Privacy Policy

1. Information We Collect

1.1 Account Information

• Email Address: For account creation, login, and communications
• Name: Display name (optional)
• Password: Stored encrypted using Bcrypt (10+ rounds)
• Authentication Tokens: JWT tokens for session management

1.2 Usage Information

• AI Prompts: Your messages to CreonOS agents
• Generated Code: AI-generated content and self-improvement outputs
• Project Data: Workspace files, project graphs, execution logs
• Feature Usage: Which AI models, agents, and tools you use
• Settings: Theme preferences, editor settings, language preferences

1.3 Payment Information

• Billing Details: Processed by Stripe on the web and by Apple on iOS. We never see or store your card number. On iOS every purchase goes through Apple's in-app purchase system and we receive only a signed confirmation that it happened.
• Payment History: Invoices, subscription status, transaction IDs
• Subscription Tier: Free, Pro, Ultra, Studio or Agency

1.4 Technical Information

• IP Address: For security and rate limiting
• Browser & Device: User agent, OS, screen resolution
• Cookies: Session cookies, preferences (see Cookie Policy)
• Logs: API requests, error logs (retained 30 days)

1.5 Files, Photos, Video and Audio

• Attachments: Photos, video and documents you choose to attach to a conversation. Nothing is read from your device library unless you pick it.
• Voice and microphone: When you use voice mode we access your microphone, and audio is captured only while you are speaking and converted to text. The microphone is not open at any other time. We do not keep the audio. The transcript is treated exactly like anything else you type.
• Generated media: Images and video the agent creates or finds for you, stored in your workspace.

1.6 Connected Accounts

If you connect a third-party account, we store an access credential for it so the agent can act on your behalf. These are encrypted at rest and are never sent to your browser or exposed to the AI model.

• GitHub: To read your repositories, work on a branch and open pull requests. We never push to your default branch.
• Google / Gmail: Read access to your inbox, and send access only if you explicitly grant it. We ask for the narrowest scope that does the job.

You can disconnect any account at any time in Settings, which deletes the stored credential.

1.7 Age and Content Restrictions

• Year of birth: Asked so we can apply our minimum age. We ask for the year alone rather than a full date, and we do not verify it.
• Restriction settings and PIN: Which capabilities are switched off for the account. The PIN is stored hashed and never in plain text.

1.8 Reports of Harmful Content

If you report something through the app we record what you told us, any link you gave, your account, your IP address and the time. We keep this so we can investigate and act on it, and because we may need to show what we did about it.

1.9 Diagnostics and Analytics

• Crash and error reports: What broke, where, and the state of the app at the time.
• Performance data: How long things took, so we can find what is slow.
• Interaction events: Which features are used, and whether a run finished. Not the content of your work.
• Anonymous visitor identifier: A random ID stored in your browser so we can count visitors without accounts. It contains nothing about you, it is not an advertising identifier, and it is never shared. When you are signed in, this data is associated with your account.

1.10 Pages You Publish

Publishing puts a page on a public web address that anyone with the link can open. That is the point of the feature, and it means anything you put on that page stops being private. Publishing always asks first and is never automatic. You can ask us to take a published page down at any time.

1.11 What the Agent Remembers About You

So that you do not have to repeat yourself, the agent can save short notes about how you work and what you are building. This is the only part of the product that keeps a record about you rather than a record of what you did, so it is worth being precise about it.

• What can be saved: preferences you have stated, corrections you have given the agent, facts about a project you are working on, and links to things you have pointed it at.
• What is never saved: passwords, payment details, access tokens for connected accounts, and the contents of your files. Notes are written by the agent in plain English, not scraped.
• Project notes stay with the project. A note taken while working on one thing is scoped to that workspace and is not carried into an unrelated one.

You can see all of it, and you can delete any of it. Settings contains a Memory tab listing every note in full, with the date it was written. Nothing is hidden behind a summary, and deleting a note removes it immediately and permanently. Deleting your account deletes all of them.

If a project is built on files you provide that describe how you like an agent to work, such as a README or an instructions file in a repository you connect, the agent may read those and keep what is relevant to that project. That is the purpose those files serve, and the notes it takes from them are visible and removable in the same place as all the others.

2. How We Use Your Information

2.1 Service Delivery

• Provide AI-powered development assistance
• Execute autonomous agents and self-improvement algorithms
• Store and sync workspace data across devices
• Deliver real-time notifications and updates

2.2 Platform Improvement

• Analyze usage patterns to improve AI models
• Identify and fix bugs through error logs
• Develop new features based on user behavior
• Optimize performance and reduce latency

2.3 Communication

• Send account verification emails
• Notify about service updates and new features
• Respond to support requests
• Send security alerts (e.g., unusual login activity)

2.4 Legal Compliance

• Comply with GDPR, UK Data Protection Act, and other regulations
• Respond to legal requests (e.g., subpoenas, court orders)
• Enforce our Terms of Service
• Detect and prevent fraud, abuse, and security incidents

3. Data Sharing and Third Parties

3.1 AI Service Providers

Note: AI providers process data under their own privacy policies. We use Business/Enterprise tiers with strict data retention (30 days max).

3.2 Other Service Providers

• Stripe: Payment processing (see Stripe Privacy Policy)
• Railway: Cloud hosting (SOC 2 Type II certified)
• Cloudflare: CDN and DDoS protection
• Sentry: Error monitoring (anonymized)

3.3 What We Never Do

• ❌ We never sell your personal data to third parties
• ❌ We never share your code with advertisers
• ❌ We never use your private code to train public AI models
• ❌ We never rent your email list for marketing

4. Data Security

4.1 Encryption

• In Transit: TLS 1.3 for all HTTP communications
• At Rest: AES-256 encryption for database and file storage
• Passwords: Bcrypt hashing with 10+ rounds (never stored in plaintext)
• API Keys: Encrypted in database, never logged

4.2 Security Practices

• Regular security audits and penetration testing
• Automated vulnerability scanning (Dependabot, Snyk)
• Rate limiting (100 requests/minute, 1000 requests/hour)
• CSRF protection on all state-changing requests
• Session tokens expire after 30 days of inactivity

4.3 Data Breach Notification

In the event of a data breach affecting your personal information, we will notify you within 72 hours via email and platform notification, as required by GDPR Article 33.

5. Data Retention

5.1 Active Accounts

• Account Data: Retained while your account is active
• Usage Data: Retained for 2 years for analytics
• Logs: Retained for 30 days, then deleted
• Backups: Deleted data may persist in backups for up to 90 days

5.2 Deleted Accounts

• Account data is permanently deleted within 30 days of account deletion
• Anonymized usage statistics may be retained for analytics
• Legal obligations may require retaining certain data (e.g., billing records for 7 years)

5.3 Data Export

Before deleting your account, you can request a full data export in JSON format. Email marco@creonai.io to request your data export.

6. Your Privacy Rights (GDPR)

6.1 Right to Access (Article 15)

Request a copy of all personal data we hold about you. We will provide this within 30 days in machine-readable format (JSON).

6.2 Right to Rectification (Article 16)

Correct inaccurate or incomplete personal data. You can update most data directly in your account settings.

6.3 Right to Erasure (Article 17)

Request deletion of your account and all associated data. This is irreversible and takes effect within 30 days.

6.4 Right to Data Portability (Article 20)

Export your data in JSON format for transfer to another service.

6.5 Right to Object (Article 21)

Object to processing of your data for marketing purposes. Unsubscribe from emails via the link in any email.

6.6 Right to Withdraw Consent (Article 7)

Withdraw consent for optional data processing (e.g., analytics cookies) at any time.

6.7 How to Exercise Your Rights

Email marco@creonai.io with your request. We will respond within 30 days, and usually much sooner.

7. Cookies, Storage and Tracking

We use cookies for authentication and preferences, and browser storage for your settings and a random visitor identifier used to count visits. See our Cookie Policy for full details on types, purposes, and how to manage them.

We do not track you. We use no advertising identifier, no advertising network and no third-party advertising SDK, we do not share your data with data brokers, and we never combine it with third-party data to profile you. Analytics are used to understand how the product is used and nothing else.

8. Children's Privacy and Parental Controls

CreonOS is not intended for users under 13 years old. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us immediately at marco@creonai.io and we will delete it promptly.

We ask for your year of birth and refuse accounts below the minimum age. This is what you tell us: we do not verify it, and we say so plainly rather than implying a check we do not perform.

Settings contains content restrictions that can be protected with a PIN. They switch off the agent's access to the open web, to photo and video search, and to publishing pages publicly. These are enforced on our servers rather than hidden in the app, so they hold on any device the account is used on and cannot be bypassed by modifying the app.

9. International Data Transfers

Your data may be transferred to and processed in countries outside the UK/EU (e.g., United States for AI processing). We ensure these transfers comply with GDPR through:

• Standard Contractual Clauses (SCCs): EU-approved data transfer agreements
• Adequacy Decisions: Transfers to countries recognized by the EU as providing adequate protection
• Data Processing Agreements (DPAs): With all third-party processors

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of significant changes via:

• Email to your registered address
• In-platform notification banner
• Updated "Last Updated" date at the top of this page

Continued use of CreonOS after changes constitutes acceptance of the updated policy.

11. Contact Information

CreonOS is run by one person. There is no support queue and no ticket number: that address reaches the person who builds it, and it is answered.

12. Supervisory Authority

If you believe we have not addressed your privacy concerns adequately, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):