Privacy Policy

Last updated: 14 October 2026

Crosswalk Technologies, Inc. ("Crosswalk," "we," "us") operates an opted-in US digital panel and licenses aggregated audience products. This Privacy Policy explains how we collect, use, share, and protect information, and how you can exercise your rights.

It covers:

  • Our websites, including crosswalknyc.com
  • Panel software (browser extension, Mac and Windows desktop apps, and the Crosswalk Panel mobile app for iOS and Android)
  • Client products: Profile IQ, Subscriber IQ, Digital Journey IQ, Trends IQ, Impact IQ, Attribution IQ, and Analysis IQ
  • The dashboard at dashboard.crosswalknyc.com, for account-holder information

If you do not agree with this notice, do not use the Services.

Questions: privacy@crosswalknyc.com or +1 (818) 231-2610.

1. Two layers. Do not mix them.

Layer A is the consented panel. If you join the panel, we hold identifiable or pseudonymous records so we can operate the panel, pay or support you where applicable, honor your rights, and build audiences. Layer A is personal information. US state consumer privacy laws apply.

Layer B is what clients receive. We do not sell your data as raw clickstream. Clients, partners, and dashboard users receive it only in our aggregated dashboard products. Those files cannot reasonably be linked to you or your device. They are not a list of people. They are group statistics: penetration, index versus US Gen Pop, projected US counts, ranked brands, and demographic composition of a cohort.

We do not sell Layer A personal information as individual records to clients. Licensing an aggregated dashboard product is not a sale of personal information under US comprehensive privacy statutes, because that product is de-identified and aggregated.

The public commitment that we will not re-identify Layer B is posted at De-identified data.

2. Who this notice is for

Panelists. People who opt in to Crosswalk software so we may observe digital behavior. Panelists are 18 or older, unless a parent or legal guardian has consented to collection from a person under 18 where that collection is legal. See COPPA and Parental consent.

Site visitors. People who browse crosswalknyc.com without joining the panel.

Dashboard users. People with a Crosswalk account who use client products. Account information (name, work email, login) is Layer A for that account. The audience files they download are Layer B.

3. Information we collect (Layer A)

From panelists, with consent

  • Identity and contact: name, email, phone, payout or reward details where used
  • Device and technical: browser type, OS, device type, IP address (used to run the panel; not shipped to clients)
  • Clickstream: URLs visited, timestamps, and related digital events across search, social, media, e-commerce, owned properties, streaming video, streaming music, gaming, and vMVPD / FAST
  • Declared profile details you choose to provide (for example age band or gender)
  • Records of your rights requests

We redact emails, reset tokens, account IDs, and other sensitive query parameters from URLs on device or at ingest. Identity keys (name, email, payout) are stored apart from the behavioral log.

From panel mobile apps (iOS and Android)

The Crosswalk Panel mobile app uses the operating system's built-in networking APIs to observe the destination hostnames you visit so your panel contribution reflects your mobile browsing in the same way the browser extension reflects your desktop browsing.

  • iOS. The app installs a local, on-device VPN configuration through Apple's Network Extension framework (NEPacketTunnelProvider). The VPN is on-device only; your traffic is not routed through Crosswalk servers or any other remote endpoint. The extension reads DNS lookups and connection metadata on your device, extracts the destination hostname and timestamp, and uploads only that metadata to the Crosswalk panel. We do not operate or offer a VPN service to you; the VPN API is used solely as the sanctioned iOS mechanism to observe the sites you visit for research purposes.
  • Android. The app uses Android's VpnService API for the same purpose, with the same on-device-only design.
  • What is collected. Destination hostnames (for example example.com), timestamps, per-app byte counts, device model, and OS version. Full URL paths for web browsing where observable are included; app content, form inputs, keystrokes, screenshots, microphone, camera, contacts, and precise GPS location are not collected.
  • What is not collected. We do not read the content of pages or messages. We do not collect your location, contacts, photos, microphone, or camera. We do not inspect encrypted payloads; we do not act as a man-in-the-middle. We do not request those permissions in the app.
  • Your controls. The app shows a plain-English consent screen before any observation begins. You consent in-app and iOS or Android then shows its own system consent dialog for the VPN configuration. You can pause observation in-app at any time, disable the VPN configuration from iOS Settings > General > VPN & Device Management or Android Settings > Network & Internet > VPN, or uninstall the app; uninstalling removes the VPN configuration.

From site visitors and dashboard users

  • Information you type into forms (contact, credit requests, support)
  • Account credentials and professional information for dashboard login
  • Device, log, and cookie data needed to run the website and dashboard (see Cookies)

We do not collect, for the product set named here

  • Social Security numbers
  • Precise geolocation in any file a client receives (including any radius of 1,750 feet or closer)
  • Biometric identifiers or genetic data as a product
  • Personal information of anyone under 18 except with parental or guardian consent, and only where that collection is legal

We do not use Layer A or Layer B to determine eligibility for credit, insurance, employment, or housing. Our products are not consumer reports.

4. How we use Layer A

  • Operate the panel and the website
  • Honor access, deletion, correction, portability, and opt-out requests
  • Build aggregated audience products (Layer B)
  • Security, fraud prevention, and legal compliance
  • Service messages about your account or panel participation

We do not use panel clickstream to serve you ads on Crosswalk properties as a named person.

5. What clients receive (Layer B)

A shipped product never contains:

  • Name, postal address, email, phone, Social Security number, or account login
  • IP address, cookie, mobile advertising ID, device serial, or persistent panelist ID
  • Precise geolocation
  • One person's URL history, purchase list, or content list
  • Biometric identifiers, genetic data, or consumer health data
  • Personal information of anyone known to be under 18 as an individual record (minors with parental consent stay in Layer A; they never appear as a row in a client file)

A shipped product does contain category-level shares of an audience, index versus US Gen Pop, projected US audience counts, ranked lists at a stated floor, and named cohort cuts (for example Avid Fan, Female, 18-24, a DMA).

6. How we share information

Processors. Vendors who host, email, pay, or support us, under contract, may see Layer A as needed to do that job.

Clients. Receive Layer B only.

Legal. We may disclose Layer A if required by law, legal process, or to protect rights and safety.

Corporate transaction. If we sell or reorganize the business, Layer A may transfer with it under this notice.

Recipients of Layer B are contractually prohibited from re-identifying any person, household, or device, from commingling the file with individual-level data in a way that would reasonably re-identify, and from reverse-engineering small cells. We oversee those terms.

7. Sale, share, and targeted advertising

We do not sell Layer A panelist personal information to clients as individual records. We do not sell raw clickstream.

Licensing an aggregated dashboard product is not a "sale" or California "share" of personal information, because the file is not personal information.

You may still use Your Privacy Choices to opt out of any residual Layer A sale, share, or targeted advertising on Crosswalk consumer properties. We honor Global Privacy Control (GPC) on those properties as a universal opt-out of sale, share, and targeted advertising.

8. Sensitive personal information

We do not sell sensitive personal information. Maryland's prohibition is met by construction. Demographic composition in a Layer B file is an aggregate share of an audience, not a person's racial, health, or orientation record.

Where a state requires opt-in to process sensitive personal information on Layer A, we obtain it before that processing.

9. Retention

Identifiable panel records are kept for panel operations and legal duty, then deleted or de-identified. After a valid deletion request we delete or de-identify the panel record. Later product builds inherit that deletion. We will not re-identify a Layer B file in order to pull one person out of it. That person is not in the file.

Shipped aggregated products are statistics and may be retained as the client's licensed file.

10. Security

We use administrative, technical, and physical safeguards: encryption in transit (TLS) and at rest, role-based access, employee training, incident response, and a written information security program. No method of transmission or storage is perfectly secure.

11. Your rights

If you are a US consumer whose personal information we hold on Layer A, we honor this set of rights so a national panel does not require fifty workflows:

  • Know / access
  • Delete
  • Correct
  • Portability
  • Opt out of sale, share, and targeted advertising
  • Limit use of sensitive personal information (California)

We will not discriminate against you for exercising a right.

How to submit. Email privacy@crosswalknyc.com, call +1 (818) 231-2610, use Your Privacy Choices, or write to Crosswalk Technologies, Inc., 23465 Civic Center Way Bldg 9, Malibu, CA 90265.

Timing. We respond within 45 days. We may take one 45-day extension when the statute allows it. We will tell you if we do.

GPC. If your browser sends Global Privacy Control, we treat it as an opt-out of sale, share, and targeted advertising on our consumer-facing sites and panel flows.

Layer B. We are not required to re-identify de-identified or aggregated products to fulfill a request. Rights run on the panel record. Later builds inherit the result.

12. California

California residents have the rights above, plus the right to limit use of sensitive personal information and a private right of action for certain data breaches under Civil Code section 1798.150. California is the only comprehensive state law that also covers employees and B2B contacts. Workforce notices are maintained separately.

Categories collected, sources, purposes, and disclosures are described in sections 3 through 6. We do not sell Layer A personal information as individual records. Use Your Privacy Choices to opt out of any residual sale or share.

13. Children and parental consent

The panel is for adults by default. With parental or guardian consent, we may collect digital behavior from a person under 18 where the law allows it.

For children under 13, we collect personal information only after verifiable parental consent (COPPA). For teens 13 to 17, we collect only with parental or guardian consent and only as applicable state law permits. We do not sell a minor's data as raw clickstream. We do not sell it as an individual record. We do not use it to market or advertise directly to that minor. The only client deliverable is our aggregated dashboard products. Those products do not contain the minor as a row.

If we learn we collected from someone under 18 without the required consent, or in a place or for a purpose the law does not allow, we delete it.

Parents: COPPA and Parental consent.

14. Cookies (this website)

The marketing site may use cookies and similar tools, including a cookie consent manager, to run the site. That is separate from the panel. The panel is permissioned clickstream from people who opted in. It does not rely on third-party advertising cookies to build Layer B products.

You can control cookies in your browser and in the site's cookie banner.

15. International transfers

We operate in the United States. If you are outside the US, your information may be processed here. We use appropriate safeguards where required.

16. Changes

We will post updates on this page and change the date above. Material changes may also go out by email to panelists and account holders.

17. Contact

Crosswalk Technologies, Inc.

Email: privacy@crosswalknyc.com

Data protection: dpo@crosswalknyc.com

Phone: +1 (818) 231-2610

Mail: 23465 Civic Center Way Bldg 9, Malibu, CA 90265

Related pages: Your Privacy Choices · Opt-Out · De-identified data · COPPA · Parental consent · Terms of Use