What we hold, and what we do with it

Who we are

Croft is a workflow automation service, a product of Crannmor Holding LLC. You describe a recurring task, an agent writes a workflow in TypeScript that performs it, and Croft stores and runs that workflow on a schedule or on demand. Croft is the controller of your account information and analytics data, and processes the workspace content you create on your behalf.

For anything in this policy, write to privacy@croft.now .

What we collect

Account information

When you sign up we store your email address, an optional display name, and the time you confirmed the address. Croft has no passwords: you sign in with a link or a short code sent to your email. We keep the sign-in tokens that process needs and the address each was sent to. If someone invites you to an organisation or workspace, we store the address they invited. If you are on a paid plan, we keep a record of your subscription and the billing events Stripe sends us.

Your account record does not hold IP addresses, browser details, advertising identifiers or location. Some of that reaches our providers instead; see Analytics and error tracking.

Content you and your workflows create

Almost everything Croft stores is content you put there. In a workspace we hold:

• • Workflow source code, in full, with the compiled version that actually runs, its configuration values, and its description. Anything typed into a workflow is stored, so do not paste passwords or keys into workflow code. Use a connected account instead.
• • Runs and their step records. Each run's input, result and any error, and for every step the input it was given and the output it returned. That record is what lets you open a past run and see exactly what happened, and what lets a run be replayed. If a step read a customer's invoice or an email body, that content is in the step record.
• • Workspace data: records, documents, files and hosted pages, holding whatever you or your workflows put in them.
• • Email your workflows send. The recipient, subject and full body, so the workspace has a record of what went out.
• • Incoming webhook payloads. When a workflow is started by a request to its webhook address, we store the body of that request. We do not store the sender's IP address or headers.
• • Answers to paused runs and results you save as tests.

Credentials for accounts you connect

When you connect a third-party account (today: Gmail, Google Calendar, Google Sheets, Outlook, Outlook Calendar, Attio, Stripe, Slack, GitHub or X) we store the credential that lets Croft act for you. For accounts connected by OAuth that is the access and refresh tokens the provider issues, the scopes you granted and when they expire. For accounts set up with a token you supply, it is that token. We never receive your password for another service. Every credential is encrypted before it is written down; see Security. We also record which provider it is for, when it was connected and by whom.

Data your workflows fetch from a connected account, such as messages, rows, events, invoices or files, enters Croft as step records and workspace data and is held as above.

When you write to us

If you use the enterprise inquiry form, we keep your name, email address, company and message, and they are processed by a Croft workflow in our own workspace. Email you send us is kept in our mailbox.

croft.now/call is an advertising landing page: it is where a Facebook ad sends you, and it works differently from the rest of the site. As you fill in the form, we store your name and work email as soon as the email address is complete, even if you never press the button, so we can follow up. Empty the email field before you leave and we delete what you typed. If you book, we also store your phone number and the time you picked, plus your answer to "what's the one thing you'd hand us first" if you give one. With them we keep your IP address, browser, the page that referred you, the campaign tags in the link, and the ad click id and cookies Meta uses to attribute the visit (known to Meta as fbclid, fbp and fbc). A booked call goes on our Google Calendar, and Google emails you the invite.

This page, like our other public pages (home, pricing, comparisons, docs, and this policy), loads the Meta (Facebook) pixel, which records the page view. It is not loaded in signed-in workspace pages or on pages Croft hosts for customers. This page also reports two events to Meta's Conversions API: that you gave your name and email, and, if you book, that a call was booked. Meta receives your hashed email, name and phone number (never in the clear), your IP address, browser, and the cookies named above. We use this to measure whether the ad that sent you here worked, and to show Croft ads on Facebook and Instagram to people who have visited our public pages. On those pages the page view is reported to Meta twice, from your browser and from our server, and the server copy includes your IP address and browser. Our public pages set Meta's _fbp and _fbc cookies. See "Meta" in Who else sees it.

AI assistants and the Croft connector

An assistant such as ChatGPT or Claude can connect to croft.now/mcp and use Croft's tools for you. You authorise it by signing in to Croft, the same way you sign in yourself, and it acts with your access to the workspaces you choose. Everything a tool returns goes to the assistant, and from then on it is handled under that assistant provider's privacy policy, not this one.

Below is every tool the connector offers today, what it takes in, what it hands back to the assistant, and what Croft keeps afterwards.

The connector also offers prompt templates that help an assistant start a task, such as creating a workflow or debugging a run. Their arguments only fill in a message and are not stored.

What we record about each tool call

Croft keeps no log of tool calls in its database. For each call, PostHog receives the tool's name, how long it took, whether it failed and the kind of error, the assistant's name, version and user agent, a hashed session id, and the workspace and your role in it. It does not receive what the assistant sent to the tool or what the tool returned. The one exception is capability_request, whose text is sent to PostHog, as described in the table above.

What we record about the assistant

When an assistant registers with Croft we store the name, web address, logo address and sign-in return addresses it supplies. The tokens it is issued are stored only as hashes. We also create one assistant identity per person per workspace, holding a name and its permissions, and no record of the calls it makes.

Analytics and error tracking

We use PostHog, hosted in the United States, to see which parts of Croft are used and what breaks. It runs on every page of croft.now except hosted pages, which block it.

• • In your browser it records the pages you open, clicks and other interactions, and errors, along with your IP address and browser details. Sign-in tokens are removed from addresses before they are sent. Visitors who are not signed in are counted without a profile.
• • Once you sign in events are linked to your account, and PostHog receives your email address, name, and the organisation and workspace you are working in.
• • From our servers it receives the name and timing of actions in the app (not what you typed), assistant tool calls as described above, and error reports. An error report carries the address that was requested, the request method, your IP address and the error message. We strip credentials from error reports, but a message can still contain other content from the action that failed, such as an email address.

Apart from the Meta pixel on our public pages, described under /call above, we do not use advertising pixels. Analytics data is not used to advertise to you. There is no in-product switch to turn analytics off yet. Blocking cookies and scripts in your browser stops the browser part, and we will delete your analytics data if you ask.

How we use it

Each kind of information is used for the purposes below and nothing else.

We do not sell your personal information or share it with advertisers, with one exception: the Meta pixel on our public pages and Conversions API on /call, described above, which measure whether an ad worked and let us advertise to past visitors. We also upload to Meta the email address and phone number of people who gave their details on /call and of paying customers, hashed first so Meta never sees them in the clear. Meta matches them to its own accounts so we can leave those people out of ads or show ads to similar businesses. Write to privacy@croft.now and we will take you off that list. We do not use your workspace content, or anything an assistant sends through the connector, to train AI models, and we do not read it for any purpose other than running Croft for you, answering a support request you make, or investigating abuse.

Who else sees it

People you share a workspace with

Members of your organisation and workspace can see its workflows, runs and step records, stored data, and the record of email it has sent, according to their role.

Anyone, if you publish something

A hosted page set to link visibility can be opened by anyone with its share link, and one set to public by anyone with its address, without signing in. A published blueprint shows the workflow's source code and your organisation's name to anyone with the link. A webhook address accepts requests from anyone who has it. Treat each of these as publication.

AI assistants you connect

An assistant you connect receives what its tool calls return, as set out in AI assistants. Its provider handles that under its own privacy policy.

Services we rely on

These providers run parts of Croft for us. Each receives only what it needs to do its job:

Accounts you connect, and the web

Beyond these, data leaves Croft only because a workflow tells it to. Connected accounts receive the calls your workflows make, under the scopes you granted. Web pages a workflow fetches receive that request. Mail your workflows send goes to the recipients it is addressed to; if you connect Gmail or Outlook, mail sent through it goes out from your own Google or Microsoft account.

We will disclose information if the law requires it, and it may transfer as part of a merger or acquisition, in which case this policy continues to apply until you are told otherwise.

Security and where your data lives

Croft runs on Amazon Web Services in the United States, and your data is stored and processed there, as it is by PostHog, Stripe and our email providers. If you use Croft from outside the United States, your information is transferred there.

Connected-account credentials are encrypted before they reach the database. Croft seals them with AES-256-GCM using a 256-bit key held outside the database, with a fresh random initialisation vector for every value and an authentication tag that makes tampering detectable. The code refuses to store a credential if the key is missing rather than falling back to plain text, and credentials are kept out of logs.

The database is also encrypted at rest, so everything in it is encrypted on disk. Traffic to the site and the connector is served over TLS, as is the connection to our database. Sign-in codes, API keys and assistant tokens are stored only as hashes. Workflow code runs in a sandbox on our own servers, and it can reach the network only through what Croft provides it, such as connected accounts, email and fetching web pages. Access to production data is limited to the people who operate the service.

No system is perfectly secure, and Croft is a young product. Croft has not completed a SOC 2 or ISO 27001 audit.

Retention and deletion

Deleting a workspace removes its workflows, runs, step records, stored email, pages, connections and credentials. Copies in backups and earlier file versions age out on the schedule above.

Your choices and controls

In the product, yourself:

• • Delete workflows (with their runs and tests), projects, hosted pages and blueprints from the app, and documents through a connected assistant. For records and files, write to us.
• • Change a hosted page's visibility back to private.
• • Disconnect any connected account, which deletes its stored credential; remove members; and revoke invitations.
• • Disconnect an assistant by removing Croft in the assistant's settings. Croft does not yet have its own button for this; write to us and we will revoke its tokens.
• • Read everything a workspace holds, through the app or a connected assistant.

By writing to privacy@croft.now : delete your account, an organisation or a workspace and everything in it; get a copy of the personal information we hold about you or a full export of a workspace; correct your information; or delete your analytics data. Account deletion and export are not self-service yet.

Depending on where you live, laws such as the GDPR or the CCPA may give you further rights, including to object to processing based on our legitimate interests and to complain to a data protection authority. We honour the requests above for everyone, wherever they live. Croft is not intended for children, and we do not knowingly collect information from anyone under 16.

Cookies and similar storage

Croft sets one cookie of its own, which keeps you signed in for up to 60 days. PostHog stores an identifier in your browser so it can tell visits apart. Our public pages also set Meta's two cookies, _fbp and _fbc, which Meta uses to recognize your browser across visits and ads. They last up to 90 days.

Changes to this policy

When Croft starts handling your information differently, including when a connector tool is added or changes what it takes in or returns, we update this page and the date at the top. If a change materially reduces your protections, we will tell account holders by email.