Terms of Service

These terms are an agreement between you and KeepFlow L.L.C-FZ, Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E., registered with Meydan Free Zone, Dubai, license no. 2646796.01, formation no. 2646796 ("Crunu", "we", "us"). They cover the crunu.com website, the hosted service at app.crunu.com and the Crunu software we provide for use with it: the web app, the crunu agent and command-line tool, and the CI integrations. Together we call these "the service".

By creating an account or using the service, you accept these terms, the Acceptable Use Policy and the Privacy Policy. If you use Crunu on behalf of a company or other organization, you confirm that you may accept these terms for it, and "you" includes that organization.

1. Early access

• Price. The service is free during early access. If we introduce paid plans, we'll announce them at least 30 days in advance, and we won't charge you unless you choose a paid plan.
• The service is still changing. Features can change, be limited or be removed. The current limits, such as the maximum size of an environment and the number of projects in an organization, are listed on the pricing page.
• No availability commitment. We don't promise any level of uptime and offer no service-level agreement. We may pause the service for maintenance or to deal with incidents, sometimes without notice.
• Ending early access. We may end early access or stop offering the service. Unless the law or a security threat forces us to stop sooner, we'll give at least 30 days' notice by email so you can export your data.

2. Your account

• You must be at least 16 years old and able to enter into a binding contract where you live.
• Use an email address you control and keep it current. We use it for sign-up codes and important notices.
• An account is for one person. To work with others, invite them to your organization instead of sharing an account.
• You're responsible for what happens under your account and under the machines and service tokens you create.
• We strongly recommend turning on a second factor, either an authenticator app or a passkey.

3. Your password, Secret Key and recovery code

Your account key is derived on your devices from two parts: your password and your Secret Key. We never receive either one. This is what keeps your data unreadable to us, and it has a direct consequence:

• Keep your Emergency Kit and recovery code somewhere safe and separate from your devices.
• If every owner and admin of an organization loses access, nobody can manage that organization any more. Members can still read the environments they already hold keys for. Keep at least two owners, or an owner and an admin, in every organization.
• A recovery code opens your account after a waiting period, without your second factor. Store it as carefully as the Secret Key.

4. Your content

• What it is. Your content is everything you put into the service: the values, files and notes you store, and the names you give to organizations, projects, environments, machines and other items.
• You keep it. You keep all rights to your content. You allow us to store, copy, transmit and process it only as needed to run the service for you. Values travel and rest as ciphertext. Names and other metadata are stored in readable form, as the Privacy Policy explains.
• You're responsible for it. You confirm that you're allowed to store and share your content. Store only credentials you are authorized to hold.
• Keep your own copy. We take care to keep the service's data intact, but during early access you should keep your own copy of anything you can't afford to lose. The app can download an offline copy of your environments that opens with your password and Secret Key, without our servers.

5. Organizations

• Owners and admins control an organization: who joins, who gets which environments, settings such as how long the audit log is kept and whether personal environments can be recovered, and whether the organization is deleted.
• When you join an organization, its owners and admins can see your activity in its audit log, including IP addresses.
• Removing a member stops the service from delivering anything to them and rotates the keys of the environments they had. It can't erase what they already saw. You should reissue those secrets at the providers that issued them.
• An organization is responsible for how its members use the service on its behalf.

6. Machines, tokens and other services

• You're responsible for the machines that run the crunu agent and for the CI systems where you keep service tokens. Anyone with full administrative access to a machine can read what the service delivers to it.
• When you connect the service to other products, such as a CI provider, a cloud platform or a webhook receiver, their own terms apply to them. We aren't responsible for those products.

7. Acceptable use

You agree to follow the Acceptable Use Policy. In short: don't use Crunu to break the law, don't hold credentials you aren't authorized to hold, don't try to reach data that isn't yours, and don't strain or abuse the service.

8. Software license

• We grant you a personal, non-exclusive, non-transferable license, which we may revoke, to install and use the Crunu software to access the service or a Crunu server you are allowed to use, for as long as you follow these terms.
• You may inspect the software and its behavior for good-faith security research under the rules in the Acceptable Use Policy.
• Don't sell, rent or sublicense the software, and don't remove its notices or misrepresent where it comes from.
• Releases are signed. We publish updates, and older versions can stop working with the service. The service currently requires agent version 6.0.0 or later.
• The service, the software, and the Crunu name and logo belong to us. These terms give you no rights to them beyond those stated here.

9. Feedback

If you send us suggestions, we may use them freely, without any obligation to you.

10. Reporting security issues

Report vulnerabilities to security@crunu.com. The Acceptable Use Policy sets out the rules for testing.

11. Closing your account, and suspension

• You can leave at any time. Delete your account in the app. Deletion asks for your password and Secret Key. If you are the only owner of an organization, first hand ownership to someone else or delete the organization.
• We may suspend or close an account or an organization that breaks these terms or the Acceptable Use Policy, puts the service or other users at risk, or exposes us to legal liability. When we can, we'll tell you first and give you a chance to export your data, unless the law or the risk involved doesn't allow it.
• After closure, we delete data as described in the Privacy Policy.
• Sections 4, 8, 9, 12, 13, 14, 16 and 17 continue to apply after these terms end.

12. Disclaimers

To the extent the law allows, the service and the software are provided "as is" and "as available", without warranties of any kind, whether express or implied. That includes warranties of merchantability, fitness for a particular purpose, non-infringement, and uninterrupted or error-free operation.

On-device encryption reduces risk but doesn't remove it. The known limitations page lists what the design doesn't protect against, such as malicious software on a device where your keys are in use.

13. Limitation of liability

To the extent the law allows:

• we aren't liable for indirect, incidental, special, consequential or punitive damages, or for loss of profits, revenue, data or goodwill, or for the cost of replacing credentials, even if we were told such loss was possible;
• our total liability for all claims relating to the service is limited to the greater of the amount you paid us for the service in the 12 months before the claim and 100 US dollars.

Nothing in these terms limits liability that the law doesn't allow to be limited, such as liability for fraud or willful misconduct.

14. Indemnity

If you use the service for a business, you'll defend and indemnify us against third-party claims that arise from your content or from your breach of these terms, and you'll cover reasonable costs that result from them.

15. Changes to these terms

We may update these terms. For material changes, we'll email account holders and publish the new version on this page at least 30 days before it takes effect, unless a change is required sooner by law or to keep the service secure. If you continue to use the service after a change takes effect, you accept it. If you don't agree, stop using the service and delete your account.

16. Governing law and disputes

These terms are governed by the laws of the Emirate of Dubai and the federal laws of the United Arab Emirates that apply there. The courts of Dubai have exclusive jurisdiction over any dispute about these terms or the service.

Before starting formal proceedings, please contact us at support@crunu.com and give us 30 days to try to resolve the issue. If you are a consumer, nothing in this section takes away protections that the law of your country gives you and that can't be waived by contract.

17. General

• Entire agreement. These terms, the Acceptable Use Policy and the Privacy Policy are the whole agreement between you and us about the service.
• Severability. If a court finds part of these terms unenforceable, the rest stays in effect.
• No waiver. If we don't enforce a term right away, we can still enforce it later.
• Assignment. You may not transfer these terms without our written consent. We may transfer them as part of a merger, acquisition or reorganization, and we'll tell you if we do.
• Notices. We send notices to the email address on your account. Send notices to us at support@crunu.com.
• Events outside our control. We aren't responsible for delays or failures caused by events we can't reasonably control, such as outages at our providers, network failures or natural disasters.
• Language. If we translate these terms, the English version prevails.

Contact

KeepFlow L.L.C-FZ, Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E.. Email support@crunu.com.