Privacy policy — Crossways
Last updated: 28 April 2026
Crossways is made by Shamalama (Vanessa Latchem-Smith, sole trader, United Kingdom). The app is a private residents’ platform for a specific residential estate. Access is restricted by invite code.
What the app collects
Account information
When you register, we store your email address and the first name you enter. These are held in Firebase Authentication and Cloud Firestore, both services provided by Google.
Content you post
Any content you create in the app — space status updates, away notices, delivery posts, asks, poll responses, feed posts, and booking requests — is stored in Cloud Firestore and visible to other residents of the estate.
Push notification token
If you grant notification permission, a device registration token is stored in Cloud Firestore so the app can send you push notifications via Firebase Cloud Messaging (Google) and Apple Push Notification service (Apple).
What we do not collect
We do not collect location data, contacts, browsing history, or any data beyond what is listed above.
How the data is used
Data is used solely to operate the app: to show estate residents each other’s status, facilitate coordination, and deliver notifications about events relevant to the estate. We do not use it for advertising, profiling, or any purpose beyond running the app.
Who can see your data
Content you post is visible to other registered residents of the estate. No data is shared with third parties beyond the infrastructure services listed below.
Third-party services
| Service | Provider | Purpose |
|---|---|---|
| Firebase Authentication | Google LLC | Account sign-in |
| Cloud Firestore | Google LLC | Data storage |
| Firebase Cloud Messaging | Google LLC | Push notifications |
| Apple Push Notification service | Apple Inc. | Push notification delivery on iOS |
Google’s privacy policy is at policies.google.com/privacy. Apple’s privacy policy is at www.apple.com/legal/privacy.
Data retention
Your account and content remain in the system while you are a resident of the estate. If you leave the estate and your account is removed by the estate owner, your data is deleted from Firestore and Firebase Authentication. You can request deletion of your account and content at any time by contacting us.
Your rights
Under UK GDPR you have the right to access, correct, or delete personal data we hold about you. To exercise these rights, contact us at the address below.
Children
The app is intended for adults. It is invite-only and restricted to known estate residents.
Security
Data is stored in Google Firebase, which applies industry-standard security controls. Access to the estate’s Firestore database is controlled by Firestore Security Rules that restrict reads and writes to authenticated residents only.
Contact
Questions about this policy: shamalama-app@outlook.com
Changes
If this policy changes materially, residents will be notified via the app. The Last updated date at the top will always reflect the current version.