Privacy Policy

Effective date: August 24, 2026

1. Who We Are

CrawlFox ("we", "us", "our") operates the CrawlFox API and dashboard at crawlfox.io. Contact us at privacy@crawlfox.io for any privacy-related requests.

2. Data We Collect

We collect the minimum data needed to provide the Service:

• Account data: email address, a one-way hash of your password (never the password itself), account creation timestamp
• Usage events: per-request logs including URL scraped, HTTP status, latency (ms), success flag, and API key identifier. No scraped content is retained.
• Session data: short-lived JWT stored in a secure HTTP-only cookie.
• Analytics: pages visited and general usage, via Google Analytics, with your IP address truncated. Not linked to your account.
• Technical metadata: IP addresses in server access logs, retained for 30 days for security and abuse prevention.

3. How We Use Your Data

• Authenticate you and keep your session secure
• Enforce quota limits and bill for usage
• Detect and prevent abuse or fraud
• Send transactional emails (account creation, key rotation). No marketing without explicit opt-in.
• Improve the reliability and performance of the Service

4. Data Sharing

We do not sell or rent your personal data. We share data only with:

• Infrastructure providers (hosting, database) bound by data processing agreements
• Analytics provider (Google Analytics) to measure how the site is used; your IP address is truncated before storage and we do not send it your account details
• Live chat (Tawk.to) when you start a conversation; it receives what you type and your chat identifier
• Email provider (Resend) to deliver account emails such as password resets; it receives your address and the message, nothing else
• Payment processor (Stripe) to process subscription payments; your full card details are handled by Stripe and are never stored on our servers
• Law enforcement when required by valid legal process

5. Data Retention

• Account data: retained while your account is active, then deleted within 30 days of account closure
• Usage events: retained for 12 months for billing disputes, then deleted
• Access logs: 30 days

6. Your Rights (GDPR / CCPA)

Depending on your jurisdiction you may have the right to access, correct, delete, or export your personal data. You may also object to certain processing or request restriction.

To exercise any of these rights, email privacy@crawlfox.io. We will respond within 30 days. For deletion requests, your account and all associated data will be erased within 30 days of verification.

7. Cookies

We use a strictly necessary session cookie and Google Analytics cookies. See our Cookie Policy for details.

8. Security

Passwords are stored only as bcrypt hashes and are never recoverable, by us or by anyone who obtained the database. Traffic is encrypted in transit via TLS 1.3. Database access is restricted to the application server network. We will notify affected users within 72 hours of a confirmed data breach.

9. Children

The Service is not directed to users under 16. We do not knowingly collect personal data from minors. Contact us immediately if you believe a minor has registered.

10. Changes

We post the current version with its effective date at the top of this page. We will make reasonable efforts to notify registered users by email of significant changes. Continued use after the effective date constitutes acceptance.