What we hold, and what we do with it

Who we are

Croft is a workflow automation service. You describe a recurring task, an agent writes a workflow in TypeScript that performs it, and Croft stores and runs that workflow on a schedule or on demand. Croft is the controller of the account information described below, and processes the workspace content you create on your behalf.

For anything in this policy, reach us at [email protected].

What we collect

Account information

When you sign up we store your email address, an optional display name, and the time you confirmed the address. Croft is passwordless: you sign in with a link or a short code sent to your email, so there is no password and no password hash on file. We keep the sign-in tokens needed to run that process, along with the address each was sent to. If someone invites you to a workspace, we store the email address they invited until the invitation is accepted or expires.

We do not keep IP addresses, browser fingerprints, advertising identifiers, or location data in your account record.

Content you and your agents create

Almost everything Croft stores is content you put there. In a workspace we hold:

• — Workflow source code, in full, along with the compiled bundle that is actually executed and any description written for it. Anything typed into a workflow is stored, so please do not paste secrets into workflow code — use a connection instead.
• — Runs and their step records. Croft records each run's input, its result, any error, and for every step the input it was given and the output it returned. That verbatim record is what lets you open a past run and see exactly what happened, and it is what makes a run replayable — so if a step read a customer's invoice or an email body, that content is in the step record.
• — Workspace data: records streams, documents, uploaded or generated files, and artifacts. These hold whatever you or your workflows put in them.
• — Email your workflows send. Recipient address, subject, and the full body are stored so the workspace has a record of what went out. Anyone with access to the workspace can read that record.
• — Incoming trigger payloads. If a workflow is started by an incoming webhook, we store the payload that started it.

Credentials for accounts you connect

When you connect a third-party account, we store the credential that lets Croft act on your behalf: for accounts connected by OAuth, the access and refresh tokens the provider issues, the scopes you granted, and expiry information; for connectors set up with a token you supply yourself, that token. We never receive or store your password for another service. Every one of these is encrypted before it is written down — see Security. We also record which provider the connection is for, when it was made and by whom.

Data your workflows fetch from a connected account — messages, rows, invoices, files — enters Croft as step records and workspace data and is held as described above.

Operational information

We record usage counts per workspace — runs, steps, AI tokens, connector calls, stored bytes — to operate and bill the service. Our servers also produce ordinary operational logs. We do not run analytics, advertising, or session-replay trackers on this site, and there is no third-party tracking script on any Croft page.

How we use it

We use the information above to run the service you asked for: to sign you in, to build and execute your workflows, to show you what a run did, to send the mail your workflows send, to keep your connected accounts working, to measure usage for billing, and to keep the service secure and working. We also use your email address to reach you about your account or a problem with the service.

We do not sell your personal information. We do not share it with advertisers. We do not use your workspace content to train our own models, and we do not mine it for any purpose unrelated to operating Croft for you.

Who else sees it

People you share a workspace with

A workspace is shared by design. Members of your organisation and workspace can see its workflows, runs and step records, stored data, and the record of email it has sent, according to their role. Artifacts have their own visibility setting — an artifact set to link or public visibility can be opened by anyone holding the URL, without signing in. Treat that setting as publication.

Agents and assistants you connect

Croft exposes a connector at croft.now/mcp so an AI assistant can work in your workspace on your behalf. If you connect one, you authorise it through the same sign-in you use yourself, and from then on it can read and write the workspace data it has been granted — workflows, runs, documents, records and files. What the assistant does with what it reads is governed by that assistant's own privacy policy, not this one. You can revoke its access at any time from the workspace, and we record which agent identity took which action.

Services we rely on

We use a small number of providers to run Croft. Each receives only what it needs to do its job:

Beyond these, data leaves Croft only because you told it to. The accounts you connect — today that includes Google Sheets, Attio, Stripe, Slack and GitHub — receive whatever calls your workflows make to them, under the scopes you granted. Mail your workflows send goes to the recipients you address it to. You choose which connections exist and can revoke any of them at any time.

We will also disclose information if we are legally required to, and we may transfer it as part of a merger or acquisition — in which case this policy travels with it until you are told otherwise.

Security and where your data lives

Croft runs on Amazon Web Services in the United States, and your data is stored there. If you are using Croft from outside the United States, that means your information is transferred to and processed in the US.

Connected-account credentials are encrypted before they reach the database. Croft seals them with AES-256-GCM using a 256-bit key held outside the database in the application's environment, with a fresh random initialisation vector for every value and an authentication tag that makes tampering detectable. The key is versioned so it can be rotated without a migration, and the code refuses to write a credential at all if the key is missing rather than falling back to plaintext. Credentials are marked so they do not appear in logs or debugging output.

Underneath that, the database itself is encrypted at rest with a managed key, so everything stored in it — not only credentials — is encrypted on disk. Traffic to the site and to the connector endpoint is served over TLS, and the connection to our database is TLS-encrypted as well. Sign-in codes and API keys are stored only as hashes, never in a readable form. Workflow code runs in a sandbox on our own servers, not on a third party's, and it has no access to the network or filesystem except through the connections you granted it. Access to production data is limited to the people who operate the service.

No system is perfectly secure, and we are a young product. We would rather tell you what we actually do than imply a certification we do not hold: Croft has not completed a SOC 2 or ISO 27001 audit.

Retention and deletion

We keep what you create for as long as your account and workspace exist. Croft does not currently apply an automatic expiry to workflows, runs, step records, stored data, or the record of email sent — a run from a year ago is still there, on purpose, because being able to look back at what an automation did is much of the point. Sign-in links and codes are the exception: they are short-lived and are destroyed as soon as they are used or fail too many attempts.

You can delete individual workflows, documents, files, records, and artifacts yourself from within the product, and you can disconnect a connected account at any time, which removes the stored credential.

Deleting a whole account or workspace is not yet self-service. Email [email protected] and we will delete your account, your workspaces, and the content in them. Deleting a workspace removes its workflows, runs, step records, stored email, artifacts, and connections along with it. Backups may retain a copy for a short period after deletion before they age out.

Your choices

You can ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. Your workspace content is exportable from the product — workflow source, stored documents, files, and records can all be downloaded — and we will help if you want everything at once. Depending on where you live you may have additional rights under laws such as the GDPR or the CCPA; we apply the requests above to everyone regardless of where they live.

Croft is not intended for children, and we do not knowingly collect information from anyone under 16.

Changes to this policy

If we change how Croft handles your information, we will update this page and move the date at the top. If a change materially reduces your protections, we will tell account holders by email rather than relying on you to notice.