Privacy policy

Last updated 2026-11-07

This policy explains what personal data Crewly collects, why, where it is stored, and the choices you have. It applies to the website at crewlyhub.com, the web app at app.crewlyhub.com (together, the "Service"), and the Crewly desktop app. Effective date: 2026-11-07.

1. Who we are

Crewly is operated by an individual developer ("Crewly", "we", "us"). We are the controller of the personal data described in this policy. You can reach us at support@crewlyhub.com.

2. Data we collect

Account data

If you sign up with email: your username, display name, email address, whether the address is verified, and your password. We never store the password itself, only a salted hash of it.
If you sign in with Google or GitHub: the identifier that provider gives your account, and the email address (and whether it is verified), name and avatar URL that the provider shares with us. We ask Google for the openid email profile scopes and GitHub for read:user user:email. We use the access token the provider issues only to read this profile during sign-in; we do not store it, and we cannot act on your Google or GitHub account.
Optional profile details you add, such as an avatar and display preferences.

Sessions and security data

When you sign in we create a session. We store a hash of the session token, when it was created and last used, when it expires, the IP address and the browser's user agent. You can see and end your sessions in your account settings.
We use IP addresses and email addresses to limit how often sign-in attempts and emails can be made, to stop abuse. These counters are kept in memory and are not stored long term.
If human verification is enabled on the sign-up page, Cloudflare Turnstile processes your IP address and browser signals to tell people from bots.

Workspace content

The things you and your teammates put into the web app: organizations, offices, members and invitations, tasks, threads and chat messages, meetings and minutes, schedules, inbox items, agent and office settings, and usage records (token counts and cost per agent turn). Content you post in a shared office can be seen by the other members of that office.

Email delivery data

To verify your email address and reset passwords we send transactional email. Our email provider receives the recipient address, subject and message (which contains a one-time link) and keeps delivery records such as whether the message was delivered or bounced. We do not send marketing email.

Messages you send us

If you email support, we keep the conversation so we can help you.

What we do not collect

The website and web app do not use analytics or advertising trackers, and we do not buy data about you from third parties. Our hosting providers may keep short-lived operational logs (for example, request metadata and errors) to run and protect their networks.

3. Your code and repositories

Crewly's coding agents are designed to run on your own computer, using your own Claude Code or Codex sign-in. Today that happens in the Crewly desktop app, which runs its service locally on your Mac and keeps its data (offices, tasks, agent definitions and memory, connector secrets, knowledge bases, and the repositories you connect) on that computer. The desktop app does not upload this data to Crewly's servers.

The web app does not read your repositories. We are building a feature that connects your computer to the web app so you can assign work from a browser. When it ships, the plan is that repository contents, full run logs and credentials stay on your computer, and only what you or your agents explicitly put into tasks, threads or chats (for example a summary or a code snippet in a message) is stored on our servers. We will update this policy before that feature launches.

When an agent runs, the AI command-line tool on your computer sends prompts (which may include code) to its provider, such as Anthropic or OpenAI, under your own account with them. That exchange is governed by your agreement with that provider, not by Crewly.

4. How we use data

To create and secure your account, sign you in and keep you signed in (performance of our contract with you).
To provide the Service: store and show your workspace content to you and the members you invite (contract).
To send verification and password reset emails (contract).
To prevent abuse, fraud and attacks, for example by rate limiting by IP address (our legitimate interest in keeping the Service secure).
To answer your support requests, and to comply with legal obligations.

We do not use your workspace content to train AI models, and we do not use your data for advertising.

5. Where data is stored

All servers that store Service data are in the United States. Our service providers (processors) are:

Provider	What it does	Location
Fly.io	Runs the web app server and stores office data (tasks, threads, meetings, schedules and other workspace content)	USA, us-east (Ashburn, Virginia)
Neon	Managed Postgres for the account database: users, sign-in identities, sessions, organizations, offices and memberships	USA, AWS us-east-1
Resend	Sends transactional email	USA
Cloudflare	DNS, hosting and CDN for this website, email forwarding for support@crewlyhub.com, and optional bot protection on sign-up	Global network; USA

If you sign in with Google or GitHub, those companies also process data under their own privacy policies. If you are outside the United States, your data is transferred to and processed in the United States.

We do not sell or rent your personal data, and we do not share it for cross-context behavioral advertising. We share data only with the providers listed above so they can run the Service for us, with members of the organizations and offices you join, when you ask us to, or when required by law or to protect the rights and safety of our users and the Service. If Crewly is ever transferred to a new owner, this policy will continue to apply to your data, and we will tell you in advance.

7. Cookies and local storage

We do not use advertising or analytics cookies. The web app uses:

crewly_session: keeps you signed in. HttpOnly, sent only to the web app, lasts up to 30 days or until you sign out.
crewly_oauth: a short-lived cookie (about ten minutes) used only while you sign in with Google or GitHub, to protect that sign-in from forgery.
crewly_signed_in (when set): a hint with the value 1 and no personal data, readable by crewlyhub.com, so this website can show "Go to workspace" instead of "Get started".

This website and the web app also save display preferences, such as your light or dark theme, in your browser's local storage. They stay on your device.

8. Retention and deletion

We keep your data while your account is active. Expired sessions are removed automatically.

You can delete your account in the web app under account settings. If you are the last owner of an office or organization that other people still use, you first need to hand ownership to someone else. When you delete your account:

you are signed out everywhere, and your password and Google or GitHub sign-in links are removed immediately, so the account can no longer be used;
you are removed from every organization and office; an organization where you were the only member is closed and its invitations are revoked;
the account record is marked deleted. Messages and other content you posted in offices that others still use stay in those offices, so your teammates' history remains intact.

If you want the remaining account record and your content permanently erased, email support@crewlyhub.com from the address on the account and we will do so within 30 days, unless we must keep something to comply with the law. Copies in our providers' backups expire on their own schedule.

9. Security

We use measures appropriate to a service of this size, including:

HTTPS (TLS) for all traffic to the website and web app, and encrypted, certificate-checked connections to the account database;
passwords stored only as salted scrypt hashes; session tokens and one-time email links stored only as hashes;
sessions in HttpOnly, SameSite cookies, with protections against cross-site requests and repeated failed sign-ins.

No system is perfectly secure. If we learn of a breach that affects your personal data, we will notify you and the authorities as the law requires.

10. Your rights

Depending on where you live (for example under the GDPR in the EU and UK, or the CCPA in California), you may have the right to access the personal data we hold about you, get a copy of it in a portable format, correct it, delete it, restrict or object to some processing, and withdraw consent where we rely on it. You can edit most account details yourself in settings. For anything else, including a data export, email support@crewlyhub.com. We will respond within 30 days and may ask you to confirm you own the account. We will not treat you differently for exercising these rights. You can also complain to your local data protection authority.

11. Children

The Service is not intended for children. You must be at least 13 years old to use it, or older if the law where you live requires it. We do not knowingly collect data from children under 13; if you believe a child has given us data, contact us and we will delete it.

12. Changes and contact

We may update this policy as Crewly changes. We will change the date at the top, and for material changes we will tell you by email or in the app before they take effect. Questions or requests: support@crewlyhub.com.