Legal documents

Privacy Policy

What personal data Crunu processes, what it can never read because values are encrypted on your devices, how long records are kept, and your rights.

Effective: October 27, 2026
Version: 1.0
Last updated: October 27, 2026

On this page

This policy explains what personal data KeepFlow L.L.C-FZ processes when you visit crunu.com and when you use the Crunu service at app.crunu.com, why we process it, how long we keep it, and what you can ask us to do with it. In this policy, "Crunu", "we" and "us" mean KeepFlow L.L.C-FZ.

Crunu is built so that the values you store are encrypted on your devices before they reach us. We hold the encrypted form and never the keys. Most of what follows is about the information the service needs to work around those encrypted values: who you are, which teams you belong to, and what happened when.

Who is responsible

KeepFlow L.L.C-FZ runs crunu.com and app.crunu.com and decides how the personal data described here is used.

Address: Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E.
Registration: Meydan Free Zone, Dubai, license no. 2646796.01, formation no. 2646796
Privacy questions and requests: support@crunu.com

What we cannot see

These never reach us in readable form:

Your stored values. Variables, credentials files, notes, file names and paths inside an environment are encrypted on your device. The service receives and stores only ciphertext.
Your password and Secret Key. Your account key is derived from both on your device. Neither is sent over the network in any form.
Your recovery code. The service keeps a copy of your account key that only the code can decrypt.
The key in a share link. It sits in the part of the link after #, which browsers don't send to servers.

Because we never hold these keys, we can't read your data, hand it to anyone in readable form, or restore it if you lose your password and Secret Key.

What the service processes

To run app.crunu.com, the service stores and uses the following. All of it is readable to us, so avoid putting secrets into names.

Category	What it includes	Why
Account	Email address, the name you enter, when the account was created	To identify you, sign you in and write to you about your account
Team structure	Names of organizations, projects, environments, machines, service tokens, access profiles and network lists; memberships and roles; invitations and the addresses they were sent to	To show your workspace and decide who may receive what
Membership certificates	Records signed by each organization you join, holding your name, email address, role and public keys	So apps and agents can check who signed each change, including changes made by former members
Devices and sessions	Device name and type, browser user agent, IP address, sign-in and last activity times	To keep you signed in, list your sessions and flag sign-ins from new devices
Account recovery	When someone uses a recovery code for your account: the time, IP address and browser user agent of the request	To alert you and let you cancel an attempt that isn't yours
Second factor	Authenticator app secret, stored encrypted with a key held by the service; public part and name of each passkey or security key	To check your second factor
Versions	Who saved each version of an environment, when, its number and its size	To keep history, detect conflicts and enforce size limits
Audit log	Actions in an organization (sign-ins, invitations, role and access changes, saved versions, key rotations, machine and token activity, share link use, denied requests, network policy changes), who performed them, when and from which IP address. It also holds the reveal, copy and export events your app reports	So owners and admins can review activity. Entries form a hash chain, so edits and deletions show up when the log is verified
Delivery records	Which version of which environment each person, machine or token received, when, how many times and from which IP address	To produce the exposure report when someone leaves
Machines and tokens	Names, last IP address, lease and renewal times, enrollment code use and the address it came from	To deliver environments to servers and CI, and to raise alerts on unusual use
Networks	The IP ranges in your organization's network lists, and the addresses of denied requests	To serve environment contents only to allowed networks
Email codes	A keyed hash of each single-use code for sign-up and for confirming invitation addresses	To confirm that you control an email address
Alerts	Alert events and the notification channels your organization sets up, such as webhook addresses and recipient emails. Webhook secrets are stored encrypted with a key held by the service	To notify your team about events worth a look
Abuse protection	Counts of failed sign-ins and code requests per IP address and per account over short windows	To slow down password guessing and email flooding
Messages to us	Your email address and what you write when you contact us	To answer you

Who in your organization can see your data

When you join an organization, its owners and admins can see:

your entries in the organization's audit log, including the IP addresses recorded with your actions;
the delivery records showing which versions you received, when and from where;
your membership, role and the devices and sessions you use in that organization.

Each organization has an organization recovery key held by its owners and admins. While the organization's setting for recovering personal environments is on, which is the default, they can use that key to open your personal environments in that organization if your account is lost. An owner can turn the setting off.

Anyone you give access to an environment can read and copy its values. Hiding values in the app is a display choice, not a barrier to someone who already holds the key.

The crunu.com website

The marketing site has no accounts, sets no cookies and runs no advertising trackers.

Hosting. Vercel serves the site. To deliver pages, it processes your IP address and the details your browser sends with each request.
Analytics. We use Vercel Web Analytics and Vercel Speed Insights. They record page views and loading performance: the page address, referrer, approximate location, browser, operating system and device type. They set no cookies and are not tied to your IP address. Web Analytics tells visits apart with a hash of the request that changes every day, so it can't follow you from one day to the next or across other sites.
Signing up. When you enter your email address on crunu.com, the site passes it to the app in the part of the link after #. The site's servers never receive it. The app sends it to the service only when you ask for a sign-up code.

Storage in your browser and on your computer

The app at app.crunu.com doesn't use cookies. It keeps a device key in your browser's storage, along with the signed state it has already checked, so it can recognize the device and spot an outdated response from the server. If you choose to remember your email and Secret Key on a device, the app stores them there too, so you don't have to type the Secret Key on every sign-in. The crunu command-line tool keeps its keys in files that only the system account running it can read. These items exist so the service works. We don't use them to track you.

Email

We send email through Resend from mail.crunu.com:

sign-up codes;
codes that confirm the address on an invitation;
alert emails, if your organization turns them on.

Alert emails describe events, such as a sign-in from a new device. They can include names and IP addresses. They never contain secret values, because the service doesn't have them.

Why we process personal data

To provide the service you asked for. Account, team structure, sessions, versions, delivery and email data are needed to perform our agreement with you, the Terms of Service.
To keep the service secure. Audit logs, alerts, abuse counters and request logs rely on our legitimate interest, and your organization's, in detecting misuse and proving what happened.
To meet legal obligations, for example answering valid legal requests or keeping records the law requires.

We don't sell personal data, don't use it for advertising and don't use it to train machine learning models.

Who else receives personal data

Service providers. Cloudflare, Resend and Vercel process data for us. The subprocessors page lists what each one does and where.
Your organization. As described above.
People you share with. Recipients of a share link receive the files you chose to share.
CI providers. If you link a service token to a CI provider, the service downloads that provider's public keys to check its tokens. It doesn't send your data to the provider.
Authorities. We disclose data only when the law requires it and after checking that the request is valid. We can hand over only what we hold: account details, metadata, logs and ciphertext. Where the law allows, we tell the affected organization or person first.
A new owner of the service. If Crunu is sold or reorganized, personal data passes to the new operator under this policy, and we'll tell you before that happens.

Where data is stored

Service data. The service runs on Cloudflare's global network. Its database is a Cloudflare D1 database whose primary location is Western Europe, with no read copies elsewhere (checked 2026-10-27). Each request is handled in the Cloudflare data center closest to you, which can be in any country.
Email. Resend sends our email from its EU region in Ireland and stores email data in the United States.
Website. Vercel serves crunu.com from its global network and processes data in the United States and other countries where it operates.

Cloudflare, Resend and Vercel are based in the United States. They protect international transfers with the European Commission's Standard Contractual Clauses and their Data Privacy Framework certifications, as described in their own terms linked on the subprocessors page.

How long we keep it

Data	How long
Account	Until you delete the account
Devices, sessions, second factors, recovery codes and personal alert settings	Removed as soon as you delete your account
Sessions	Expire after 12 hours without activity and after 7 days at most. A cleanup task removes expired sessions every few minutes
Audit log	365 days by default. Owners can extend this for their organization, up to 36,500 days or indefinitely. Older entries are removed daily, and a checkpoint keeps the remaining chain verifiable
Delivery records	Each version's record is kept while that version is still being delivered and for 90 days after the last delivery. After that it is merged into a summary for the same person, environment and key generation, which is kept while the environment exists
Records about a deleted account inside organizations	Audit log entries stay until they age out under that organization's retention period, and delivery records follow the rule above. Membership certificates, with your name and email address, stay while the organization exists, because they are needed to verify the versions you signed. All of these are part of the organization's tamper-evident history
Deleted organization	Unavailable from the moment it is deleted. Its data, including its audit log, is removed in batches starting about 5 minutes later. The owner's own account log keeps one entry recording the deletion and the organization's name
Sign-up and invitation email codes	Valid for 15 minutes. The service keeps only a keyed hash of each code, never the code itself
Abuse counters	Minutes to a day, depending on the limit
Request logs at Cloudflare	Up to 7 days
Database restore history at Cloudflare	Up to 30 days. Deleted data can remain in this history until it ages out
Email logs at Resend	30 days
Web Analytics visitor hash	24 hours
Messages to us	As long as we need them to resolve your request and keep a record of it

Your rights

Wherever you live, you can ask us to:

tell you what personal data we hold about you and give you a copy;
correct data that is wrong;
delete your data;
give you your data in a portable format;
stop or limit some processing, or object to processing based on our legitimate interests.

You can do much of this yourself in the app: review and revoke devices and sessions, download an offline copy of the environments you can access, except those limited to specific networks, and delete your account. Deleting an account requires your password and Secret Key. If you are the only owner of an organization, you first need to hand ownership to someone else or delete the organization.

For anything else, email support@crunu.com from the address on your account. We reply within one month. We may ask you to confirm that you control the address before we act.

Some limits come from how Crunu works:

We can't give you your stored values in readable form, because we can't decrypt them. You can export them yourself while signed in.
Requests about an organization's records, such as its audit log, may involve that organization's owners. We'll tell you if we pass a request on to them.
If you lose your password, Secret Key and recovery code, nobody can open your account, including us. You can still write to us from the account's email address about deleting it.

If you think we've handled your data wrongly, you can complain to the data protection authority where you live or work. We'd like the chance to fix it first, so please write to us.

Security

The security overview explains how the encryption works, and known limitations lists what it doesn't protect against. To report a vulnerability, write to security@crunu.com.

If we learn that the service has been breached, we'll tell affected account holders by email without undue delay: what happened, what data was involved and what we recommend doing. A breach of the service exposes ciphertext and the metadata listed above, not the values in your environments: they can't be decrypted without your password and Secret Key.