Privacy Policy

1. What We Collect

CronCommander collects the minimum data necessary to provide the Service:

• Account data: Email address, email-verification status, name, profile picture, and authentication-provider identifier. CronCommander uses Google Cloud Identity Platform for authentication. Email/password credentials are sent directly to Google; CronCommander's application server does not receive or store your password.
• Agent metadata: Hostname, OS, architecture, environment tags, and connection timestamps.
• Job metadata: Job name, schedule (cron expression), and command string.
• Execution data: Start/end timestamps, exit codes, execution duration, and captured stdout/stderr output.
• Technical and usage data: IP addresses, browser/device information, timestamps, request and error logs, session/security identifiers, and website analytics when enabled. These data can be personal or pseudonymous; we do not describe them as inherently anonymous.
• Billing and support: Customer and subscription identifiers, plan and billing interval, subscription/payment status, invoice and tax information made available by Paddle, and messages or attachments you send us. We do not store full payment-card numbers.

Google Sign-In data

If you choose “Continue with Google,” we request only your basic profile and email information: your Google account identifier, name, email address, email-verification status, and profile picture when available. We use this information to authenticate you, associate you with your CronCommander account and workspaces, display your account profile, and protect account access. We do not request access to Gmail messages, Google Drive files, contacts, or calendars.

Google account information is stored with your account on Google Cloud infrastructure and is accessible to authorized personnel only as needed to operate the service, investigate security incidents, or provide support. We do not sell Google user data, use it for advertising, or use it to train general-purpose AI models. We share it only with service providers as necessary to deliver the service, such as Google for authentication and hosting, and your billing email with Paddle when you subscribe, or where required by law.

You can revoke Google's authorization in your Google Account settings. Revoking that authorization does not automatically delete your CronCommander account or its job history. To request deletion of your account and associated Google profile data, contact [email protected]. Account retention and your data rights are described below.

2. Commands, output, and customer responsibility

Commands and stdout/stderr may contain personal data or secrets. Avoid putting passwords, access tokens, financial details, or unnecessary personal data in commands and output; review what your agents submit. You must have authority to monitor the relevant servers and process the data you submit. Do not use CronCommander as a password vault or the only copy of important records.

3. How We Use Your Data

• To operate and deliver the Service (displaying agents, jobs, and executions).
• To enforce plan limits and billing.
• To send transactional emails (account confirmations, alerts, invoices).
• To improve the Service based on aggregated, anonymized usage patterns.
• To respond to support requests.

We do not sell your data. We do not use it for advertising.

Where applicable law requires a legal basis, we rely on performing our contract to provide accounts, monitoring and support; legitimate interests in securing and maintaining the service and preventing fraud; legal obligations for tax, accounting and lawful requests; and consent for optional analytics where required. You may withdraw consent without affecting prior lawful processing. We do not use automated decision-making to make decisions with legal or similarly significant effects about individuals.

4. Data Storage & Security

• Infrastructure: The application and its database are hosted on Google Cloud. Operational providers such as Paddle, Typeform, and Google Analytics process the information required for their separate functions.
• Encryption at rest: Managed application storage uses Google Cloud encryption at rest.
• Encryption in transit: All communication between agents and the gateway uses TLS-encrypted HTTPS connections.
• Access control: Internal access to production data is restricted to authorized personnel only.

Workspace/account isolation, managed secrets, and access controls help protect operational and Google account data. Account and workspace roles restrict access to authorized scopes. Ownership and team labels do not grant permissions. Agency Auditor views omit commands, execution output, and workspace keys. Membership changes, ownership history, and job proposals retain actor and review metadata for accountability. No system is perfectly secure, and we do not claim SOC 2 certification.

Minibota Labs LLC is based in the United States. Depending on the provider and service, data may be processed outside your country, including in the United States and Europe. Where international-transfer rules apply, we use the safeguards required by those rules and applicable provider data-processing terms. Contact us for information about the safeguards relevant to your use; do not assume all provider processing occurs in one region.

5. Data Retention

Audit events are retained for 12 months on Free, Starter, and Pro plans, and for three years on Agency. Account and operational records are retained while needed to provide the service and then for applicable recovery, security, dispute-resolution and legal needs. Execution output does not have the same plan-based retention promise as audit events.

Request account closure or deletion at [email protected]. We verify your identity and account authority, explain any lawful retention exceptions, and remove or anonymize eligible active records. Deleting a job, leaving a workspace, canceling billing, revoking Google access, and deleting your account are different actions; one does not automatically perform the others.

Recovery copies expire separately from active data. Our current recovery configuration retains 35 daily database recovery points and independent monthly database exports for a 400-day retention period. Backup copies are restricted to recovery purposes and are not available for ordinary account use. Legal holds, security investigations, and financial-record obligations may require longer retention of particular records. We do not promise immediate erasure from immutable backups or permanent deletion of every copy within 30 days.

6. Third-Party Services

We use the following third-party services:

• Google Cloud Platform and Identity Platform: Infrastructure, data storage, authentication, and account-verification and password-reset emails.
• Google Analytics: Optional website analytics about page views, traffic sources and browser/device activity. Analytics can involve online identifiers and technical connection information.
• Paddle: Merchant of record for paid subscriptions, including checkout, payment methods, invoices, tax calculation, customer portal, refunds and billing records under its own terms and privacy policy.
• Typeform: Early access request forms.
• Website resources: Google Fonts, interface/CDN resources and hosting/security providers may receive IP addresses and browser request information when your browser loads them. Opening external links, including YouTube, takes you to services with their own privacy practices.

We share only information needed for these functions. We may also disclose information when legally required, to protect rights or investigate abuse, to professional advisers under confidentiality obligations, or in a business transfer with appropriate safeguards and notice where required. We do not provide other customers with general access to your account data.

7. Your Rights

Depending on your location and applicable law, you may request access, correction, deletion, portability, restriction, or objection, and withdraw consent where processing relies on it. Send requests to [email protected]; we may request proportionate information to verify identity and respond within the applicable legal deadline. We will explain any exception rather than promising unconditional deletion. You may complain to your competent data-protection authority. If your organization controls the data in question, we may direct the request to it or assist it in responding.

8. Cookies

The console uses essential session and security cookies, including an eight-hour server session and a short-lived login request-protection cookie. They are necessary for sign-in and protecting requests. Browser storage also remembers your optional website analytics choice.

Google Analytics is loaded on the public website only after you choose to allow analytics. You can decline without losing access to the site and reopen “Privacy choices” to change your choice. Withdrawing permission stops subsequent analytics loading and clears the website's accessible analytics cookies; it does not retroactively erase information already received by Google. Your browser can also block or clear cookies. We do not enable advertising personalization through this analytics integration.

9. Changes to This Policy

We may update this policy and will publish the revised date. We will give additional notice of material changes where appropriate or required and obtain new consent where the law requires it. Merely continuing to use the service is not a substitute for consent where consent is required.

10. Contact

CronCommander is intended for adults and professional infrastructure use, not children under 18. If you believe a child has provided personal data, contact us. For privacy, access, export, deletion or security questions, email [email protected]. You do not need to use a third-party form or have an active subscription to contact us.