Privacy policy

1.Who is responsible for your data

The controller is CRODU sp. z o.o., ul. Szlak 77/222, 31-153 Kraków, Poland, tax ID (NIP) 6762551500. Below we call it "CRODU" or "we".

For personal data matters, write to hello@crodu.com.

2.What this policy covers

This policy explains what happens to your data when you use the Crodus app connected to CRODU's server at matrix.crodus.ai. It covers the app for iPhone, iPad, Android, macOS and Windows.

• Crodus is a workplace messenger: conversations, files and AI agents.
• CRODU creates the accounts. You cannot create an account in the app.
• The policy also covers test versions, such as the one distributed through TestFlight, including people outside CRODU whom we invited to test.

The demo version, available on the first screen of the test version, runs on sample data stored in the app. It does not connect to CRODU's server or any other server and does not use the camera or the microphone. Photos and files you send in it do not leave the device. The only exception is the "Let's talk" form: if you fill it in and send it, the app passes what you entered to the crodus.ai website (section 4). If you use only the demo version and do not send the form, the only data we get about you is what the test programme, such as TestFlight, passes to us (section 4).

This policy does not cover:

• servers on which Crodus runs for CRODU's customers; there the customer is responsible for the data, and CRODU may act on its behalf;
• the crodus.ai website;
• other apps you use with the same account, such as Element.

3.In short

• The app has no ads, no tracking, no analytics and no tools that collect crash reports automatically.
• The "Let's talk" form, in which you leave us your contact details, sends data only after you tap send, and only to CRODU (sections 4 and 10). The marketing consent in it is separate and unticked by default.
• One-to-one conversations and rooms created in the Crodus app are end-to-end encrypted by default. A room created in another app or by an administrator may be unencrypted; the app labels it "Not encrypted" (section 6).
• Conversations with AI agents are usually not end-to-end encrypted. CRODU's server and the agent read them. The app asks before starting such a conversation and labels it "Not encrypted".
• The agents Croduś and Karol are set up to use only language models on CRODU's computers, not a cloud model provider. Some other bots on CRODU's server may use cloud models (section 7).
• We turn voice recordings into text on CRODU's computers and do not keep them (section 8).
• The connection between the app and the server passes through the Cloudflare network.

4.What data we process

We do not collect location, the contacts on your device or advertising data. We do not ask for special categories of data, such as health data. If you type them into a conversation yourself, they go wherever the rest of that conversation goes.

5.Device permissions

On Android the QR code is read by the Google ML Kit library, which is part of the app and runs on the device. Google may receive technical information about how the library works from it, under its own terms.

You can withdraw any permission in the system settings. The rest of the app keeps working.

The app sends the chosen photo unchanged. If the file contains where the photo was taken, the recipients may see it.

6.End-to-end encryption, in plain words

In an end-to-end encrypted conversation your device encrypts the message before sending it. Only the devices of the people in the conversation can read it, because only they have the keys. On its way through Cloudflare and on CRODU's server it is in a form that cannot be read.

• One-to-one conversations started in the Crodus app are always encrypted.
• Group rooms created in the app are encrypted by default. Encryption can be turned off when creating a room.
• A room created in another app (such as Element) or by an administrator may be unencrypted. The app labels such a room "Not encrypted".
• Conversations with an AI agent are created without encryption, unless that agent can read encrypted conversations. The app asks before starting such a conversation and shows the label "Not encrypted" in it.
• Encryption does not hide information about the conversation. The server knows who writes to whom, in which room and when, how large the files are and who read a message.
• On the participants' devices the message is readable. Any participant can copy it, forward it or take a screenshot.
• If you turned on key backup (for example in the Element app), the server keeps an encrypted copy of your keys. It cannot be read without your recovery key.
• The connection between the app and the server is always encrypted (HTTPS). This encryption ends in the Cloudflare network, so conversations without end-to-end encryption and voice recordings are readable to Cloudflare there (section 11).

7.AI agents

An agent is a participant in a conversation whose replies are written by a program with a language model. An agent that CRODU's server reports as an agent is labelled in the app as AI, and the app shows where its model runs, as the server reports it. Bot accounts that the server does not report as agents look like ordinary participants in the app.

The app gets the list of agents from CRODU's server. If CRODU uses the Core system, the app also asks it what your role in the company is and which agents to show you. It does this over the same connection as the messenger, so also through Cloudflare (section 11). CRODU's administrators change these settings in the Core administration panel, which is available only to them and only over CRODU's private network.

• An agent sees the messages in conversations it has been added to. It does not see your other conversations.
• Your message to an agent goes to CRODU's server and to the agent's program on a CRODU computer.
• The agents Croduś and Karol are set up to use only language models on CRODU's computers, also when their main model is unavailable, and not to send conversations to cloud model providers.
• If an agent has a web search tool, it sends search queries that it writes itself, based on the conversation, to a search engine.
• CRODU's server also has accounts for internal bots that may use cloud models, for example from OpenAI or Anthropic (USA). Content that such a bot sees in a conversation or receives from another agent may reach its model provider (sections 11 and 12). The app shows the provider's name only for an agent for which the server gives it.
• An agent may use CRODU's tools, such as task boards, on terms set by the administrator. The app does not control this.
• An agent may remember the course of a conversation to reply in context. Section 13 says for how long.
• An agent's memory may be shared by everyone who talks to it. What you tell an agent may then appear in its replies to other people in the company. Do not give an agent information that other people should not know.
• Agents' replies can be wrong. An agent does not make decisions about you that have legal effects or similarly significantly affect you (Article 22 GDPR).
• An agent replies only to people the administrator has allowed.

8.Voice

You can speak instead of typing to an agent that has voice turned on, if CRODU has given you this feature.

1. Recording starts only when you press the microphone and lasts at most 60 seconds. The device keeps it in memory and does not save it to a file.
2. The recording goes through Cloudflare to the speech gateway on CRODU's server. The gateway checks that your account is allowed to use voice and passes the recording to the speech recognition program on a CRODU computer.
3. Text comes back. You see it, can correct it and decide yourself whether to send it. The agent receives only the text, as an ordinary message.
4. The gateway does not store the recording or the text. Its log keeps only who spoke and when, the length of the recording, which computer recognised the speech and how long that took. If the speech recognition program writes the recognised text to its technical log, that record stays on the CRODU computer and the period for server logs applies to it (section 13).
5. We do not recognise people by their voice.
6. If you turn on reading replies aloud, a voice built into the device reads them. The app picks only voices that work without the internet, so the text does not leave the device for this.

Voice is an optional feature. The app works the same without it.

9.Notifications and audio and video calls

Notifications. On iPhone and iPad the app tells you about new messages if your version of the app has this feature, CRODU's server has turned it on and you agree to it.

• CRODU's server then sends through Apple's notification service only the room and message IDs and the number of unread messages, without the content and without the sender.
• The app fetches the content itself from CRODU's server and decrypts it on the device. Apple does not receive it.
• CRODU's server keeps your device's notification token until you sign out or the device is removed from your account.
• In the app's settings you can stop notifications from showing message content, and in the system settings you can turn notifications off.
• On other systems the app does not use external notification services. Before we change that, we will update this policy.

Audio and video calls. Audio and video calls go through CRODU's call server in Germany (rtc.crodus.ai), rented from Hetzner Online GmbH. If your version of the Crodus app has audio and video calls:

• a call can be started only in an end-to-end encrypted room;
• your device encrypts the sound and video, and the call server passes them on in encrypted form and does not keep them;
• the call server sees your account ID, your IP address and the time and length of your part in the call;
• the call keys go to all devices of the people in the room, including devices their owners have not verified.

10.Why we process data and on what legal basis

Account data is needed to use the app: without it we cannot create an account. You give the data in the "Let's talk" form voluntarily; name, email address and company name are needed so that we can answer your submission. The camera, microphone, access to photos and files, and notifications are needed only for the features in section 5.

11.Who else has access to data

• Conversation participants, including AI agents added to them, see what is in that conversation.
• People at CRODU who administer the servers have technical access to them, and so to conversations without end-to-end encryption, to conversation information, to message reports and to data in the Core panel. Some work on the servers is done on their instructions by CRODU's administration agent. If it uses a cloud model for this, data it reads while working, such as parts of server logs, may reach the provider of that model.
• Cloudflare, Inc. (tunnel and DNS). The whole connection between the app and the messenger server passes through the Cloudflare network, where HTTPS encryption ends. Cloudflare can therefore see the content of conversations without end-to-end encryption, voice recordings, recognised text, conversation information and IP addresses. It sees end-to-end encrypted conversations only in encrypted form. Cloudflare acts as our service provider.
• Google. If you sign in with a Google account, Google learns about the sign-in and passes us basic account data, such as name and email. In this respect Google acts under its own terms. Google also runs CRODU's email, so it stores the messages you send to hello@crodu.com. We keep encrypted server backups on Google Drive; Google does not have the key to these backups. On Android, Google may also receive technical information from the ML Kit library (section 5).
• Apple and other app stores. Apple distributes the app through the App Store and TestFlight and processes testers' data under its own terms. So does the store or test programme from which you get the app on another system. Notifications without message content pass through Apple's notification service (section 9).
• "Let's talk" form submissions. The data from the form is received by a server on the crodus.ai website that runs on Cloudflare (Cloudflare Workers and the D1 database) and stored in the submissions database. We send CRODU an email notification about the submission through an email provider (Resend, Inc., USA); it is received by CRODU's email at Google. The submission data also goes to CRODU's internal systems (the Cases system and an internal messenger channel), where people who handle customer enquiries see it.
• Hetzner Online GmbH (Germany), from which we rent the audio and video call server (section 9).
• Cloud model providers, such as OpenAI and Anthropic. They receive only the content passed to them by an internal bot that uses their models (section 7) or by CRODU's administration agent.
• Web search engines, if an agent uses web search. They receive the queries the agent writes.
• Servers of other organisations in the Matrix network. If users of other Matrix servers take part in a conversation, their servers receive a copy of that conversation, and their administrators are responsible for it.
• Public authorities, when the law requires it.

The messenger server, the programs of the agents Croduś and Karol, and speech recognition run on CRODU's computers, not in an external provider's cloud. Croduś and Karol are set up to use only language models on CRODU's computers (section 7). We do not sell data and do not pass it to advertisers.

12.Transfers outside the European Economic Area

The audio and video call server is in Germany, that is in the European Economic Area (EEA). Data may leave the EEA through:

• Cloudflare, Inc. (USA). Cloudflare states that it participates in the EU-U.S. Data Privacy Framework, and its data processing agreement for customers includes the EU Standard Contractual Clauses.
• Google (USA): sign-in with a Google account, CRODU's email, encrypted backups, and on Android the ML Kit library.
• Resend, Inc. (USA): sending the email about a "Let's talk" form submission to CRODU (section 11).
• Apple (USA): the App Store, TestFlight and notifications.
• Cloud model providers, such as OpenAI and Anthropic (USA), in the cases described in sections 7 and 11.
• Web search engines, if an agent uses them.
• Servers of other organisations in the Matrix network, if their users take part in a conversation and those servers are outside the EEA (section 11).

On request to the address in section 1 we will tell you on what basis a given transfer takes place.

13.How long we keep data

If you have device backup turned on (for example in iCloud, or Google backup on Android), the app's files may go into it, including the encrypted conversation database. The provider you chose keeps such a backup under its own terms.

14.Your rights

You have the right to:

• access your data and get a copy (Article 15 GDPR);
• rectification (Article 16);
• erasure (Article 17);
• restriction of processing (Article 18);
• data portability (Article 20);
• object to processing based on our legitimate interest (Article 21).

Write to the address in section 1. We will answer within one month.

You can withdraw the marketing consent given in the "Let's talk" form at any time by writing to the same address. Withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal (Article 7(3) GDPR).

The people you sent messages to have them too. Deleting your account does not remove the copies on their devices, and we have no access to the content of end-to-end encrypted conversations.

You can also lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

15.Security

• End-to-end encryption of conversations and encrypted connections to the server.
• Sign-in data in the system's secure storage (the keychain on iPhone, iPad and Mac); the app's local database encrypted with a key from that storage.
• Access to the servers only for designated people and CRODU's administration agent, over an encrypted private network. The Core panel is available only on that network.
• Backups on the USB drive and on Google Drive are encrypted.

16.Children

Crodus is a work tool. It is not intended for people under 16 and we do not create accounts for them.

17.Changes to this policy

The current version is at https://crodus.ai/privacy/, and the Polish version at https://crodus.ai/prywatnosc/. The Polish version is binding. We will tell you about significant changes in the app or by email before they take effect.