings and my data or through support, you may get one last text saying they are off. Your sign-in codes come from a different number.

When texts end. Reminder texts end when you reply STOP, turn them off in Settings and my data, or ask support to turn them off. They can also end on our side, for example when your sign-in phone changes or is removed, or when your number appears on the list described next. If a text cannot be sent because reminder texts are off or your number changed, a reminder you set to come by text only comes to your account email instead. Texting START, YES or UNSTOP to our reminder number lets it text you again, but reminder texts come back only when you turn them on again in Settings and my data.

Disconnected numbers. Once a day, we check the numbers that have reminder texts on against a list, from our messaging provider, of U.S. numbers that mobile carriers report as disconnected. A carrier can give a disconnected number to someone else, and a number moved to another carrier can be on the list too. If your number is on it, your reminder texts end, and you can turn them on again in Settings and my data. We do not keep the list.

Proof of your agreement. When you turn texts on, we record the phone number, the version of the words you agreed to, and when and how you agreed. When texts end, we record when and why. That record stays with your account until your account is deleted, or until four years after the texts end if that comes first. A proof with the same details, but not your account, is kept for four years after the texts end, even if you delete your account sooner, and is then deleted. It holds nothing about your health or your reminders, and no IP address or browser details. We keep it so that we can show that you agreed to the texts if our messaging provider or a mobile carrier asks for proof, or if we need it for a legal claim.

What our messaging provider receives. To send a text, our messaging provider receives your number and the words of the text; a reminder text includes the date. Your mobile carrier then carries the text to your phone. Our messaging provider also receives the replies you text to our reminder number. We do not store the words of your replies. The provider keeps its own record of each text and reply, with the number, the words and the delivery status, and it may keep a record of each country check. Under its default settings, which we have not changed, it keeps the records of texts and replies with no fixed end date. If you reply STOP, the provider keeps your number on its list of numbers our reminder number may not text, until you text START, YES or UNSTOP to that number.

Your mobile information is not shared for marketing. We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. We do not share, sell, or provide your mobile phone number or messaging consent data to third parties or affiliates for marketing or promotional purposes. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. The service providers in Section 12 receive it only to run the texts for us: for example, our messaging provider receives your number to send our texts and to check its country. Apart from them, we do not share your text-message opt-in data or consent with any third party, except to show that you agreed when our messaging provider or a mobile carrier asks, when we need it for a legal claim, or when the law requires it. Your agreement covers Crosscheck reminder texts only, and it does not let anyone else text you.

8. Crosscheck Fill-in

When you press Start filling MedXPress, your answers for your MedXPress application pass through Crosscheck Fill-in into its pages. Crosscheck Fill-in is an optional browser extension made by Crosscheck.

When it runs. Only after you press Start filling MedXPress and confirm once in its own window. It fills each page of your own MedXPress application from General to Medical Visits, and stops when it reaches Declarations, when you press Stop, or after 60 minutes. If no MedXPress tab is open, it opens one.
What it holds. When you press Start, Crosscheck gives Fill-in the answers for this fill. Fill-in keeps them only in memory while it fills, never saves them, and erases them when it stops. It doesn't save what it types. It stores only the date you agreed to its notice.
What it sends to the FAA. For each medication or visit it presses MedXPress's Add button, which saves that entry to your application. On Medical History it clicks each Yes you chose, which sends that page, and types your explanation. After each page it presses MedXPress's Next, which sends that page. If MedXPress goes back to its home page, it opens your application again and presses MedXPress's own Next through the pages already filled to bring you back to where you were.
What it never does. It never signs or submits your application. It leaves your Social Security number, your declaration, Submit and every other MedXPress button to you.
What it tells Crosscheck. It makes no internet connections of its own, and it sends nothing to Crosscheck's systems itself. It tells the Crosscheck page open in your browser which boxes it filled and, after you submit, your MedXPress confirmation number and its dates, which that page keeps with your records.

Fill-in can reach only the FAA's MedXPress site, and only Crosscheck's own site can send it a request. Fill-in uses the information it handles only to fill in your own MedXPress application and to bring back your confirmation number. It is not used for advertising, sold, or given to anyone else, and Crosscheck staff have no routine way to read it. Crosscheck Fill-in's use of information it receives adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

If you install Fill-in from the Chrome Web Store or Apple's App Store, Google or Apple processes information about that download under its own privacy policy. On Apple devices, Fill-in does not store your information in iCloud.

9. Reviews of examiners, and information about examiners

Writing a review is your choice. On Find an examiner you can review an aviation medical examiner you have visited. Nothing in the Service asks you for a review, and nothing works differently if you never write one. Before you send a review, we ask you to agree to its publication.

What we publish. Your rating, your words, the price you paid and whether that included an EKG, the class of exam, and the month of your visit. A published review carries no name, initials, handle, account identifier or exact date, and nothing on the published page connects two reviews to the same person. We publicly commit not to attempt to re-identify anyone from a review.

What we can read. A review is written to be published, so it is not encrypted the way your records are. We can read it, and we read every one, because no review appears on the Service until we have. Your review is stored with your account, for two reasons: so that you can change it or take it down, and so that we can stop someone who is abusing the Service. Our own moderation screens show a random tag in place of who wrote it, so that a member of staff can see that one person wrote several reviews without seeing who.

Typical prices. An examiner's typical price is shown only once at least three pilots have reported a price, so that no single visit stands for all of them.

Taking a review down. You can take your review down at any time from that examiner's page. It is removed from the Service straight away, although a copy already loaded in someone's browser can take a few minutes to update. We keep its text, marked as removed, so that we can answer a question about it later, and it is deleted with your account.

Information about examiners. Find an examiner shows examiners' names, practice addresses and contact details from the FAA's public list of aviation medical examiners, together with pilots' reviews and typical prices. An examiner who wants something corrected can write to support@crosscheckmed.com.

10. Payments

You pay on our payment processor Stripe's own page, never on ours. Stripe receives your email address, an account number that links the payment to your Crosscheck account, the plan you chose, any promotion code applied, and the card details and billing address you enter on its page. A code an examiner gave you may name that examiner, so the code sent with your payment can show which examiner referred you. Stripe receives nothing from your records. We never receive your full card number. Stripe tells us your plan, its status and renewal date, and its own reference numbers for you.

Stripe processes this information to take payments for us, and it also uses payment information for its own purposes, such as preventing fraud and meeting financial regulations, under its own privacy policy. Stripe keeps its own payment records after you delete your Crosscheck account, as its own policy and the law require.

If you arrive with a promotion code, such as one from an examiner's link, our site keeps the code in your browser (Section 14) and asks Stripe, from our own systems, what the code is worth. Only the code's text is sent, not anything about you. We log only whether the code was valid and how long the check took.

When you buy a plan, we keep a record of your agreement to its automatic renewal: the plan, the price, the exact words you agreed to and when (Section 15).

Plans bought in the Crosscheck app. If you buy a plan in the app, Apple takes the payment through its App Store, under Apple's own terms and privacy policy, and Stripe is not involved. Before the purchase, our server gives the app a random token for your account, which Apple carries with the purchase so that Apple's messages about it name your Crosscheck account without Apple ever receiving your email address or our identifiers for you. From Apple we receive the purchase as Apple signs it: the plan, its dates and status, whether it is a test purchase, Apple's own reference numbers for it, and that token. Apple receives nothing from your records. We keep these purchase records as Section 15 describes for paid-plan records.

11. Emails we send

We send account and service emails, such as sign-in and security notices, notices about your records (including the warnings before the records of an ended paid plan are deleted), reminders, renewal and price notices, and notices of changes to our documents. These are part of the Service. Marketing emails, and news and updates, are sent only if you choose them (Section 5). Our emails do not use open tracking or click tracking.

12. Who receives your information

We do not sell personal information. We share it only as this section describes.

Our service providers. These companies run parts of the Service for us:

Provider	What it does for us	What it receives
Supabase (database host, account service and file storage)	Stores your account and your encrypted records and documents, signs you in, runs our server functions, and sends sign-in codes through our messaging provider	Account details, your encrypted records and document files, reminder details, reviews, plan details, your agreements and choices, sign-in records and service logs. Stores them in the United States
Cloudflare (our hosting provider)	Serves the site, protects access to your records, stores the map images, applies rate limits, keeps service logs and error reports, and counts visits to our public pages (Cloudflare Web Analytics)	Requests to our site, including IP address and browser type; on our public pages, the page visited and how it loaded; security credentials used to protect access to your records; service logs; error reports. Serves pages from locations near you, which may be outside the United States
Stripe (payment processor)	Takes payments, sends receipts, handles renewals and cancellations, and checks promotion codes	Your email address, an account number linking the payment to your account, your plan, any promotion code, and the card details and billing address you enter on its page. Stripe also uses payment information for its own purposes under its own privacy policy (Section 10)
Resend (email delivery provider)	Sends account notices, security notices, reminders and plan emails, and the marketing emails and news and updates you choose; delivers messages you write on the Contact page to our support mailbox	Your email address and the message. If you choose marketing emails or news and updates, your address and which of them you chose, until you unsubscribe or turn them off (both, if you chose both) or delete your account. It currently keeps email and log data for 30 days under its retention policy
Twilio (messaging provider)	Sends sign-in codes, and reminder texts if you turn them on; checks which country your number belongs to; provides the daily list of disconnected numbers	Your mobile number, the codes and texts we send you (a reminder text gives the date) and the replies you send to our reminder number (Section 7)
Expo (app update delivery)	Delivers updates to the screens of the Crosscheck app for iPhone and iPad	The request's IP address, the app's version and update channel, the device's platform, and a random identifier for the app's installation (Section 3.2A). Nothing from your account or records
Zoho (support mailbox provider)	Hosts support@, privacy@ and security@crosscheckmed.com	Messages you send to those addresses or through the Contact page, and our replies
Northwest Registered Agent (mail-handling provider)	Receives the post sent to our postal address and scans it for us	What you send us by post, such as a letter or a request

Each of these providers processes personal information to provide its services to us, apart from Stripe's own uses described in Section 10.

Others who may receive information.

The public, when you choose to publish a review, which carries no name (Section 9).
The FAA, when you send it something yourself, and when Crosscheck Fill-in presses MedXPress's Add, Yes or Next at your instruction, which sends those pages (Section 8). Crosscheck sends nothing else to the FAA.
Apple or Google, if you choose to sign in with them. You sign in on Apple's or Google's own page or sign-in sheet, so they learn that you are signing in to Crosscheck. They receive nothing from your records, and they use what they learn under their own privacy policies.
Your mobile carrier, which carries texts to your phone.
App stores, if you install Crosscheck Fill-in or the Crosscheck app from one (Section 8). Apple learns that you installed the app, and, if you buy a plan in the app, takes the payment (Section 10).
A person who sent us a copyright notice, who receives a copy of any counter-notice you send, including your name and contact details (Terms of Use, Section 24).
When the law requires it. We disclose information when we believe in good faith that the law requires it, such as a valid subpoena, court order or warrant, and then only what is required. We will tell you first unless the law prohibits it or there is an emergency involving a risk of death or serious physical injury to someone.
If our business changes hands. If GJU Software LLC is involved in a merger, acquisition, reorganization, bankruptcy or sale of all or part of its business, personal information may be transferred as part of it. The new owner must handle it as this policy describes, and we will tell you before your information becomes subject to a different privacy policy. Your agreement to reminder texts covers Crosscheck reminder texts only, and it does not let anyone else text you.
With your consent, for anything else.

Affiliates. We have no affiliates, and we share nothing with any affiliate.

13. What we do not do

We do not sell personal information, and we have not sold any in the last 12 months.
We do not share personal information for cross-context behavioral advertising, use it for targeted advertising, or use it for profiling in furtherance of decisions that produce legal or similarly significant effects.
We never use health information for advertising or marketing, and we never choose who receives a marketing email, or news and updates, based on health information.
We do not sell consumer health data, and we will not sell it without your separate, signed authorization.
We do not use a geofence around any place where health care is provided, or anywhere else, and we do not collect precise location.
We do not use personal information to train artificial intelligence models, including large language models, and we do not give it to anyone else to do so.
We do not allow third parties to collect personal information about your activity on the Service over time or across other websites.
We do not disclose personal information to third parties for their own direct marketing.

Global Privacy Control and Do Not Track. We do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising or profiling, so a Global Privacy Control or Do Not Track signal has nothing to switch off. If that changes, we will treat a Global Privacy Control signal as a valid request to opt out.

14. Cookies and browser storage

Crosscheck keeps only these items in your browser:

Item	What it holds	How long
Your sign-in session (browser storage)	The tokens that keep you signed in, and your account's basic details, such as your email address	Until you sign out. After 15 minutes without activity it is refused and removed
Your last activity (browser storage)	The time of your last action, as a number	As long as your sign-in session
Failed attempts (tab storage)	How many recent sign-in or password attempts failed, and when	Until the tab closes, and forgotten after 10 quiet minutes
A promotion code you brought (browser storage)	The code's text	Until you pay or remove it, or the code turns out not to work
Crosscheck Fill-in's storage	The date you agreed to Fill-in's notice	Until you remove Fill-in

None of these holds your records, your password or any health information. The Crosscheck app for iPhone and iPad keeps its own short list on the device, described in Section 3.2A; it too holds no records, no password and no health information. We set no other cookies. Our hosting provider can set a strictly necessary security cookie of its own when its protections need one. We use no advertising or analytics cookies.

15. How long we keep information

We keep personal information only as long as the purpose it was collected for needs, or as the law requires. Then we delete it.

Information	How long we keep it
Your account (email address, password hash, mobile number, profile and plan)	Until you delete your account; then deleted at once
Your records, including documents' details	While you keep them. Deleted at once when you delete your account. With Delete my records, kept for 30 days so that you can undo it, and used for nothing else, then deleted at the next daily clean-up; sooner if you ask (Section 16). When a paid plan ends for good, the records in the areas that belong to paid plans are kept read-only for 12 months and then deleted, with emails 60, 30 and 7 days before naming the date (Terms of Use, Section 13.3)
A single record you delete	Removed at once. An encrypted marker showing it was deleted is kept for up to 90 days so that your other devices can catch up
Document files	Deleted at the next daily clean-up of stored files after you delete the document or your account, once the 30 days of Delete my records or Start fresh end, or once the 12 months after a paid plan ends run out
Your previous records after Start fresh	30 days, so that you can bring them back; then deleted
Items set aside during a security re-encryption (Section 6)	90 days, still encrypted; then deleted
Reminder details (the day and time to send, the date it is about, whether it comes by email or text, when it was set and changed, delivery status, and for your automatic medical reminder your medical class)	30 days after the reminder is sent or can no longer be sent; at once when you remove the reminder, turn the automatic one off, or your records are deleted; and in any case 90 days after the day it was due
Your reminder time zone	With your account, until you change it or delete your account
Reminder-text delivery details (which text, the date it gives, when it went and whether it was delivered; not your number or the words)	With the reminder details above. A text that is not a reminder: 30 days after it is sent or can no longer be sent, except the one confirming that texts are on, which stays until 30 days after they end
Your agreement to reminder texts	With your account, until four years after the texts end or until your account is deleted, whichever is sooner
Proof of that agreement (the same details, without your account)	Four years after the texts end, even if your account is deleted sooner; then deleted
The country check of your sign-in phone	While that number is your sign-in phone; deleted with your account
Our check against the list of disconnected numbers	Only the date and counts, for 90 days. We do not keep the list or the numbers on it
Your choices about marketing emails and news and updates	With your account. Our email delivery provider's copy of your address for those lists is deleted, usually within a day, when you turn both off or delete your account
Reviews you write	While you keep them. A review you take down is kept, marked as removed, until your account is deleted
Your plan record	With your account. Our payment processor keeps its own records under its own policy
Proof of your agreement to a paid plan's automatic renewal (the plan, the price, the exact words and the time; nothing medical)	3 years after you agreed, or 1 year after the subscription ends, whichever is later, even if you delete your account sooner
Your acceptance of our documents (which documents, the version, the exact words of each box and when)	With your account. After your account is deleted, a minimal proof (a one-way fingerprint of your email address, the version, the exact words and the time; nothing else) for 5 years
Account emails we sent you (which kind, when, whether it was delivered, and for some the date it was about; not their contents)	90 days after we send it or stop trying to, or sooner if you delete your account
Proof that we sent the notices about your plan's renewal, price and cancellation (which notice, when and for which renewal; not its words)	3 years after it was sent, or 1 year after the subscription ends, whichever is later, even if you delete your account sooner
Proof that we sent you a notice of a change to our documents or of a security incident (which notice and when)	3 years after it was sent
Records of a legal request about your account (such as a subpoena) and of our answer	3 years after the request is closed
Security logs related to access to your records	Until your account is deleted
The record of a support-assisted account recovery	With your account
Our log of support actions on your account (what our staff did and when)	3 years after the action, even after your account is deleted. It holds your account's internal identifier, not your email address or anything from your records
Sign-in records held by our account service	Sign-in history for 90 days, and deleted at once when you delete your account. A signed-in session ends when you sign out and is deleted with your account
Service logs and error reports	Up to 7 days, under our hosting provider's and database host's settings. Our hosting provider's security analytics also keep a sample of requests to our site, including the IP address, for up to 31 days. A weekly summary of error reports is kept with our support email, for the time given for messages below
Messages you send to our support addresses	Up to 24 months, then deleted
Records of privacy requests and our answers	24 months
Our email delivery provider's records	30 days under its retention policy
Our messaging provider's records of texts and replies	Under its own settings. Under its default settings, which we have not changed, they have no fixed end date. A STOP stays on its list until you text START, YES or UNSTOP to our reminder number
Backups	Deleted information is removed from backups within 90 days

16. Deleting your records or your account

Deleting your account (Account & privacy):

deletes your account and your records at once, including any previous set of records waiting out its 30 days;
removes document files from storage at the next daily clean-up, and copies in backups within 90 days;
cancels any paid plan bought on our website, usually within a day, after which our daily clean-up deletes your customer record at our payment processor, which keeps its own payment records under its own policy (a plan bought in the Crosscheck app must be cancelled with Apple: deleting your account does not cancel it);
if you deleted it in the Crosscheck app and signed in with Apple, asks Apple to remove Crosscheck from your Apple ID, or tells you how to do it yourself;
removes your address from our email delivery provider's lists for marketing emails and news and updates, usually within a day; and
leaves a few records, each for the time Section 15 gives: the proof of your agreement to reminder texts, the proof of your agreement to a paid plan's automatic renewal, the minimal proof of your acceptance of our documents, our log of support actions, and what our service providers keep under their own settings.

Delete my records (Settings and my data) is different:

it deletes the records in My records but keeps your account;
you can undo it for 30 days, and during those days we keep your records only so that you can undo it, and use them for nothing else;
after that, your records are deleted at the next daily clean-up, document files with them, and copies in backups within 90 days; and
if you want them gone sooner, delete your account, which deletes them at once, or email privacy@crosscheckmed.com and we delete them within 15 days.

Before you delete anything, you can export a readable copy of your records from Settings and my data, and download your document files from My documents. Anything else we hold about you is available by email request to privacy@crosscheckmed.com.

17. Your rights, and how to use them

Wherever you live, you can ask us to:

confirm whether we hold personal information about you, and give you a copy of it in a portable format;
give you a list of the third parties, including our service providers, that have received your personal information, with their contact details;
correct information that is wrong;
delete your information;
stop processing your health information, by withdrawing your consent (Section 18); and
opt out of the sale of personal information, targeted advertising and profiling. We do none of these, but you may still ask.

We will not discriminate against you, charge you more, or give you a worse service, for using any of these rights.

How. Sign in and use Settings and my data (export your records, delete them, and your email and reminder choices) or Account & privacy (your sign-in details and deleting your account). Or email privacy@crosscheckmed.com, or write to us at the address in Section 2. You may use an authorized agent, who must show us your written permission. Nevada residents can send a request not to sell their personal information to privacy@crosscheckmed.com, and we will answer it within 60 days.

Verifying it is you. If you are signed in, that is how we know it is you. For a request by email, we may ask you to confirm it from the email address on your account. If you do not have an account, we may ask for a little information to check who you are. We ask for no more than we need, and we never ask for your Social Security number.

Timing. We acknowledge a request within 10 business days and answer it within 45 days. If a request is complex, we may take up to 45 more days and will tell you why. We complete a deletion within 30 days after verifying the request (or, if you used Delete my records, when its 30-day undo ends, unless you ask us to delete sooner), and remove the information from backups within 90 days. Requests are free.

Appeals. If we decline a request in whole or in part, you can appeal by replying to our answer or by emailing privacy@crosscheckmed.com with "Appeal" in the subject line. We decide appeals within 45 days and explain our decision in writing. If you disagree with the decision, you can contact your state Attorney General: for example, in Washington at atg.wa.gov, in Nevada at ag.nv.gov, and in Connecticut at portal.ct.gov/ag.

We keep a record of privacy requests and our answers for 24 months.

You can withdraw any consent you gave us as easily as you gave it:

Your consent for your health information: delete your records in Settings and my data, or delete your account in Account & privacy, or email privacy@crosscheckmed.com. The Consumer Health Data Privacy Policy explains the effect.
Your automatic medical reminder: turn it off in Settings and my data.
Reminder texts: reply STOP, or turn them off in Settings and my data.
Marketing emails, and news and updates: use the unsubscribe link in any of those emails, or Settings and my data.
A review you published: take it down from that examiner's page.
Crosscheck Fill-in: remove the extension from your browser.

We act on a withdrawal at once when you use a control in the Service, and within 15 days at the latest when you ask us by email. Withdrawing consent does not affect what we did with your information before you withdrew it.

19. How we protect information

We use measures designed to protect personal information, including:

encryption in transit, and encryption at rest by our database host;
encryption of your records on your device before they are sent, so that they become available only after you sign in;
signing you out after 15 minutes without activity (in the Crosscheck app with Sign in with Face ID on, locking it instead, as Section 3.2A describes), and asking for your password again before sensitive changes such as deleting your records or your account or changing your phone number;
two-step sign-in (your password plus a code) on Plus and Pro, while records from a paid plan are kept, and on any account with a phone added;
no routine staff access to your records, including during account recovery, which restores sign-in only;
a log of the password resets and account recoveries our support staff carry out; and
security logs related to access to your records, kept for security and incident response.

If you forget your password, you can reset it by email, and your records are unaffected. If you cannot receive your texted code, our support team can start a recovery designed to help you back in, after identity checks and a 24-hour delay, during which an email lets you stop the process with one click. Both ways back in rely on access to the email address on your account.

No method of storing or sending information is completely secure, and we cannot promise that information will never be accessed without authorization. The Security page at crosscheckmed.com/security says more about what we hold, what protects it and where that protection ends.

20. If there is a data breach

If we learn of a breach involving your information, we will notify you without unreasonable delay and within the time the law requires, by email and by a notice in Crosscheck, and we will notify regulators where the law requires. Our notice will say what happened and when, what kinds of information were involved, what we are doing about it, what you can do, and how to contact us.

21. HIPAA and the FAA

Crosscheck is not a health care provider, health plan or health care clearinghouse under the Health Insurance Portability and Accountability Act (HIPAA), and it is not anyone's business associate, so HIPAA generally does not apply to the information you store with us. Other laws do, as this policy describes. Crosscheck is not affiliated with or endorsed by the FAA, and we share nothing with the FAA except the MedXPress pages Crosscheck Fill-in sends at your instruction (Section 12).

22. Children

The Service is for adults. You must be 18 or older, and able to form a binding contract where you live, to create an account. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it promptly. A parent or guardian who believes we hold a child's information can write to privacy@crosscheckmed.com.

23. Where Crosscheck operates

Crosscheck is intended for people in the United States. If you use it from elsewhere, your information is transferred to, stored and processed in the United States, where privacy laws may differ from those where you live. Our database host stores your account and records in the United States. Our hosting provider serves pages from locations near you, which may be outside the United States.

24. Notices for residents of particular states

California. We do not disclose medical information about you without your authorization, except as the law permits or requires, and we never use it for marketing. We do not sell or share personal information as California law defines those terms, and we do not disclose personal information to third parties for their own direct marketing. Section 13 explains how we respond to Do Not Track and Global Privacy Control signals, Section 17 how you can review and correct your information, and Section 26 how we tell you about changes.

Connecticut. We process sensitive data, including consumer health data and citizenship, only with your consent, given at sign-up, and only as reasonably necessary to provide the features you use. You have the rights in Section 17, including the right to appeal, and if you disagree with our decision on an appeal you can contact the Connecticut Attorney General at portal.ct.gov/ag. We do not sell personal data, use it for targeted advertising or profiling, or use it to train large language models.

Nevada. Section 3 lists the categories of information we collect, Section 12 who receives it, Section 17 how you can review and change it, Section 26 how we tell you about changes, and Section 13 that no third party collects information about your activity on the Service over time or across other sites. The date this policy takes effect is at the top. The Consumer Health Data Privacy Policy covers consumer health data.

Texas. Health information you store with Crosscheck is disclosed electronically to the service providers listed in Section 12 that host it, deliver our emails and texts, and keep our support mailbox. Our payment processor receives none of it. We do not sell health information.

Virginia and other states. If you enter reproductive or sexual health information, the consent you give at sign-up covers it, as the Consumer Health Data Privacy Policy explains.

Washington. Our Consumer Health Data Privacy Policy describes how we handle consumer health data under Washington's My Health My Data Act.

25. Information about you that others give us

If someone else gives us information about you, for example a message to support that mentions you, we use it only to deal with that message. If you are an examiner, Section 9 explains what Find an examiner shows.

26. Changes to this policy

A material change. We will tell you at least 30 days before it takes effect, by email to the address on your account and by a notice in Crosscheck. We may ask you to confirm that you have read the new version the next time you sign in.
Information we already hold. A change that would let us use it in a materially different way applies to it only if you give your consent. Otherwise, the change applies only to information collected after it takes effect.
A change the law requires may take effect sooner, and we will tell you as soon as we can.
A change that is not material, such as a correction, takes effect when we post it with a new "Last updated" date.
Earlier versions of this policy are available on request from privacy@crosscheckmed.com.

27. Contact

GJU Software LLC, doing business as Crosscheck, 7901 4th St N #36361, St. Petersburg, FL 33702, USA.

Telephone: (954) 569-6920

privacy@crosscheckmed.com

Crosscheck — Privacy Policy