Crosspointx, Inc.
NetSpect
Last Updated: October 19, 2026
Crosspointx, Inc. ("Company," "we," "us," "our") operates the NetSpect mobile application. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the App. Please read it carefully — if you do not agree with our policies and practices, do not use the App.
We request "Always" location permission so check-in can work even when the App isn't open, but we do not continuously track or stream your location. Your location is read when you arrive at the court for a run your group calls, or for a match you are playing in, and again opportunistically while that game is under way — when the App is already awake — so that the time you spent there is measured rather than assumed. It is not read between runs, and we do not build a movement history. We use geofencing instead: your device monitors a small, specific boundary around a court only while your group has a run, or you have a match, coming up there, and notifies the App only when you cross that boundary — we do not receive or store a continuous trail of your movements. That means if you turn up at a run your group called, you are counted as there even if you never said you were coming. When your group calls a run, we send your phone a silent notification that wakes the App for a few seconds in the background so it can start watching that court; you see nothing, and the App uses that moment only to set up the watch. We verify your reported arrival server-side before releasing your reserved credit. If you referee a match, the App reads your location once, when you tap check in at that match's court, to confirm you are there. Location data is never sold or shared with third parties, and is used only for check-in verification and measuring how long you played.
You can use NetSpect three ways, and they collect different things.
Anonymous sign-in: an authentication ID generated by Firebase, plus the display name you type. No email, no password, no real name.
Sign in with Apple: the same authentication ID, plus what Apple hands us the first time you authorise — your email address and your name. If you chose Apple's "Hide My Email", what we receive and store is the private relay alias, not your real address, and we record which of the two it is so we know never to treat the alias as a contactable address. Apple sends these once, at first authorisation only.
Email and password: if you add an email and password to your account in Settings, we store that email address. Firebase Authentication stores your password; we never see it.
Either way we also store: your group membership, the runs you joined, your check-in records, your chat messages, the courts you turn alerts on for, the games you abandon, your reactions to chat messages, your profile photo if you add one, the times you mark yourself available to play each day, and a push notification token for each device you sign in on.
If you buy a league membership, in the App or on netspect.app, Stripe processes the payment. We receive from Stripe your email address, which plan you are on, whether your membership is active, and when it renews or ends. We never receive your card number. The first time you pay, we record that you confirmed you are 18 or older or have a parent's or guardian's permission, with the date and whether it was in the App or on the website.
Free weeks are given once per person, so when someone starts them we keep: a record that the account had them; a code Stripe gives us that stands for the card but can't be turned back into its number, together with the account it was first used on; and a single yes-or-no mark that Apple keeps for us against the phone, through Apple's DeviceCheck service. The mark doesn't tell us or Apple who you are, and it stays with the phone if the App is deleted and reinstalled.
If you sign up for a ranked season, in the App or on netspect.app, we store the first and last name you enter, whether you want a heads-up when the season opens, and the start date of the season you signed up for. Other signed-in players can see the name on a season sign-up, so enter only the name you play under.
If you apply to referee through the Careers page on netspect.app, we also store what you send: your name, your city, what you tell us about your refereeing or playing experience, and whether we approved it. Only NetSpect admins can read it.
Some things stay on your phone and are never sent to us: the courts you save as favourites, which chat messages you have read, and your scores in the basketball mini-game.
When you delete your account, an Apple sign-in is revoked as part of the deletion, not left connected.
For each device you sign in on, we store a push notification token so we can tell you a run has been called. A token identifies a device, not a person, and it changes when you reinstall the App. When you open the league offer, the App also asks Apple for a one-time DeviceCheck code for the phone, used only to check whether that phone has had free weeks before (see "Account & User Data").
We do not collect your advertising identifier, IP-based location, or browsing behaviour. From version 1.0.4 the App uses PostHog to learn how it is used; see “How we learn what to fix (PostHog)” below. Since 26 September 2026 the App does include a crash reporter, Firebase Crashlytics: when the App crashes it sends Google where in our code it happened, your device model and OS version, and your NetSpect account ID so we can find your crash among everyone else’s. It runs only on a crash, and never records what you tap or which screens you open. If you contact us about a problem, we may ask you for your device and OS version — that is you telling us, not us collecting it.
Your data is stored and processed through Firestore, Firebase Authentication (anonymous sign-in, Sign in with Apple, and email and password), Firebase Cloud Functions, and Firebase Cloud Messaging for push notifications. We also use Firebase Crashlytics for crash reports. We do not use Firebase Analytics or any Google Analytics products. Stripe handles every payment: referee fees (your card details go from Apple Pay to Stripe and never reach us), league memberships bought on netspect.app, and payouts to referees.
How we learn what to fix (PostHog). From version 1.0.4, the App uses PostHog to see how people use NetSpect and where they get stuck. It records two things. First, a short list of moments, such as joining a group, joining a game, paying a fee, opening the league offer or checking in at a court, with no more detail than the game format or plan. Second, recordings of the screens you see, so we can watch where people get stuck. In recordings, anything you type and every photo is hidden, and payment screens (the referee fee, the league offer, checkout and Your membership) are never recorded at all. Other words on screen can appear, including players' names and messages in your group's chat. This information is linked to your NetSpect account ID, never your name or email. It is not used for advertising, not combined with information from other companies, and not used to follow you across other apps or websites. PostHog does not receive your location and does not work out where you are from your internet address. Recordings are kept for 30 days and moments for up to a year. If you delete your account, we delete what PostHog holds about you too.
The first time you open NetSpect after installing it, the App checks your clipboard one time for a NetSpect invite link. This is how an invite survives the trip through the App Store: you tap a link, the website puts the invite code on your clipboard, you install the App, and the App picks the code up so you land in the run you were invited to instead of on a blank screen.
It asks iOS what KIND of thing is on the clipboard before reading anything, so a clipboard holding a photo or a password is never read at all. It happens once, ever, on first launch — never again, and never in the background. If it does read a link, iOS shows you its own paste notification. Nothing from your clipboard is sent anywhere unless it is a NetSpect invite link.
The courts map shows how busy each court has been. That figure counts distinct people who checked in, never who they were, and any court with fewer than three distinct people in the period is reported as having no activity at all rather than as a small number — so a quiet court can never identify the one or two people who were there.
The App also shows you the names of people you have previously played with, and shows your name to them on the same basis. Your name and check-in status are visible to members of your own group. If you play ranked matches, we keep your rating, your ranked wins and losses, and the times and courts of your ranked matches. Your name, rating and ranked record are shown on the season ladder to every signed-in player, not just your group. People you have played with can invite you to a spot in one of their matches. While a refereed match is being played, other players can follow its score; they see the two groups' names, never the players' names or faces. Your location coordinates are never shown to anyone.
To find out why check-ins fail for real people in real places, the App records on your own user record: whether you granted location permission, a count of check-in failures, and when the last one happened. That is the whole of it. There is no advertising identifier and no tracking across other companies' apps or websites. Crash reports and product analytics (PostHog) are separate, and described in this policy.
Running the App: keeping your account, your group membership, the runs you call or join, invite links, and the messages you send to your group.
Check-in: detecting that you arrived at the court for a run your group called (whether or not you said you were coming) or a match you are playing in, verifying it server-side against that court's real coordinates so it cannot be faked from a phone, and measuring how long you stayed.
Telling you things: push notifications when your group calls a run, when you are counted in at a court, when someone posts in your group's chat (you can turn these off in Advanced Settings), when a pickup run you joined is canceled, and, if you turned on alerts for a court, when a game is called there. A chat notification shows the sender's name and the start of their message, delivered through Apple and Firebase like every other notification. Only you can see which courts you follow, and a court alert says only the court and the time, never who called the game or who is going.
Abandoning a game: if you drop out of a game you joined, we record that you did so we can show your group how many people abandoned it. Your group sees that number only, never who.
Reactions: when you react to a message, your group sees how many people reacted with each emoji, never who.
Weather: showing the forecast at the court you picked for an outdoor run, looked up by the court's location, not yours.
Showing the group what happened: attendance on a run, the people you have played with, and how busy a court has been in aggregate.
Keeping it working and lawful: fixing check-in failures, resolving disputes, enforcing our Terms, and responding to legal requests.
Reports and moderation: when you report a message or a person, we store who reported whom, the reported person's name at that moment, the group, when, and the reported message's text, so we can act on it. If we suspend an account, we keep a record of that, the reason, and which admin did it. Only NetSpect admins can read reports. Every admin is alerted when one arrives; the alert itself shows no names or message text.
We do not use your information to advertise to you, and we do not sell it.
While you have an account, check-in records and credit history are held so the credit system can function — we don't retain a continuous location history, only confirmation that a check-in occurred. If you delete your account, this is a real, permanent deletion, not a deactivation: your profile and photo, group membership, credit history (including any unspent match-fee credit, which is lost), pickup-game attendance records, daily availability, court alerts, abandon records, message reactions, run invites made out to you, your ranked season sign-up and any referee application are permanently deleted, and your account cannot be recovered. Chat messages you sent and the outcome of completed matches stay, because they are part of other members' record of a shared event, but your name is taken off them and replaced with "Deleted player". Reports you filed about someone else are kept for safety, with your account removed from them. Records of payments are kept by Stripe as the law requires. The moments and screen recordings PostHog holds for your account are deleted too. If you delete your account, we keep the one record that you confirmed your age or a parent's or guardian's permission before paying, as proof the payment was agreed to; it holds no name, photo or location. The record that a card has had free weeks is kept after you delete your account, so the free weeks can't be claimed twice; it holds Stripe's code for the card, never the card number. If you have a league membership, deleting your account cancels it straight away, with no refund for the rest of the month. If you referee and we still owe you a payout, we keep a small record of that payout until it is paid, and then delete it.
We do not share your data with advertisers, data brokers, social media platforms, or other third-party services. We share data with five companies, all of them to make the App work rather than to market to you:
Google LLC (Firebase) — storage, authentication, cloud functions and push delivery. Your account, groups, runs, check-ins and messages live here.
Apple Inc. — if you use Sign in with Apple, Apple authenticates you and tells us your email and name. If you chose Hide My Email, Apple also relays mail to you without giving us your real address. Apple delivers our push notifications to your device. Apple also supplies the weather forecast shown for outdoor runs (Apple Weather): the App sends Apple the court's coordinates and the game's time window, never your own location and nothing that identifies you. Apple's DeviceCheck service keeps the single free-weeks mark for a phone described under "Account & User Data".
Stripe, Inc. — payments and payouts. Stripe processes referee fees and league memberships, and holds the identity and bank details referees give it to get paid. Those details go to Stripe directly from its own pages; NetSpect never receives them.
PostHog, Inc. — product analytics, on servers in the United States. It receives the moments and screen recordings described in “How we learn what to fix (PostHog)”, linked to your NetSpect account ID. Payment screens are never sent to it.
Microsoft Corporation (GitHub) — encrypted backups of our source code. No user data is on GitHub, only the code that runs the App. We may disclose information if required by law (e.g. court order, subpoena).
NetSpect is intended for users age 13 and older. By creating an account, you confirm that you are at least 13 years old. We do not knowingly allow anyone under 13 to use the App. If you are under 18, you need permission from a parent or guardian before you pay for anything in NetSpect.
You can request a copy of your personal data and how it's used. You can delete your account at any time from Settings → Delete Account — see Data Retention above for exactly what is and isn't removed. You can disable location permissions at any time in your device settings; this will prevent check-ins from working, meaning a reserved credit for a match you accept won't be released back to you. If you're a California resident, you have CCPA rights to know what's collected, know whether it's sold (it isn't), and delete it — contact us at pointxcross@gmail.com to exercise these rights.
Location data is transmitted encrypted (HTTPS/TLS). Firestore is protected by Google's enterprise-grade security. We verify location data server-side to prevent client-side manipulation. We store the least that makes the App work: a display name always, and an email address only if you signed in with Apple and shared one, added an email and password, or bought a league membership — see "Account & User Data" above for exactly what that means. We do not collect phone numbers, postal addresses, card numbers, contacts, or your device's advertising identifier — a card used for a referee fee goes from Apple Pay to Stripe without passing through us. We cannot guarantee 100% security against unauthorized access — no security system is impenetrable, and use of the App is at your own risk.
We may update this Privacy Policy from time to time. When we make material changes, we'll notify you within the App and update the "Last Updated" date above. Continued use of the App after changes means you accept the new policy.
Questions about this policy, your data, or your privacy rights:
Email: pointxcross@gmail.com
Mailing Address: Crosspointx, Inc. 131 Continental Dr, Suite 305 Newark, DE 19713, US
Email: pointxcross@gmail.com
Mailing Address:
Crosspointx, Inc.
131 Continental Dr, Suite 305
Newark, DE 19713, US
This Privacy Policy is effective as of September 13, 2026.