PRIVACY PROTOCOL

00. WHO WE ARE

Crossfyre is operated by Clickswave Labs Private Limited, a company incorporated in India and based in Gujarat. In this policy "we", "us", and "Crossfyre" refer to Clickswave Labs Private Limited, which acts as the Data Fiduciary for the personal data described below.

This policy explains what we collect, why, who we share it with, and the rights you hold under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"). For any privacy question or request, contact our Grievance Officer at [email protected].

01. DATA WE COLLECT

We operate with a minimal footprint philosophy and collect only what is needed to run the platform and bill for it:

• Account data: name, email, and authentication credentials (hashed and salted).
• Billing data: subscription plan, payment status, and the partial transaction records returned to us by our payment processor. We never store your full card details.
• Operational data: audit logs of scanning activity, node and extension configuration, and basic request logs (IP, timestamp, user agent) kept for security and debugging.
• Target and reconnaissance data you generate through the platform.

02. CROSSFYRE MOBILE (ANDROID APP)

Crossfyre Mobile is our Android app. It signs in to your Crossfyre account and captures the HTTP and HTTPS traffic of apps you choose on the phone it is installed on, so that you can test apps you own or are authorized to test. On top of the account data in section 01, the app handles the following:

• Sign-in: your username or email and password are sent to crossfyre.io once, to issue an account key for the app. The password is not stored on the phone. The key is kept in the app's private storage, encrypted with a key held by the Android Keystore. Signing out revokes the key on our side and removes it from the phone.
• Device details: when you sign in and pick a workspace, the app sends the phone's model name, its Android version, the app's version, and an install ID, a random value the app creates on first use, so the workspace can show which phone a capture came from. The install ID is not derived from any hardware identifier or advertising ID, and uninstalling the app deletes it.
• Captured traffic: while a capture is running, the app sends, for each request made by an app in scope, the method, the host and path with query values blanked, the response status, the response time, the server banner, whether the request carried credentials (a yes or no, never the credential itself), the request's content type, and the names of its body fields. It is sent over HTTPS to the workspace you picked, and to nowhere else.
• Full requests: only if you turn on "Send full requests" in the app does it also send the full URL, the request and response headers, and the bodies. These can contain passwords, session tokens, cookies and personal data that the captured apps transmit. The setting is off until you turn it on, and a workspace cannot turn it on for you.
• The certificate: the app creates a CA certificate on the phone so it can read HTTPS. Its private key stays in the app's private storage and is never uploaded. Resetting the certificate or uninstalling the app deletes it. A certificate you installed in Android settings stays trusted until you remove it there.
• Installed apps: the list of apps you choose from is read on the phone and is not sent to us.
• On the phone: the app keeps the last 30 captured requests in memory so you can look at them on screen. They are never written to storage and are gone when the app is closed or Android stops it.
• Crash and usage data: the app contains no advertising, analytics or crash reporting code, and sends usage data to no one. The QR code scanner decodes on the phone; camera images are not sent anywhere. If you install the app from Google Play, Google may give us aggregated crash and performance statistics under Google's own privacy policy.

The capture runs as a VPN on the phone itself. Traffic from apps in scope passes through the app and continues to its original destination; it is not routed through our servers or any other VPN server. Apps outside the scope are not routed through the app at all. Captured records are stored in your workspace as target and reconnaissance data, kept until you delete them or the workspace is deleted, and handled as described in the rest of this policy.

Captured traffic can include personal data belonging to other people, for example the users of an app you are testing. You must have the right to capture it, as our Acceptable Use Policy requires, and you act as the party responsible for that data.

03. WHY WE USE IT

We process your data to create and secure your account, deliver the service you signed up for, process payments and renewals, maintain audit trails, prevent abuse, and meet our legal obligations. We process this data on the basis of your consent and of the contract between you and us. Where we rely on consent, you may withdraw it at any time (see section 06).

We do NOT sell or rent your personal data. Your reconnaissance and target data stays your own and is never used to train external models or shared for advertising.

04. WHO WE SHARE IT WITH

We share data only with processors who help us run the service, and only to the extent each one needs:

• Razorpay, for payment processing and subscription billing.
• Cloudflare, for hosting, content delivery, and object storage.
• Amazon Web Services, for compute and infrastructure.
• Our transactional email provider, for account and billing notifications.

Each processor handles your data under its own terms and applicable law. Some of them operate infrastructure outside India, so your data may be processed in other countries; where it is, we rely on the processor's safeguards and the transfer conditions permitted under the DPDP Act. We may also disclose data where required by a valid legal order, or to protect the rights and safety of our users and our network.

05. HOW LONG WE KEEP IT

We retain account and billing data for as long as your account is active, and afterwards only as long as needed to meet tax, accounting, and legal requirements under Indian law. Audit and operational logs are kept for a limited period for security and then deleted or anonymised. When data is no longer needed for any of these purposes, we erase it.

06. YOUR RIGHTS

Under the DPDP Act you have the right to access a summary of your personal data, to ask us to correct or complete it, to request its erasure, to withdraw consent, and to nominate another person to exercise your rights in the event of death or incapacity. You may also raise a grievance with us.

To exercise any of these, email [email protected] from the address on your account. We will respond within the timelines set by law. Withdrawing consent does not affect processing already carried out, and some data may be retained where the law requires it.

Deleting your account. This applies to accounts used on the web, in the CLI, in the Workbench and in Crossfyre Mobile alike. Email [email protected] from the address on your account with the subject "Delete my account". We reply to confirm the request came from you, then within 30 days delete the account, its API keys, the workspaces you own and everything in them, including traffic captured by Crossfyre Mobile. Billing and invoice records are kept for as long as Indian tax and company law requires, currently up to eight years, and then erased. Signing out of the app or uninstalling it does not delete your account. To delete only what one phone captured, without closing the account, ask the same way and name the workspace.

07. OPERATIONAL SECURITY

Data in transit is encrypted via TLS 1.3. Data at rest is protected using AES-256 encryption. We use ephemeral instances where possible to minimise data persistence. No method of transmission or storage is perfectly secure, so the confidentiality of your target data also depends on your own practices. You are responsible for keeping your API keys and access tokens secret.

08. COOKIES AND TRACKING

We use a single session cookie for authentication. We do not run third party tracking pixels or advertising cookies, and we respect the Do Not Track (DNT) signal.

09. CHILDREN

Crossfyre is not intended for anyone under 18. We do not knowingly collect data from minors. If you believe a minor has created an account, contact us and we will remove it.

10. GRIEVANCE OFFICER

In line with the DPDP Act and the Information Technology Rules, you can reach our Grievance Officer for any privacy concern or complaint:

• Grievance Officer: Dikshant Chandel
• Entity: Clickswave Labs Private Limited
• Location: Gujarat, India
• Email: [email protected]

11. CHANGES

We may update this policy as the service or the law evolves. Material changes will be reflected by the "Last updated" date above, and significant changes affecting your rights will be notified to your account email.