Privacy Policy
Last updated: 8 October 2026
This policy explains what personal data CronBeat ("we") processes when you use CronBeat, why we process it, how long we keep it and what you can do about it. CronBeat is a service that watches scheduled jobs (cron jobs, scripts, Kubernetes CronJobs) and alerts you when a job does not run, fails or runs too long.
1. The service
You create monitors in CronBeat. A monitor either receives HTTP requests (pings) that your job sends to a ping URL, or is fed by the CronBeat Kubernetes agent that you install in your own cluster, or by the CronBeat host agent that you install on your own Linux server. When something goes wrong, CronBeat sends an alert through the channels you configured: email, Slack, Discord, Telegram, Microsoft Teams, PagerDuty or a webhook. You can also publish a public status page. CronBeat has three plans: Free, Pro and Enterprise. Paid plans are billed through Polar.
2. Accounts and sign in
- You can sign up with an email address and a password. We store the email address and a BCrypt hash of the password, never the password itself.
- You can optionally sign in with GitHub, Google or GitLab. We receive your identifier at that provider and the email address it gives us. We do not store the access tokens of these providers.
- Verification and password reset tokens are stored only as hashes and are valid for a limited time.
3. Data we process and why
| Data | Purpose |
|---|---|
| Account email, password hash, linked sign-in identities | Create and secure your account, sign you in, send account emails. |
| Monitor configuration (names, schedules, grace times, notification settings) | Run the monitoring you asked for. |
| Ping metadata: time, type (start, success, fail, log), duration, source IP address and user agent | Detect missed, failed and too-long runs, show run history and help you debug, rate limit abuse. |
| Ping request body, truncated to at most 10 KB | Show you the output your job attached to a ping. |
| Kubernetes agent data: cluster name, namespaces, CronJob names, schedules, time zones and scheduling status, start, success and failure of Jobs with their run time, and for a failure a reason and a short message produced by Kubernetes | Create and update monitors for your CronJobs and detect failed runs. |
| Host agent data: server name, job names, schedules and time zones, a run id, start and result of every run with its duration, exit code and signal, and, only for a failed run, the last 4 KB of its output with secrets masked. The command, its arguments, environment variables and files are not sent | Create and update monitors for your cron jobs and detect failed runs. |
| Email addresses and webhook addresses of people and systems that subscribe to a status page | Send them the incident updates of that page. An email address is used only after the owner of the address confirmed it, and every email has an unsubscribe link. |
| Messages you send through the contact or support form | Answer you. They are emailed to us and are not stored in the CronBeat database. A support message also carries your account email and account identifier. |
| Facts of an incident and the output of the failed run, only when you ask for an AI explanation | Write the explanation (see section 10). Passwords, tokens, keys and email addresses are removed from the text before it is sent. The explanation is stored with the incident. |
| Audit log entries (who did what, the target and the time) | Show project members what changed. |
| IP address of requests to public and sign-in endpoints | Rate limit abuse. Counters are kept for two hours. |
| Incidents | Record when a monitor went down and recovered, and decide when to alert. |
| Notification delivery records (which channel, when, outcome) | Retry failed deliveries and show you what was sent. |
| Channel configuration (email addresses, Slack and webhook URLs) | Deliver alerts to the destinations you chose. |
| Subscription status and plan | Apply plan limits and show your billing state. |
Do not put secrets in ping bodies. The body of a ping is stored (up to 10 KB) and shown in the dashboard. Do not send passwords, tokens, personal data of third parties or other sensitive content in it.
We use this data to provide the service. We do not sell personal data and we do not use it for advertising.
4. How secrets are handled
- Secrets inside channel configuration (for example webhook URLs and signing secrets) are encrypted at rest.
- API keys and agent keys are stored only as hashes, so we cannot show them again.
- Full keys and tokens are never written to our logs.
5. Payments
Paid plans are sold through Polar, which acts as merchant of record. You enter your card details on the Polar checkout page, not in CronBeat. We receive the subscription status and the identifiers needed to link the subscription to your account. We do not receive or store your card number.
6. Retention
Ping and incident history is kept for a period that depends on your plan and is deleted automatically after it.
| Plan | Ping and incident history |
|---|---|
| Free | 7 days |
| Pro | 30 days |
| Enterprise | 365 days |
Other data has a fixed period: the audit log is kept for 365 days, in-app notifications for 30 days after you read them and at most 90 days, delivery records of status page subscribers for 14 days, and email addresses that subscribed to a status page but never confirmed are removed after 7 days. Your sign-in session lasts 14 days.
Account data and monitor configuration are kept while your account exists. Backups of the database are stored with our backup provider, so deleted data can remain in a backup until that backup is removed.
7. Deleting your account
You can delete your account yourself on the Account page. This deletes your monitors, channels, history and the rest of your data in CronBeat. If you have an active subscription you must cancel it first. Records that Polar keeps as merchant of record are governed by Polar's own policies.
8. Cookies and browser storage
- One session cookie that keeps you signed in. It is HTTP-only.
- One CSRF cookie that protects requests made by the web app against forgery.
- Your light or dark theme choice, stored in your browser's local storage. It never leaves your browser.
We do not use advertising cookies or analytics cookies. Because these items are needed to run the service, they are not used for tracking.
9. Security measures
- Traffic is encrypted with TLS.
- Passwords are hashed with BCrypt. Keys and tokens are stored as hashes.
- Channel secrets are encrypted at rest.
- Sign-in and ping endpoints are rate limited.
- Webhook destinations must use HTTPS. Addresses that resolve to loopback, private or link-local networks are rejected and redirects are not followed, which protects against server-side request forgery.
- You can only see your own data.
No system is perfectly secure, and we cannot guarantee absolute security.
10. Where data is stored and who processes it
CronBeat runs on a virtual private server hosted in Europe. We use a small number of service providers for hosting, delivery of the web app, email delivery, payments, backups, the AI explanation if it is switched on and, if you choose to use them, sign in. They are listed with their purpose and the data they receive on the Subprocessors page.
11. International transfers
Some of our providers may process data outside your country or outside the European Economic Area. Where this happens, we rely on the transfer mechanisms that apply to that provider and to you. See each provider's documentation for details.
12. Your rights
Depending on where you live, data protection laws such as the GDPR and the Turkish KVKK may give you rights over your personal data. In general these include:
- access to the data we hold about you,
- correction of data that is wrong,
- deletion of your data (you can do this yourself on the Account page),
- a copy of your data, which we provide on request,
- the right to complain to your data protection supervisory authority.
To use a right, write to . This page is general information and is not legal advice.
13. Changes to this policy
We may update this policy. The date at the top shows when it last changed. If a change is significant we will tell account holders, for example by email or inside the app.