Crosswalk runs on your own computer, and what it holds stays there.

Crosswalk runs on your own computer and what it holds stays there. There is no account, no analytics, no crash reporting, no advertising, and no third-party code in the app that reports anything to anyone. Your terminals, and everything that appears in them, never leave your machine.

With the app as it installs, there are exactly two times anything leaves your computer, and both are below: the app asks whether a newer version exists, and, if you buy a licence, the payment goes through Stripe.

Browser sessions are an experimental feature, off unless you turn them on. A browser session is a web browser, so the sites you open in it see what any browser shows them. Two of its options, ad blocking and dangerous-site blocking, download public blocklists, and a third, if you give it your own Google key, asks Google about the addresses you visit. All three are off by default, and all of it is set out under "Browser sessions" below. None of it involves us.

All of it is on your own disk, in your own user account. Crosswalk keeps its files in one directory, which differs by platform:

These are the files there that hold anything of yours.

crosswalk.db holds the things you set up:

• Your sessions: the name you gave one, the command it runs, its working directory, any environment variables you set for it, your notes, and counts of how much it has read and written.
• Your groups and layouts, and their names, colours and working directories.
• Your snippets: their titles, descriptions, and the text they paste.
• The last screen of each session, up to 256 KB of it, so that a session you restart comes back looking as it did rather than blank. This is terminal output, and it is written to your disk. It is never sent anywhere.

license.json holds when your trial started, the furthest date the app has seen, and your licence key once you enter one. The key contains the email address it was issued to, which is how Settings can show who it belongs to.

settings.json holds your preferences: the theme, your keyboard shortcuts, your notification choices, and the other switches in Settings. It describes the app, not you. If you paste in a Google Safe Browsing key, it is kept here.

endpoint.json holds the local service's address and the token for this launch, so that a program in one of your sessions can still find the app after an update restarts it. It is readable only by your user account.

host.sock is how the app talks to the small process that keeps your terminals running between launches (below). It is a socket, not a file with anything in it.

If you use browser sessions, the directory also holds what any browser keeps: cookies, site storage, the cache, and the permissions you have granted to sites. Files a page downloads go to your own Downloads folder.

One file is kept outside that directory:

It holds the same two trial dates a second time, so that reinstalling does not silently start a new trial. It is left behind if you delete the app. You can delete it yourself; it is plain text and holds nothing else.

Two things worth knowing about the database:

• Environment variables you set for a session are stored in it as plain text. If you put a token or a password in one, treat the file the way you would treat any file holding a secret.
• Everything a terminal produces while it runs is held in memory and discarded when the session ends. Only the last screen is written to disk.

Your terminals run inside a small separate process, so that quitting or updating Crosswalk does not stop them. It holds each session's recent output in memory, which is what lets the window show what an agent printed while the app was closed. It runs as you and talks to nothing but the app, over the host.sock socket above. The only thing it writes to disk is a log beside that socket, host.sock.log, recording when sessions open, attach and close and which program each one started. It never records what a terminal shows. It leaves on its own a while after the last session it holds has finished, and choosing Stop everything when you quit stops it at once.

Crosswalk runs a small local service that owns the terminals. It listens on 127.0.0.1 only, on a port chosen by the operating system, and requires a token generated fresh for each launch. Nothing else on your network can reach it.

Each session is also told how to reach that service, through environment variables it can read: CROSSWALK_SESSION, CROSSWALK_URL, CROSSWALK_TOKEN and CROSSWALK_ENDPOINT, the path of endpoint.json. That is what lets a program you run, such as an agent's stop hook, ask Crosswalk for a notification. It is the same loopback address and the same token, so this reaches no further than the app already does, and the request carries only the text the notification is to show.

If you turn on agent control under Settings, Experimental, the same service also lets a program in one session start, type into, read and close other sessions, and, if you allow it, read and act in your browser sessions. That happens on your machine, between your own sessions, and nothing of it is sent to us. What a program does with what it reads is up to the program: an agent that sends its context to its own provider will send what it read too.

Crosswalk asks https://releases.crosswalk.wareshq.com whether a newer version exists, about once a minute while it is running, and downloads it when there is one. That request carries what any HTTPS request carries, including your IP address. It contains nothing about you, your sessions, or what you run.

We do not enable access logging on that service (verified 2026-09-10), so we hold no record of who checked for an update or when. It is served by Amazon CloudFront and Amazon S3, which act as our infrastructure providers.

There is currently no setting to turn the update check off. If that matters to you, blocking that hostname is sufficient, and the rest of the app continues to work.

Browser sessions are off until you tick the box under Settings, Experimental. Once on, a browser session is a Chromium-based browser, and the sites you visit in it receive what any browser sends them: your IP address, cookies they set, and so on. Who you are signed in as is shared between the browser sessions of one group by default, or across all of them, or kept per session, as you choose under Settings, Browser.

Three options under Settings, Browser send requests of their own. Each is off by default.

The blocklists are cached in the Crosswalk directory, so blocking keeps working offline once they have been downloaded.

Payment is handled by Stripe. Your card details go to Stripe and never reach us. From a purchase we receive your email address, the country used to calculate tax, and the fact that you bought something.

We use your email address for two things: to send you your licence key, and to answer you if you write to us. Your key is stored alongside the payment record in Stripe so that we can send it again if you lose it. That is the whole record. There is no account, no password, and nothing to sign in to. The key is verified on your own machine, offline, so using Crosswalk never tells us that you are using it.

Everyone who handles any of this on our behalf:

We keep the invoices that tax law requires us to keep. We do not sell personal information to anyone.

No analytics. No telemetry. No crash reporting. No advertising, and no advertising identifiers. No profiling. We cannot read your terminals, your commands, your files, or your notes, because none of it is ever sent to us.

• To remove everything Crosswalk has kept on your computer: delete the directory in the first table above, and the trial.json file in the second.
• To see or remove what we hold about a purchase: email us. What we hold is your email address, your licence key, and the payment record in Stripe. We will delete what tax law does not require us to keep.
• To stop the update check: block releases.crosswalk.wareshq.com.
• To clear what browser sessions have kept: quit Crosswalk and delete the Partitions folder in the Crosswalk directory. That signs every browser session out of everything.

If you are in the EU, the UK, or California, you have the rights your law gives you over the small amount of data above: to see it, to correct it, to have it deleted, and to complain to your regulator. Ask, and we will do it.

Crosswalk is a developer tool and is not directed at children.

If this policy changes, the date at the top changes with it, and any material change will be stated in the summary at the top rather than only in the section it affects.

Email support at wareshq dot com.