Privacy Policy

Cronevra is a product in the Evra family. It shares one account and one subscription with Rankevra, Optimevra and Promevra — there is no separate Cronevra login and no separate Cronevra billing. Account questions are handled at Evra; anything Cronevra-specific can go to contact@cronevra.com.

• Your account — email, name and avatar, held once for the whole Evra family rather than per product. If you sign in with Google we receive your email address, name and profile picture, and nothing else.
• Your jobs — the target URL, HTTP method, schedule, time zone, timeout and alert preferences.
• Request secrets — bearer tokens, custom headers and request bodies, encrypted before storage (see below).
• Execution records — for each run: when it was scheduled and started, how long it took, the HTTP status, any error, and a short excerpt of the response.
• Usage counters — how many executions, tests and alert emails you used in the current billing period.

Bearer tokens, custom headers and request bodies are encrypted with AES-256-GCM before they reach the database, and decrypted only inside our servers at the moment a request is sent.

They are never returned to your browser after you save them — not to you, not behind a “reveal” button. Editing a job shows a masked placeholder; leaving the field blank keeps the stored value. Header names are encrypted along with their values, because a header called X-Internal-Staging-Token reveals something about your infrastructure even with the value hidden.

We never store full response bodies. A request stops downloading at 1 MB, and only a short excerpt is kept — between 256 bytes and 4 KB depending on your plan.

Before that excerpt is written to the database it is scanned for credential-shaped strings — bearer tokens, API keys, JWTs, secret-named JSON fields — and those are replaced with [redacted]. Redaction happens before storage, not before display, so a secret your endpoint echoes back is not sitting in our database waiting to be read by some future feature.

• Execution history — 3 days on Free, 7 on Starter, 30 on Growth, 90 on Scale. Older records are deleted automatically.
• Jobs and secrets — until you delete the job. Deleting a job stops it immediately and removes its stored secrets.
• Your account — until you close it. That is handled at Evra, since the account is shared.

Cronevra sends HTTP requests to the URLs you configure. Those requests come from our infrastructure, carry a CronevraBot/1.0 user agent, and include whatever headers or body you configured. The operator of that endpoint will see our IP address, not yours.

We refuse to make requests to private networks, loopback addresses, link-local addresses and cloud metadata endpoints — including when a public URL redirects to one. That is a safety limit on our side, not a privacy promise about your endpoint.

• Supabase — the PostgreSQL database holding everything above.
• Render — application and worker hosting.
• Resend — delivery of failure and recovery alert emails. They receive your email address and the alert content.
• Google — only if you choose to sign in with Google.
• Stripe, via Evra — subscription billing. Cronevra holds no card details and processes no payments; it only reads which plan your account has.

Cronevra sets a session cookie when you sign in, and stores your light/dark preference and sidebar state in your browser. That is all. There are no advertising cookies, no third-party analytics and no tracking pixels.

You can delete your jobs from the dashboard at any time, and close your Evra account to remove the underlying record. Deleting a job removes its stored secrets immediately; its execution history stays until the retention window above expires, so a record of what ran is not erased by deleting the job that ran it.

There is no self-serve export yet. For a copy of your data, or for any access or deletion request the dashboard does not cover, email contact@cronevra.com.

If this policy changes in a way that affects what we collect or how long we keep it, we will update the date at the top and notify account holders by email before the change takes effect.