What CrossMain Collects

CrossMain stores account, company, job, form, file, labor, workflow, and audit information supplied by authorized users. If a user connects Google Calendar, CrossMain receives the Google account and calendar information described below to display that user’s selected calendars.

How Information Is Used

Information is used to provide CrossMain’s internal job-management features, keep company records separated, support users, secure accounts, and maintain an activity history. Google Calendar data is used only to show the connected user’s selected calendars inside CrossMain.

Google User Data We Access

Connecting Google Calendar is optional. With your permission, CrossMain accesses the following Google user data:

• Google account information: your email address and account identifier returned by Google’s identity service. The openid and email permissions identify the connected account and let us check that its email matches your CrossMain account.
• Calendar information: the calendars available to your Google account, including calendar identifiers, names, time zones, visibility, selection, and access settings. Read-only calendar-list permission lets CrossMain find the visible calendars you have selected in Google Calendar, including calendars shared with your Google account.
• Calendar event information: event identifiers, titles, start and end dates and times, locations, descriptions, status, organizer and attendee information, and Google Calendar and Google Meet links. Read-only event permission lets CrossMain retrieve event details for the calendar dates you view. Google’s responses may include additional calendar and event metadata; CrossMain uses the event details needed to display your calendar and meeting links.
• Connection information: Google access and refresh tokens, token expiration, the connected email, connection status, connection timestamps, and connection errors. Tokens let the server retrieve your calendar while you remain connected without requiring you to approve access each time.

How Google Data Is Used and Shared

CrossMain uses Google data to identify your connection and show your selected calendars on Home, including event titles, times, locations, descriptions, and available meeting links. This integration cannot create, edit, or delete Google Calendar events. It does not request access to Gmail messages, Google Drive files, or Google Contacts.

Your personal Google event content is shown to you within your active CrossMain company. Connecting your account does not share that content with coworkers, Company Admins, or other CrossMain companies. Calendar connection and disconnection activity, including who performed the action and when, is recorded in CrossMain’s activity history and is available to authorized administrators.

CrossMain’s hosting and database providers process information to operate the service. CrossMain does not sell Google user data or use it for advertising or training AI models. Google data is used to provide this user-facing calendar integration, consistent with the limited-use requirements of the Google Workspace API User Data and Developer Policy.

How We Protect Sensitive Data

• CrossMain uses HTTPS to protect information in transit between your browser and the production service, and between the server and Google’s APIs.
• Google access and refresh tokens are encrypted before database storage using AES-256-GCM. The encryption key is held in the server environment separately from the stored connection records. Google tokens and the OAuth client secret are used on the server and are not returned to the browser.
• The database restricts direct access to Google connection and authorization-state records. Server requests validate the signed-in user and active company; personal calendar requests are restricted to that user’s connection and matching email. Access to other CrossMain records is controlled by role and company.
• Google authorization uses a random, short-lived state value bound to the user, company, and approved return address. It expires after ten minutes and is checked and consumed during the callback to help protect the connection process.

Storage, Retention, and Deletion

Google event content is fetched when you view the calendar, processed on the server, and held temporarily in browser memory for display. This integration does not save copies of Google event content in CrossMain’s event database. Connection information is stored while your account remains connected, including if the connection needs attention because of an error.

To stop access, open Profile → Google Calendar → Disconnect Google Calendar and confirm Disconnect. Successful disconnection removes your personal connection record and its saved Google tokens and stops future calendar retrieval through that connection. CrossMain also requests token revocation from Google. You can independently remove CrossMain’s access in your Google Account connections settings. Disconnecting does not delete events from Google Calendar.

CrossMain’s own company records and connection activity history remain after disconnecting. Deleting live records does not remove any copies already included in backups. If your company previously configured a company-level Google connection, its saved connection and calendar name, identifier, and time zone are separate from your personal connection; contact support to request their removal.

CrossMain retains business and audit records while needed to provide the service, support users, maintain security, or meet applicable business or legal obligations. To request access to or deletion of retained personal data, including connection metadata or activity records, contact the address below. Retention of company records may also depend on the company’s recordkeeping requirements.

Contact

Questions or requests may be sent to support@crossmainapp.com.