Skip to content
cronpad

cronpad / privacy

privacy policy

Last updated

The privacy of your data — and it is your data, not ours — matters to us. This policy covers what we collect and why, how we handle it, and your rights to it. We never sell your data.

This policy applies to customers of cronpad Cloud (app.cronpad.com, including its API and MCP server) and to visitors of cronpad.com. It does not cover cronpad you run yourself: a self-hosted server sends nothing to us, and whoever runs it decides what happens to its data. If you have any questions, email us at contact@cronpad.com.

What we collect and why

We collect only what we need to run the service. In practice:

Identity and access

You sign in to cronpad Cloud with GitHub or Google. From that provider we receive your name, your primary verified email address, your profile picture URL and an account identifier. We use them to identify you, show who did what in a workspace, and send you invoices, alerts you set up and other essential messages. We never see your GitHub or Google password. We won’t use your name or company in marketing without your permission.

Your workspace content

To run your jobs, we store what you put in your workspace: job definitions and schedules, target URLs, request headers and bodies, commands, secrets, alert channels and rules, API keys, and team members. Secrets, signing secrets and API keys are encrypted at rest.

Each run produces a history record: when it was due, when it started, how long it took, the status code and any error. For failed attempts we also store the response body or command output, truncated to 64 KiB. This lets you see why a run failed. Run history, response bodies and the audit log are deleted after the retention window of your plan; see data retention.

We process this content only to provide the service to you. We don’t analyse it, train models on it, or share it with anyone except the subprocessors that host it.

Requests we send for you

When a job runs, cronpad Cloud sends an HTTP request to the URL you configured, with the headers and body you configured. The receiving server sees our IP addresses and whatever you put in the request. Alerts go to the channels you choose (for example email, Slack or a webhook), and their content is the run details you’d see in the dashboard.

Billing information

When you upgrade to a paid plan, we ask for your card and billing address. They go directly to our payment processor and never pass through our servers. We keep a record of each transaction, including the last 4 digits of the card and the billing address at the time, for invoicing, account history and billing support.

IP addresses and logs

Our servers log requests, including the client IP address, so we can enforce rate limits, investigate abuse and check that no one has accessed your account without permission. We keep these logs for no longer than 30 days, unless we need them for an ongoing security investigation.

Website interactions

On cronpad.com we use Plausible Analytics, self-hosted on our own server. It sets no cookies and stores no personal data: it counts page views, referrers, browser, operating system, device type and country, without identifying you. The dashboard at app.cronpad.com runs no analytics.

The cron validator sends the expression you type to our API to preview the next runs. We don’t store those expressions.

Cookies

We use only first-party cookies that make the service work:

  • A session cookie that keeps you signed in, and a matching CSRF cookie. Both expire with your session.
  • A short-lived cookie that protects the sign-in flow with GitHub or Google.
  • cronpad-theme, which remembers your light or dark theme across cronpad.com and app.cronpad.com.
  • cronpad_signed_in, which only tells cronpad.com to show a “Dashboard” link instead of “Log in”. It holds no identifier.

We don’t use advertising or third-party tracking cookies. You can clear or block cookies in your browser, but you will then need to sign in again.

Voluntary correspondence

When you email us with a question or for help, we keep that correspondence, including your email address, so we have the history if you get in touch again. We also keep anything you volunteer, such as survey answers. If we ever want to record a call with you, we will ask first and record only with your express consent.

Information we do not collect

We don’t collect any characteristics of protected classifications, such as age, race, gender, religion, sexual orientation, gender identity, or physical or mental abilities or disabilities. You may volunteer such information, for example a pronoun in your email signature. We don’t collect biometric data.

When we access or share your information

Our default is not to access your information. The only times we access or share it are:

To provide the service you’ve asked for. We use a few third-party services to run cronpad Cloud, and they process your data only as far as needed. See our subprocessors. This is technology handling your data: no human looks at it for these purposes, unless an error stops an automated process and needs manual intervention. When that happens, we look for a root-cause fix so it doesn’t happen again.

To help you with a support request or a bug, with your permission. If we need to look inside your workspace to help you, we will ask for your consent first.

To investigate, prevent or act on restricted uses. Accessing a customer’s account during an abuse investigation is a last resort. We have an obligation to protect both our customers and the people who report problems to us, and we try to balance those responsibilities. If we find you are using cronpad for a restricted purpose, we may report it to the appropriate authorities.

When the law requires it. We disclose information only in response to a valid legal request, and only what it requires. Where we are allowed to, we will tell you before we do.

Your rights with respect to your information

We apply the same data rights to everyone, wherever you live. Some of the most privacy-forward regulations today are the European Union’s General Data Protection Regulation (“GDPR”) and the California Consumer Privacy Act (“CCPA”). We recognise all the rights they grant, except where applicable law limits them. These include:

  • Right to know — You have the right to know what personal information we collect, use, share or sell. This policy lists the categories and specific data we collect and how we use them.
  • Right of access — You can access the personal information we hold about you, and get information about how it is shared, stored, secured and processed.
  • Right to correction — You can ask us to correct your personal information.
  • Right to erasure (“to be forgotten”) — You can ask us, subject to certain legal limits, to erase your personal information from our systems and those of our subprocessors. Some deletion requests mean the service can no longer work for you; in that case, the request may close your account.
  • Right to complain — You can complain about how we handle your personal information to the appropriate supervisory authority. If you are in the EU, find yours at edpb.europa.eu.
  • Right to restrict processing — You can ask us to restrict how and why your personal information is processed, including opting out of its sale. (Again: we never have sold and never will sell your data.)
  • Right to object — In certain situations, you can object to how or why your personal information is processed.
  • Right to portability — You can receive the personal information we hold about you and send it to another party. Your jobs are also available at any time through the API.
  • Right not to be subject to automated decision-making — You can object to a decision with a legal or similarly significant effect on you being made solely by automated processes. This right is limited if the decision is necessary to perform a contract between us, is allowed by law, or is based on your explicit consent.
  • Right to non-discrimination — We will not charge you a different price, offer different discounts or give you worse support because you exercised your privacy rights. Some rights, such as erasure, may by their nature stop you from using the service.

You can exercise many of these rights yourself by signing in and changing or deleting your data. For anything else, email contact@cronpad.com. Before acting on a request to see or delete personal information, we verify your identity using at least two pieces of information we already hold, including your email address. If an authorised agent writes on your behalf, we need written, signed consent from the account holder first.

How we secure your data

All traffic between your browser or API client and cronpad is encrypted with TLS. Secrets, signing secrets and API keys are encrypted at rest, and database backups are stored encrypted. Requests your jobs send use TLS whenever the target URL is https://. Read more on our security page.

What happens when you delete data

When you delete a job, it stops immediately, and its run history ages out under your plan’s retention window. When you delete your account or workspace, its data is no longer accessible and is permanently purged from our active systems within 30 days, and from backups within a further 30 days. Data we must keep for legal reasons, such as invoices, is kept only as long as the law requires.

Location of site and data

cronpad Cloud runs in a data centre in Germany (EU). Backups, the website and some supporting services are run by subprocessors in other locations; see our subprocessors page for the details.

Changes and questions

We may update this policy to comply with regulations and to reflect new practices. The date at the top shows the last change. When we make a significant change, we will email active customers before it takes effect.

Questions, comments or concerns about this policy, your data or your rights? Email contact@cronpad.com and we’ll be happy to help.