Privacy Policy

Last updated 29 October 2026

1. Who we are

The controller of your personal data is [TO FILL: legal name, form, country of establishment, address].

Privacy contact: [TO FILL: email].

EU representative (Art. 27 GDPR): [TO FILL: if the controller is established outside the EU].

2. What this covers

This policy covers the whole CRUX service: the website, the dashboard, and the CRUX api and MCP endpoints.

3. What we collect, why, and on what legal basis

Providing the service — performance of a contract (Art. 6(1)(b) GDPR):

  • your account: email address and display name (by default, the part of your email before the @);
  • one-time sign-in links sent by email, valid for 15 minutes and stored hashed;
  • organisations, projects, memberships, roles and invitations (the invitee's email address);
  • chats and agent sessions: messages and tool outputs;
  • token usage per turn: the model, the tokens and the cost;
  • the activity log: sessions, tickets, pull requests and invitations;
  • the trackers and git hosts you connect: their OAuth tokens, stored encrypted. Ticket content is read live with your own identity, so it then appears in chats, retrospectives and the activity log;
  • the MCP clients you authorise (for example, Claude Code): the client, your consent and the OAuth tokens we issue to it, stored hashed;
  • files and artifacts;
  • secrets you give us (LLM keys, MCP environment values), stored encrypted.

Billing — performance of a contract (Art. 6(1)(b)), once an organisation adds a card:

  • the organisation's billing account: the card owner (normally the member who added the card) and the billing month;
  • bills: one line per billed project, with the accounts counted on it and the amount.

Proof of your card consent — our legitimate interests (Art. 6(1)(f)): when you add a card, we record that you ticked the consent box: the organisation, you, the time, the version of the text you were shown, and your IP address.

Security and operation — our legitimate interests (Art. 6(1)(f)): the IP address and user agent of your sign-in sessions, logs and traces (they hold no message content [confirm]), rate-limit counters, and Cloudflare Turnstile on the contact and bug-report forms.

Answering your message — our legitimate interests (Art. 6(1)(f)), or steps before a contract at your request (Art. 6(1)(b)): what you send through the contact form (email address, optional name, message), a hashed IP address, your user agent and the page language. A bug report sends your description, your email address if you give one, the address of the page you were on and, if you add one, a screenshot, which we keep to answer the report.

Site analytics — your consent (Art. 6(1)(a)): Google Analytics, only after you choose Accept. You can withdraw consent at any time.

An email address is needed to open an account; everything else comes from your use of the service. We make no automated decisions about you and do no profiling.

4. Cookies and similar storage

Necessary — always on, because the service does not work without them:

  • the sign-in cookie on the api host;
  • the dashboard's browser storage: your sign-in token, the last project you opened and interface state;
  • your theme choice;
  • the consent cookie cc_cookie, which keeps your cookie choice for 182 days;
  • Cloudflare Turnstile on the contact and bug-report forms.

Optional — Google Analytics cookies (_ga*), set only after you accept them.

On your first visit a box asks you to choose: Reject and Accept are two buttons of equal weight. Until you accept, nothing is sent to Google. You can change your choice at any time with "Cookie settings" in the site footer; rejecting after an earlier Accept removes the Google Analytics cookies.

5. Who receives the data

We do not sell personal data. We disclose it only to the processors listed below and to the services you connect yourself.

Processors acting on our behalf:

  • Hetzner — servers (Germany);
  • Render — the database;
  • Redis Cloud — the cache;
  • Cloudflare — network, DNS, file storage (R2) and Turnstile;
  • Resend — email delivery;
  • Grafana Labs — logs and traces;
  • Google — analytics, only with your consent.

Services you connect act on your or your organisation's instruction: the LLM provider configured with your project's own key receives chat content, and the trackers and git hosts you link receive what the agents write there.

Payments: Paddle. Paddle sells CRUX to you as the merchant of record: it sells in its own name and handles your payment data under its own privacy notice, so it is not our processor. You give your card details, billing address and, for a business, VAT ID to Paddle in its checkout; we never see or store your card number. We send Paddle the email address of the member who adds the card, the ids of the organisation and of that user, and each bill's lines (project name, number of accounts counted, month) and amounts. From Paddle we receive the state of the subscription and of each payment, and links to the invoices.

When a project is already in CRUX. If you bind a tracker project that another organisation already uses in CRUX, we send your display name and verified email address to that project's admins and ask them to add you. You can withdraw the request while it is open. The request and who answered it are kept with the project. This adds two records: the requests (project_access_requests), kept while the project exists and deleted with it or with your account; and the delivery log of notice emails, which holds no email addresses and is deleted 90 days after the notice is resolved.

When the project's owners don't answer. If you ask us to transfer that tracker project to you, we send your display name, verified email address and explanation to the CRUX operator and to the holding project's admins, and we send the names and email addresses of the holding project's admins to the CRUX operator.

6. International transfers

Several of our processors are US companies. Transfers rely on the EU–US Data Privacy Framework or on Standard Contractual Clauses [TO FILL: per processor, with regions].

7. How long we keep it

  • Chat content: 24 hours, 7, 30 or 90 days after the last message, as set for the project (7 days by default), then deleted.
  • Logs and traces: 14 days.
  • Sign-in links, sign-in sessions and the OAuth tokens we issue to MCP clients: deleted once they expire.
  • Tracker and git-host connections and their OAuth tokens: while the connection exists.
  • Invitations: deleted 30 days after they expire.
  • Requests to join a project (project_access_requests): while the project and your account exist.
  • The delivery log of notice emails (no email addresses): deleted 90 days after the notice is resolved.
  • Your account, memberships, the activity log, token usage and retrospectives: while the account or the project exists.
  • Bills, their lines and the card consent records: 3 years, also after the organisation or your account is deleted.
  • Payment data that Paddle holds: as Paddle's own privacy notice states.
  • Contact form messages: [TO FILL].

8. Your rights

You have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to data portability, and to withdraw your consent at any time. You may also complain to a supervisory authority [TO FILL: the authority, which depends on the establishment].

To use these rights, write to the privacy contact in section 1. We answer within one month.

Deleting your account or your organisation does not delete its bills or the card consent records before their 3 years end (section 7).

9. Security

Connections to CRUX use TLS. Sign-in links, API keys and the tokens we issue to MCP clients are stored hashed; tracker and git-host tokens and your secrets are encrypted at rest. Only the members of an organisation can reach its data.

10. Changes

The date at the top shows when this policy last changed. When a change affects the cookies we use, we ask for your cookie choice again.