1. Scope
This Privacy Policy applies to Crux Interactive services that link to it, including cruxinteractive.com, id.cruxinteractive.com, account.cruxinteractive.com, ai.cruxinteractive.com, cloud.cruxinteractive.com, connect.cruxinteractive.com, spaces.cruxinteractive.com, calendar.cruxinteractive.com, forms.cruxinteractive.com, help.cruxinteractive.com, news.cruxinteractive.com, cruxapps.io, projects hosted on CruxApps subdomains or connected custom domains, CruxAI apps, CruxAI APIs, and integrations that use Crux ID.
Some services include links to third-party websites, platforms, stores, or sign-in providers. Their privacy practices are governed by their own policies. Forms, Spaces, and hosted projects created by other users are controlled by those users, who may have their own notices.
2. Information we collect
Account and profile information
When you create or manage a Crux ID, we collect information such as username, email address, password hash, verification status, profile picture, the age you provide, linked Google or Apple account identifiers, time zone, theme and other preferences, and account settings.
Authentication, security, and device information
We collect information used to secure your account and operate the services, including session cookies, CSRF tokens, IP address, user agent, login and session activity, last IP, two-factor authentication settings, hashed backup codes, and email verification or 2FA code records. To detect sign-ins from new places or devices, we keep a list of the network ranges and devices you have signed in from, trusted-device records, and new-device approval requests, and we may send you sign-in and security alert emails. Where enabled, an approximate location (such as city or region) may be estimated from an IP address to describe a sign-in in those emails.
User content and social activity
We collect content you create or upload, such as posts, comments, bookmarks, reactions, direct messages and message reactions, guild messages, friend requests and friend nicknames, blocked-user settings, reports, profile bios, status messages, game stats and their visibility settings, game saves, wallet or reward records, and Discord linking data if you connect Discord.
Crux Cloud files
If you use Crux Cloud, we collect uploaded files and file metadata, including original filenames, stored filenames, MIME type, size, folder names, tags, visibility, share tokens and share recipients, file versions, thumbnails, storage quota data, and access logs for viewing, downloading, sharing, editing, or deleting files. We also keep playlists you create, including collaborative playlists and their collaborators, and a music library index built from your audio files' tags (such as title, artist, album, and cover art).
Crux Cloud reads metadata already embedded in your files so it can show it to you, such as a photo's camera details, date taken, and GPS location, or an audio file's tags. We store and deliver your files unchanged, so embedded metadata, including photo location, stays in a file when you share or download it. To help you find files, Crux Cloud may create AI-generated descriptions and keywords for images and extract text from documents; these are stored as a search index. Files in the Crux Cloud Vault require you to re-enter your password, lock after inactivity, and are excluded from AI indexing and from Personal Context.
CruxAI chats, images, and app data
CruxAI may collect prompts, messages, generated responses, conversation titles, attachments, image prompts, generated images, canvas data, sandbox files, generated documents, model selections, reasoning-effort and web-search settings, sources, usage counts, and optional memory/profile fields such as display name, pronouns, interests, preferred tone, and saved memories. It also stores Flow plans and tasks, saved checkpoints, School classes and assignments, study sets and your quiz attempts, links you create to share a conversation (including a copy of the shared messages and view counts), feedback you give on responses (rating, reason, optional comment, and a copy of the rated conversation), and your model-improvement setting.
Each message is saved to your conversation as you send it, so it is kept even if you close the page or the reply fails. If you stop a reply, the part already written is saved. In long conversations, CruxAI may save a summary of earlier messages and use it in place of those messages to continue the conversation.
Temporary chats are not added to your conversation history or memory. Safety systems may record labels and account safety state when a message may violate our policies.
Projects, Specialists, and working notes
If you use Projects, we store each project's name, description, and instructions, the text of reference files you add or paste, which chats belong to the project, and which chats you pin. If you create a Specialist, we store its name, description, icon, instructions, optional guide, reference files, conversation starters, and settings, along with how often you use it. Specialists replace the earlier Apps feature; Apps you created before then are kept read-only. CruxAI may also keep working notes, such as progress on a long task, decisions, or a project's conventions, either for you or for a project. Before a note is saved, payment card and Social Security numbers are masked.
Agent tasks
If you use agent tasks, we store the task you asked for or confirmed, your start-mode setting, and a record of each task: its status, model, start and finish times, time spent working, tokens used, cost, steps taken, final result, and a list of the files it saved. Those files are copied into your conversation's workspace. If you create scheduled tasks, we also store each schedule's title, instructions, frequency, time and time zone, the chat it reports into, and the results of recent runs.
Connected apps
If you connect an app in Settings › Connectors, we store the app's name and server address, its connection status, your settings for it (Use in chat and Allow changes), the list of tools the app offers, the last error, and when you last used it. For apps that need you to sign in, we also store the sign-in details the app issues to CruxAI and your access and refresh tokens, which are encrypted and never sent to your browser.
Personal Context in CruxAI
Personal Context is off unless you turn it on. When it is on, CruxAI keeps an index of your own activity and resources across Crux services (for example Cloud file names, Spaces you belong to, Calendar events, Help Center tickets, Forms, Connect posts, and account events) so it can answer questions such as "find the song I uploaded yesterday." The index is limited to your own account, and each item is checked against the original service's permissions before CruxAI uses it. Some content, such as Cloud Vault items, private message threads, Help Center internal notes, anonymous News reactions, and form respondents' answers, is excluded. CruxAI records which items it used for a reply so it can show you a receipt. You can turn Personal Context off or clear its index at any time.
Crux Spaces
If you use Crux Spaces, we collect the Spaces you create or join, your role, invitations, notes, tasks and due dates, messages, files you add (including Crux Cloud files you link), calendar items, and an activity history of changes made in each Space.
Crux Calendar
If you use Crux Calendar, we collect your calendars, events, recurrence and exceptions, reminders, time zone, and attendee information you add, including the names and email addresses of people you invite and their responses. If you subscribe to an external calendar feed, we store its address and periodically fetch it. If you create a shareable calendar link, anyone with that link can view the events it includes.
Crux Forms
If you create forms, we collect the form content, settings, collaborators, and the responses and files submitted to them. If you answer a form while signed in, your response may be linked to your Crux ID, depending on the form's settings; if you answer without signing in, we use a random identifier stored in your browser to prevent duplicate or abusive submissions.
Help Center and support
When you contact support, we collect your tickets, replies, attachments, article feedback, and email correspondence, and a log of support emails sent to you. If you submit a ticket without signing in, we collect the name and email address you provide and store a private link token in your browser so you can return to the ticket. Support staff may add internal notes to tickets and about accounts. We keep rate-limit records based on hashed identifiers to prevent abuse.
Crux News
If you subscribe to Crux News, we collect your email address, the IP address used to subscribe, confirmation and unsubscribe records, and delivery or bounce counts. To count article views and reactions without identifying readers, we store a hashed visitor identifier together with the referring site and any on-site search terms; reactions are not linked to your Crux ID.
Site Builder projects and CruxApps hosting
If you use CruxAI Site Builder, we collect information needed to create, operate, secure, and host your projects. This can include build conversations and prompts, attachments, project files and folders, generated code, visual-editor data, versions and diffs, deployment status, project names and subdomains, custom-domain and DNS metadata, framework and package information, build and runtime logs, browser-console messages, resource usage, model and token usage, image-generation activity, and project-level security or audit events. If you start an agent build, the agent works on a copy of your project and its result is saved as a new version; the task itself is recorded as described under Agent tasks.
Depending on the features you enable, a project may also store database schemas and records, member-account information, password hashes, roles, session records, form submissions, site-user uploads, server-action requests, protected-value metadata, and traffic information such as IP address, timestamp, request path, user agent, response status, and security signals. Protected values may be stored through a designated secret interface and are handled separately from ordinary project files; do not place secrets in prompts or public client-side code.
Device permissions in CruxAI
CruxAI may request camera, microphone, speech recognition, photo library, reminders, and location permissions. These are used only for features you enable, such as attaching photos, saving generated images, live voice or camera mode, dictation, read-aloud, creating reminders, weather, nearby places, and local recommendations.
Developer API and payment information
If you use the CruxAI developer API, we collect API key metadata and hashes, workspaces, data-sharing settings, usage logs, token and image counts, credit balances, free-usage counters, and payment/top-up records. For subscriptions and purchases we keep plan, billing status, and transaction records. Payment processing may be handled by Stripe, Apple, or another payment provider; we do not need to store full payment card details in our own application database.
Policy notices and your responses
When we ask you to accept or acknowledge an update to our Terms of Service or this Privacy Policy, we record which notice you responded to, whether you accepted or acknowledged it, when, the Crux service you were using, and your IP address and user agent, so we can show that you agreed and avoid asking you again.
3. How we use information
- To create accounts, authenticate users, keep users signed in, and secure sessions across Crux Interactive subdomains.
- To operate core features such as CruxAI chats, image generation, Site Builder projects, CruxApps hosting, cloud storage, social posting, messaging, friends, guilds, Spaces, calendars, forms, support tickets, newsletters, and developer APIs.
- To personalize CruxAI responses when you enable profile, memory, or Personal Context features, and to carry out changes you confirm in CruxAI.
- To apply your Projects, Specialists, and working notes to the chats they belong to, run agent tasks and scheduled tasks you start or allow, and use the connected apps you turn on.
- To enforce plan allowances and per-task spending limits for agent tasks and other usage-based features.
- To process uploads, generate thumbnails, read embedded file metadata, index files for search, create share links, and maintain cloud storage quotas.
- To build, preview, run, version, publish, unpublish, maintain, route, and deliver hosted projects and their managed data, authentication, forms, uploads, domains, and server actions.
- To detect unusual sign-ins, approve new devices, prevent abuse, debug errors, rate limit requests, protect accounts, enforce policies, and investigate reports.
- To provide support, respond to tickets, and send transactional email such as verification, password, security, sign-in alerts, 2FA, ticket updates, calendar invitations, and deletion-confirmation messages.
- To send Crux News newsletters you subscribe to, and to count article views and reactions in aggregate.
- To apply parental controls and family settings for managed accounts.
- To improve CruxAI where your model-improvement setting allows it, and to review feedback you submit.
- To process purchases, credits, subscriptions, refunds, chargebacks, and billing records.
- To record your acceptance of our terms and policies, and to comply with legal obligations and preserve evidence where necessary for security, fraud prevention, or dispute resolution.
4. AI, apps, and connected services
CruxAI processes the prompts, chat history, attachments, images, location context, and settings needed to generate a response. Depending on the feature, that information may be processed by Crux Interactive model infrastructure or by third-party AI providers and services used to deliver AI responses, image generation, vision, speech, text-to-speech, web search, or file tools. Text you ask CruxAI to read aloud is sent to a text-to-speech provider to produce audio.
When Personal Context is on, CruxAI looks up only the records relevant to your request, checks that you can still access each one, and sends only those records to the model. When you ask CruxAI to find, play, or organize your Crux Cloud files, it can search and open your own files. CruxAI can prepare changes to your Crux services, such as renaming a Cloud file or creating a Spaces task, but it does not make the change until you confirm it.
Crux Cloud's search index uses AI models to describe images and extract text from documents you store (Vault items excluded).
For Site Builder requests, CruxAI may process relevant project files, selected database structure, build history, console errors, screenshots, attachments, package metadata, and recent conversation context to answer a question or make a requested change. When a project needs current technical information, package details, or a design workflow, CruxAI may use search, retrieval, package registries, or other tools required for the task. We aim to send only the context reasonably needed for the selected feature.
When you enable web search, search queries and related context may be sent to search or retrieval services. When you enable location, approximate or precise location fields that the app sends may be used for local answers, weather, nearby places, or search grounding. When you connect Google Drive, Gmail, Discord, Apple, Google Sign-In, or similar services, we use the connection only to provide the feature you requested and store tokens or metadata needed to maintain that connection.
Agent tasks
An agent task runs in a private cloud workspace operated by our AI provider. There the model can run code, search and read websites, and create files until the task is done. We send it the task, the relevant conversation context, and any files or Specialist materials the task needs. The websites an agent visits receive its requests, as they would from any browser. When the task ends, CruxAI copies the result and the saved files into your chat, and the provider's working session is archived. Depending on your start-mode setting, CruxAI either suggests a task for you to confirm or starts one by itself; scheduled tasks run at the times you set.
Connected apps
When a connected app is turned on for chat, CruxAI sends your request, your access token for that app, and the app's tool list to our AI provider. The provider contacts the app's server directly to use its tools. The app receives what the model sends to those tools, such as search terms, record IDs, or text to save, and its replies are processed like other chat content. Apps listed as needing no account receive the queries sent to them, but no sign-in from you. Until you turn on Allow changes for an app, CruxAI uses only the tools that app describes as read-only. Each app handles the data it receives under its own privacy policy.
Specialists
When a Specialist has a guide or reference files, CruxAI packages them and stores them with our AI provider so the model can open them when a request needs them. That copy is updated when you edit the Specialist, and we delete it when you delete the Specialist.
Our AI provider may keep data processed for agent tasks, connected apps, and Specialists' stored materials under its own retention terms. These features are not offered on managed (supervised) accounts.
Model improvement
Your CruxAI model-improvement setting controls whether your conversations may be used to improve our models and services. It is off by default for users under 18, for users in the European Economic Area and the United Kingdom, and where we cannot determine your region, and it is unavailable for users under 13 or whose age is unknown. For other adults it is on by default. A parent may turn it off for a managed account. You can change this setting at any time in CruxAI settings; the change applies going forward. When you give feedback on a response, you may separately choose whether that feedback can be used for training.
Safety review
Automated systems check CruxAI activity for abuse and safety risks. Authorized staff can read a conversation's content only after opening a documented review case for a specific purpose, such as investigating abuse or fraud or reviewing feedback you submitted. Each view and export is logged.
The developer API includes an optional data-sharing program. When data sharing is off, the shared-log table is not written for that program. When you turn it on, API request and response payloads may be saved for product improvement, evaluation, debugging, and model-quality work, as described in the data-sharing interface.
6. Cookies and similar technology
We use cookies and similar storage for login sessions, security, CSRF protection, preferences, and service operation. Crux ID session cookies may work across Crux Interactive subdomains so you can move between services without signing in repeatedly. Some services also keep small items in your browser, such as a guest ticket link in the Help Center, a random visitor identifier in Crux Forms, drafts, and display preferences.
Projects hosted through Site Builder may use essential cookies or local storage for project-member sessions, preferences, security, and app operation. A project owner may also add independent analytics, advertising, embeds, or other third-party technologies. Those additions are controlled by the project owner and should be described in the project's own privacy notice where required.
You can control cookies through your browser settings. Blocking essential cookies may prevent login, account management, cloud storage, and other authenticated services from working correctly.
7. Your choices and rights
- You can update account details, change your password, manage 2FA and trusted devices, sign out other sessions, upload or remove profile pictures, disconnect supported OAuth providers, and manage parental links in your account settings.
- You can delete or change many posts, comments, messages, files, folders, cloud shares, playlists, generated images, shared conversation links, Spaces content, calendar events, forms and form responses you own, API keys, app settings, and other user-created content from the relevant service interface.
- You can turn Personal Context on or off and clear its index, and change your model-improvement setting, in CruxAI settings. Temporary chats are not saved to your history.
- You can edit or delete Projects, Specialists, and their reference files, and review or delete working notes in Settings › Memory and on each Project.
- You can choose whether CruxAI suggests agent tasks, starts them automatically, or runs them only when you ask, and you can stop a running task or pause or delete a scheduled task in Settings › Agents.
- You can turn a connected app off for chat, turn Allow changes on or off, or remove the app in Settings › Connectors. Removing an app deletes its stored tokens from CruxAI. To revoke CruxAI's access completely, also remove it in that app's own settings.
- You can remove location and other metadata from photos before uploading them if you do not want it stored or shared with the file, and keep sensitive files in the Crux Cloud Vault.
- You can unsubscribe from Crux News using the link in any newsletter.
- Site Builder project owners can edit or delete project files and managed records, review versions, download files or projects, disconnect custom domains, unpublish a site, delete a project, and manage available forms, uploads, accounts, and other project features from the Site Builder interface.
- You can request a data copy or start an account deletion workflow from the Account Actions page. The current implementation allows a new data copy request once every 14 days and blocks data-copy requests while a deletion request is pending.
- You can turn off CruxAI memory, auto-learn, location, camera, microphone, photos, speech recognition, reminders, and similar device permissions through app settings or your operating system.
- You can revoke connected services, such as Discord or Google integrations, through Crux settings and the third-party provider's account controls.
- Depending on where you live, you may have rights to access, correct, delete, export, restrict, object to, withdraw consent for, or appeal decisions about personal information. You can contact us to exercise those rights.
8. Children and family controls
You must be at least 13 years old to create a Crux ID. We ask for your age when you sign up and do not allow accounts for users who say they are under 13. If we learn that we have collected personal information from a child under 13, we will delete it. Parents or guardians who believe this has happened can contact us.
A parent or guardian can link to a teen's account after verifying their own email address. For a managed account, a linked parent can restrict features such as messaging, friend requests, posting, public profiles, AI image generation, web search, file sharing, group joining, mature content, purchases, and external connections, and can set daily time limits, quiet hours, and weekly spending limits. To enforce these settings we record the account's daily usage time and a log of allowed and blocked actions. When activity monitoring is on, which is the default for managed accounts, linked parents can review that activity log.
Accounts for users under 18 get more private defaults, including model improvement being off. Managed accounts cannot use agent tasks, connected apps, or Specialists.
Site Builder project owners may not knowingly use CruxApps hosting to collect personal information from children in a way that violates applicable children's privacy law. Project owners are responsible for determining whether their project is directed to children, providing required notices, and obtaining any required parental consent.
9. Retention and security
We keep information for as long as needed to provide the services, maintain accounts and hosted projects, preserve user content, operate versions and backups, complete purchases, secure the platform, resolve disputes, enforce policies, or comply with law. Project files, database records, form submissions, uploads, and versions generally remain while the project exists or until the owner deletes them. Resolved support tickets are closed automatically after a period of inactivity and kept as support records. Records of your responses to policy notices are kept while your account exists and afterward where needed to show what you agreed to. CruxAI working notes are deleted after 180 days without use. When you delete a CruxAI conversation, its saved summaries are deleted too, and the text of any finished agent task in it is removed; the task's usage and cost are kept for plan limits and billing. Agent task files copied into a chat are kept with that chat's workspace. Removing a connected app deletes its stored tokens and settings. Some deleted items may remain temporarily in backups, logs, caches, moderation records, or fraud-prevention records. Security, traffic, audit, and abuse-prevention logs may be retained for a reasonable period after related public content or projects are removed.
We use technical and organizational safeguards such as password hashing, session protections, new-device approval, CSRF checks, restricted storage, access controls, permission checks before AI features use your data, encrypted storage of connected-app tokens, read-only access to connected apps unless you allow changes, spending limits on agent tasks, case-gated and logged staff access to conversations, isolation between hosted projects, resource limits, protected-value handling, API key hashing, security monitoring, and audit logging. No system is perfectly secure, so you should use a strong password, protect your API keys, enable 2FA where available, review generated applications before publishing, and contact us if you believe your account or project has been compromised.
Crux Interactive is based in the United States. If you access the services from another region, your information may be processed in the United States or other countries where we or our service providers operate.
10. Changes to this policy
We may update this Privacy Policy as our services, providers, or legal requirements change. When we make changes, we update the dates at the top of this page. For material changes, we tell you inside Crux services before the changes take effect. Depending on the change, we may ask you to acknowledge the update or to accept it before you continue using the services. We keep a record of your response so you are not asked again on other Crux services.
11. Contact
Questions or privacy requests can be sent to:
Crux Interactive
admin@cruxinteractive.com
https://cruxinteractive.com