How Cromus Protects Your Data

Last updated: August 4, 2026

Cromus respects your privacy and is committed to protecting your personal information. This Privacy Policy explains exactly what Cromus collects, how it is used and stored, who it is shared with, how long it is retained, and how to contact us. It applies to the Cromus platform, the public website, and the Cromus MCP server at mcp.cromus.ai.

For the terms governing your use of the platform, see our Terms of Service.

1. Data Collection Practices

Cromus collects only the categories of data listed below:

  • Account data — email address and a bcrypt-hashed password. Plain-text passwords are never stored.
  • Workspace content — SKILL.md, ETHOS.md, MEMORY.md, and GRAPH.md files; SOP text you paste or upload.
  • Workflow graph data — nodes, edges, and version history of workflows you build in the visual editor.
  • Cost simulation inputs — workflow size, model selections, run-volume estimates.
  • Reality Check telemetry — predicted vs. actual run data you submit to the closed-loop learning engine.
  • Usage CSV uploads — OpenAI / Anthropic usage exports you upload via the CSV Usage Uploader.
  • OAuth client metadata — client_id, redirect URIs, and registered scopes for connected third-party clients (e.g., Claude Cowork, Codex CLI).
  • Quiz responses — verdict tier and pain-point answers from the Croms™ Diagnostic Quiz.
  • Analytics data — page views and standard interaction metrics from Google Analytics 4, plus selected product events through Replit-hosted analytics when enabled in Publishing settings. Custom event properties are limited to predefined categories and counts; they do not include email addresses, account or workflow IDs, uploaded filenames or contents, secrets, or user-written text.

2. Usage and Storage

  • Workspace content (SKILL.md, ETHOS.md, MEMORY.md, GRAPH.md, SOPs, workflow graphs) is processed exclusively by Cromus's deterministic engines — the cost simulator, Croms scoring engine, and validators. No external LLM calls are made in the scoring, simulation, or validation paths.
  • Data is stored in PostgreSQL hosted in the United States.
  • All traffic is encrypted in transit over HTTPS, and database storage is encrypted at rest.
  • Passwords, API keys, OAuth client secrets, OAuth authorization codes, OAuth access tokens, and OAuth refresh tokens are bcrypt-hashed at rest with prefix-indexed lookup. Plaintext secrets are never persisted.
  • OAuth token TTLs: authorization codes expire in 60 seconds, access tokens in 1 hour, refresh tokens in 30 days. Refresh tokens rotate on every use; reuse of a revoked token revokes the entire chain.

3. Third-Party Sharing

Cromus shares data with the following third parties only for the purposes listed:

  • Stripe — payment processing. Receives billing email and payment metadata. Raw card data never crosses Cromus servers.
  • PayPal — alternative checkout. Same scope as Stripe.
  • Resend — transactional email (password reset, quiz reports, internal notification workflows). Receives recipient email address and message body.
  • Notion — only when the operator has configured the optional Quiz Lead Routing workflow with their own NOTION_API_KEY. Never automatic.
  • Google Analytics 4 — website page views and standard interaction metrics.
  • Replit-hosted analytics — when enabled in Publishing settings, receives page views and selected custom product events. Cromus custom event payloads contain only predefined, non-sensitive categories and counts; they exclude account identifiers and user-generated content.
  • Anthropic / Claude (via the MCP connector) — only when you install Cromus as a connector inside Claude. Only the tool inputs you send and the structured tool responses Cromus returns cross the MCP boundary.

No customer data is sent to external LLM providers for processing. All Cromus scoring, simulation, and validation runs in deterministic engines hosted by Cromus. The Cromus MCP server returns only structured tool responses to Claude; no LLM call is invoked by Cromus on the customer's behalf.

Cromus does not sell user data and does not share data with advertising networks.

4. Token Usage Tracker

The Token Usage Tracker is available to signed-in users in the Cromus workspace. It accepts CSV exports from OpenAI, Anthropic, Google AI Studio, and OpenRouter, and processes usage data to compute spend totals, token volumes, model mix, and deterministic waste signals.

  • Account storage — normalized row-level data (date, provider, model, token counts, cost) is stored in your account and deduplicated by (date, model, provider) to prevent double-counting across re-uploads. Raw CSV bytes are never stored.
  • No LLM calls — all analysis (waste signals, cost totals, charts) is computed deterministically server-side. No data is sent to any external AI provider as part of the Tracker feature.
  • Deletion — individual uploads can be deleted from your dashboard. Deleting an upload removes the upload record; aggregated row data tied to your account is preserved so that re-upload deduplication remains accurate. To delete all tracker data, delete your account or email contact@cromus.ai.

5. Data Retention

  • Active accounts — data retained for the duration of the active subscription plus a 90-day grace period.
  • Cancelled or deleted accounts — hard deletion of all personally identifiable data 30 days after cancellation.
  • OAuth tokens — refresh tokens expire after 30 days. Access tokens expire after 1 hour. Tokens are revoked immediately when you disconnect a client.
  • Workflow execution runs — the most recent 12 months of run-level telemetry are retained. Older runs are aggregated into monthly summaries or purged.
  • User-initiated deletion — email contact@cromus.ai; we confirm deletion within 14 days.
  • Anonymized aggregate data — Cromus may retain anonymized, aggregate metrics (e.g., distribution of Croms scores, average optimization deltas) after deletion. All direct identifiers — email, user ID, workspace ID, workflow names, SKILL.md content, and OAuth client metadata — are stripped. Aggregates cannot be reverse-mapped to an individual user.

6. Contact Information

  • Email: contact@cromus.ai
  • Business entity: CROMUS LLC, Florida, USA
  • Response SLA: within 5 business days

7. Cookies and Local Storage

  • Session cookies — Cromus uses a server-side session cookie to keep you logged in. This cookie is essential to platform operation and cannot be disabled while using the authenticated app.
  • Local storage — The app stores lightweight UI state (theme preference, dismissed banners, editor layout) in your browser's local storage. This data never leaves your browser and is not sent to our servers.
  • Analytics technologies — Google Analytics 4 measures website page views and standard interactions. Replit-hosted custom analytics is used only when enabled in Publishing settings and the app is published. Custom event payloads omit account identifiers and user-generated content.
  • No advertising or third-party tracking cookies — Cromus does not use advertising networks, retargeting pixels, or cross-site tracking cookies of any kind.

You can disable cookies in your browser settings, but doing so will prevent the authenticated platform from functioning.

8. Children's Privacy

Cromus is not directed at children under the age of 13 (or under 16 in the European Economic Area). We do not knowingly collect personal information from children. If you believe a child has provided personal information to Cromus, please contact contact@cromus.ai and we will delete it promptly.

9. Your Rights

Depending on your location, you may have rights under applicable privacy law, including the California Consumer Privacy Act (CCPA) and the EU/UK General Data Protection Regulation (GDPR):

  • Access — request a copy of the personal data we hold about you
  • Deletion — request deletion of your personal data
  • Correction — update inaccurate or incomplete information
  • Portability — export your workspace content (SKILL.md, ETHOS.md, MEMORY.md, GRAPH.md)
  • Opt-out of sale — Cromus does not sell personal data; no opt-out is necessary
  • Restriction / objection — request that we restrict or stop processing your data in certain circumstances (GDPR)

To exercise any of these rights, email contact@cromus.ai. We will respond within 30 days (or the timeframe required by applicable law).

10. Changes to This Policy

This Privacy Policy may be updated periodically. Material changes will be posted on this page with a revised "Last updated" date. Continued use of the platform after the effective date constitutes acceptance of the updated policy.