Privacy policy
Last updated 30 September 2026
In short
Criw keeps what your agents need to do their jobs, and nothing more. What you tell your agents and the files they make are yours. We store them in the EU, don't sell them, don't show you ads, and don't use them to train models. Passwords and keys you give your agents are sealed and never shown back to anyone.
Who we are
Criw is made and run by Marc Torrelles, an individual based in Spain, the controller of your personal data under the EU General Data Protection Regulation (GDPR). "We" in this policy means Marc. Write to privacy@criw.app about anything in it.
What we collect
- Your account. Your email address, or none at all if you start as a guest on your phone. If you sign in with Apple or Google, we receive your verified email from them and nothing else from your profile.
- What you give your agents. Messages, voice messages, files, instructions, memories, routines, rules and group chats. A voice message is turned into text and the recording isn't kept.
- Credentials you hand over. Passwords, API keys and sign-ins to connected apps (Gmail, Notion, Slack and others). Each one is sealed, opened only at the moment an agent uses it, and never written to a log or shown in the app.
- Usage and billing. What each run cost, your credit balance, your plan, your purchases and your daily computer time. Card details go to the payment provider and never reach us.
- How you use the apps. Counts of what you do in Criw (which screens you open, that you sent a message, that an agent finished a job, how long it took, what it cost and which model it ran on, which connectors you added), with your plan, platform, app version and language and when your account was made, kept under your account id. Never what you or your agents wrote: no messages, names, files or addresses. Turn it off in Settings → Share usage analytics.
- Devices. Notification tokens for your phone and computer, so we can tell you when an agent needs you.
- Technical logs. Errors and request records we need to keep the service running. They never contain your messages, keys or voice.
This site sets no cookies and runs no analytics. The desktop app keeps you signed in with one cookie, criw_session.
How we use it, and why we're allowed to
- To run the service you asked for: your agents, their routines, notifications and billing. Legal basis: our contract with you.
- To keep Criw secure and working: preventing abuse, fixing faults. Legal basis: our legitimate interest in a service that works.
- To meet legal duties: keeping records of payments. Legal basis: legal obligation.
- To learn what to make better: the usage counts above. Legal basis: our legitimate interest in improving Criw. You can object at any time by turning off Share usage analytics in Settings; from then on nothing is counted, on any device.
We don't sell your data, use it for advertising, or use it to train AI models. We don't read your agents' conversations, except to investigate a problem you report or when the law requires it.
How your agents use AI models
To think, an agent sends the model you picked what it needs for the job at hand: its instructions, the conversation and the relevant memories and files. We route those calls through OpenRouter to the model's provider. Each provider handles that data under its own terms, and we use only providers that OpenRouter lists as not training on it. If you use your own OpenRouter key, your account's settings with OpenRouter apply.
Where it lives
Criw runs on Cloudflare. Your agents, their memories and conversations, and every file in your workspace are stored in Cloudflare's EU jurisdiction and stay there. Your account record (email, sessions, purchases) is stored in Western Europe. When an agent calls a service outside the EU at your request, such as a model provider or a website, the data sent for that one task leaves the EU under the safeguards that service provides (the EU–US Data Privacy Framework or Standard Contractual Clauses).
Who helps us
These companies process data on our behalf, only for the purpose listed:
| Company | What for | What they see |
|---|---|---|
| Cloudflare | Hosting and storage | Everything stored in Criw, encrypted at rest |
| OpenRouter | Routing model calls to the provider you choose | What an agent sends a model for a task |
| Parallel | Searching and reading pages | The searches and addresses an agent looks up |
| Fly.io | The agents' computer: its terminal and browser | The commands an agent runs, the files it works on, and the pages its browser visits and stays signed in to |
| Composio | Signing in to Gmail, Google Calendar and Google Drive | Your Google sign-in, and the mail, events and files an agent reads or writes there |
| Resend | Emailing your sign-in codes | Your email address |
| Sentry | Crash and error reports | An account id, your device and app version, and what went wrong |
| Mixpanel | Usage analytics, stored in the EU | An account id, your plan, platform, app version and language, when your account was made, and counts of what you use in Criw (which features, models and connectors); never what you write |
| RevenueCat | Pro and credit purchases on every platform | Your purchases and an account id |
| Stripe | Card payments in the desktop app, through RevenueCat | Your payment details and email |
| Apple | Sign in with Apple, App Store purchases, iPhone notifications | Your email; purchases; a device token and the notification text |
| Sign in with Google, Google Play purchases, Android notifications | Your email; purchases; a device token and the notification text |
The apps you connect (Gmail, Notion, GitHub, Slack and others) aren't our processors: you're connecting your own account, and the data your agents read and write there is under that service's terms.
How long we keep it
For as long as your account is open. Deleting an agent, file or conversation removes it, and backups roll over within 30 days. When you delete your account, everything in it is gone within 30 days, except the payment records the law requires us to keep (six years in Spain). A guest account nobody has opened for 12 months is deleted.
Your rights
You can ask to see, correct, export or delete your data, object to how we use it, or restrict it. Most of it is in the app already: your agents, files and spending are yours to open, download or delete, and you can delete your whole account from Settings. For anything else, write to privacy@criw.app and we'll answer within a month. You can also complain to the Spanish data protection authority, the AEPD (aepd.es), or the one where you live.
Children
Criw isn't for anyone under 16. If you think a child has an account, tell us and we'll delete it.
Changes
If we change this policy in a way that matters, we'll tell you in the app or by email before it applies.