CrawluneIn short. The app runs on your computer and your crawl data never leaves it unless you send it somewhere yourself. The website stores what an account, a licence and a purchase need: your email and name, licence keys, a hashed device id, and Stripe's references to your payments. There are no analytics or advertising trackers, we never sell data, and you can ask for a copy or deletion of yours at any time.
1. Who is responsible
The controller of the personal data described here is Crawlune ("Crawlune", "we"). Contact for anything about privacy: privacy@crawlune.com.
The legal name and address of the operator appear on the invoice Stripe issues for every purchase, and are available on request from the address above.
2. The desktop app
2.1 What stays on your computer
When you crawl a site, the app requests its pages exactly as a browser would, identifying itself as Crawlune by default. The pages, links, findings, screenshots, exports, saved crawls, server log files you import, Google data you fetch, and your settings are kept on your machine, in memory and in the app's data folder. We never receive them. The free app needs no account and sends no telemetry.
2.2 What the app sends, and to whom
Every outbound request the app makes on its own behalf is listed here. Everything else goes only to the site you are crawling.
| Request | What is sent | When |
|---|---|---|
| Licence activation and daily check (crawlune.com) | Your licence key, a SHA-256 hash of a machine identifier (never the identifier itself), the device name, operating system and app version. Nothing about your crawls. | When you activate a Pro key, then about once a day while Pro is active |
| Update check (crawlune.com) | A request for the latest version manifest. No identifier beyond the request itself. | Shortly after the app starts |
| Crash report (crawlune.com) | App version, operating system, the error and its stack trace, and any note or contact address you type. Never the URLs you crawled, crawl data or your key. | Only if you choose to send one after a crash, or turn on always-send |
| Report delivery (crawlune.com) | The report files you chose, the recipients' email addresses, your subject and message, your licence key and device hash. | When you email a report, or a schedule does it for you |
| Email alerts (crawlune.com) | The recipients' addresses and the alert text; Slack and webhook alerts go straight from your computer to the URL you configured. | After a scheduled crawl that meets your alert rules |
| Google APIs | Requests under your Google account for the Search Console, Analytics, Sheets and Looker Studio features, and the URLs you test with PageSpeed Insights under your own API key. | Only when you connect an account or enter a key, and use the feature |
| AI provider of your choice | The title and visible text of the pages you select, sent with your own API key to OpenAI, Anthropic or Google Gemini. With Ollama nothing leaves your computer. | Only when you run an AI feature |
| Public bot IP lists | A download of Google's and Microsoft's published crawler IP ranges. Nothing is sent. | When you verify bots in a log file, cached for a week |
| Chromium download | A download from Google's public Chromium build storage. | Only if you choose to download Chromium for rendering |
The local API and MCP server listen on your computer only (127.0.0.1) behind a token and never connect out.
2.3 Data of other people that you process
Pages you crawl, server log files you import (which contain visitors' IP addresses and user agents) and reports you send to clients can contain personal data of other people. The app processes it locally and keeps only per-URL totals from log files, never the raw lines. For that data you are the controller and we are not involved; take care to have a lawful basis and to protect your exports.
2.4 Google user data
Three Pro features can use your Google account, which you connect in Settings, Integrations, and can disconnect there or at myaccount.google.com/permissions. The app asks only for the permissions each feature needs: drive.file (create spreadsheets and change only the ones it created), webmasters.readonly (read your Search Console properties and their search performance per URL) and analytics.readonly (read sessions, views and engagement per page from Google Analytics). The sign-in token and all data fetched are stored only on your device, next to the crawl, and are never sent to crawlune.com. Our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements: we do not use Google data for advertising, do not sell it, and no human at Crawlune reads it.
3. The website and your account
3.1 Visiting
The site is served through Cloudflare, which processes standard request logs (IP address, user agent, requested page, time) to deliver the site and protect it from abuse. We measure traffic with Cloudflare Web Analytics, which is cookieless: its script reports the page URL, referrer, browser type, country and load timings to Cloudflare, sets no cookie, stores no identifier and does not follow you across sites. When you arrive from a link that carries a source tag (ref or utm_source), the tag is kept only in the links on that page and recorded with a download or a new account so we know which channel brought you; it identifies the channel, not you. We run no advertising scripts. The only cookie is the sign-in session; see the Cookie policy.
3.2 Account
Sign-in runs through Auth0. We receive and store your Auth0 user id, email address, name, and the roles assigned to you; your profile picture URL is held in the session only. We send a welcome email on first sign-in. If you sign in with a social provider, Auth0 and that provider process your data under their own policies.
3.3 Purchases
Payment is handled by Stripe on Stripe's pages. Card numbers never reach us. We store Stripe's identifiers for your customer record, checkout session, subscription and payment, the plan, number of seats, status and renewal date. Stripe processes your payment details, billing address and tax status as an independent controller for payment, fraud prevention and its legal obligations; see Stripe's privacy policy. Receipts and invoices are sent by Stripe.
3.4 Licences, devices and trials
For each licence we store the key, plan, status, expiry, label and the email of any teammate you assign it to. For each activated device we store the hashed machine identifier, device name, platform, app version and the activation and last-seen times. Trials are recorded against the account so that each account gets one.
3.5 Reports you deliver and alerts you send
When you email a report from the app, the files are stored encrypted at rest in our storage for 30 days so the recipients can download them from the link in the email, together with the recipients' addresses, the site name and the download count. After 30 days the files and the record are deleted automatically. Email alerts are sent and not stored, apart from a daily count per licence used for rate limiting.
3.6 Crash reports and support
Crash reports you choose to send are stored for 12 months and then deleted. Emails you send to our support addresses are kept for as long as needed to help you and to keep a record of the conversation.
3.7 Activity log
We keep an internal log of account and licence events (purchase, renewal, activation, assignment, reminders sent, admin actions) to run the service, resolve disputes and detect abuse.
3.8 Emails
We send transactional emails about your account and licences: keys, receipts, renewal reminders, cancellation and refund confirmations, trial reminders, assignment notices and deliveries. We send marketing email only if you opted in, and every such email has an unsubscribe link.
4. Why we may process your data (legal bases)
- Performing our contract with you: accounts, licences, activation, purchases, renewals, deliveries, alerts, support.
- Our legitimate interests: securing the service, preventing fraud and licence abuse, fixing crashes, keeping an activity log, measuring traffic without identifying visitors. We balance these against your rights.
- Legal obligations: keeping tax and accounting records of sales, answering lawful requests.
- Consent: crash reports, connecting your Google account, marketing email. You can withdraw consent at any time without affecting what was done before.
5. Who we share data with
We never sell personal data and never share it for advertising. We use these processors, which act on our instructions under data processing agreements:
| Provider | What for | Where |
|---|---|---|
| Cloudflare, Inc. | Hosting, database, storage for deliveries and downloads, email delivery, request logs, rate limiting | Global network, headquartered in the United States |
| Okta, Inc. (Auth0) | Sign-in and identity | United States |
| Stripe, Inc. | Payments, invoices, tax, customer portal (also an independent controller for payment processing) | United States and Ireland |
Google and the AI providers listed in section 2 receive data only from your own computer, under your own accounts, when you use those features. We may also disclose data where the law requires it, to protect our rights or safety, or to a successor if the business is transferred, in which case this policy continues to apply.
International transfers. Our providers process data in the United States and other countries. Where your data is transferred out of the European Economic Area, the United Kingdom or Switzerland, it is protected by the EU-US Data Privacy Framework (and its UK and Swiss extensions) where the provider is certified, and otherwise by the European Commission's standard contractual clauses and equivalent UK safeguards.
6. How long we keep data
| Data | Kept for |
|---|---|
| Sign-in session | 30 days, or until you sign out; the temporary login state expires after 10 minutes |
| Account (id, email, name, roles) | Until you ask us to delete it |
| Orders, invoices and payment references | For as long as tax and accounting law requires after the last transaction, typically up to 10 years |
| Licences and devices | For the life of the licence; expired keys stay in your account so you can renew; a device record is deleted when you deactivate it or delete the account |
| Trial record | While the account exists, so that each account gets one trial |
| Delivered report files and their records | 30 days, then deleted automatically |
| Crash reports | 12 months, then deleted automatically |
| Activity log | While the related account or licence exists |
| Cloudflare request logs | Per Cloudflare's own retention; we keep no separate copy |
7. Your rights
Wherever you live, you can ask us for a copy of your personal data, to correct it, to delete it, to restrict or object to its processing, to receive it in a portable format, and to withdraw any consent you gave. Under the GDPR and the UK GDPR these are legal rights; we honour them for everyone. To exercise them, email privacy@crawlune.com from the address on your account, or tell us how to verify it is you. We answer within one month. Deleting an account removes the account, licences, devices and trial record; order records needed for tax law are kept for the period above and no longer.
If you are in the EEA or the UK, you may also complain to your data protection authority. If you are a California resident, you have the rights to know, delete, correct and to opt out of sale or sharing; we do not sell or share personal information as the CCPA defines those terms, and we do not discriminate against anyone who exercises their rights.
8. Security
Everything is served over HTTPS. Sessions use an HttpOnly, signed cookie. Licence files are cryptographically signed so the app accepts only ours, and device identifiers are hashed before they leave your computer. Payment data is handled by Stripe. Secrets are stored outside the code base and access is limited to the people who run the service. No system is perfectly secure; if we learn of a breach affecting your data, we tell you and the relevant authority as the law requires.
9. Children
Crawlune is a professional tool and is not directed at children. We do not knowingly collect data from anyone under 16; if you believe we have, write to us and we will delete it.
10. Changes
We update this policy when the service changes. The date at the top shows the current version; for material changes we email account holders before they take effect.
11. Contact
Privacy: privacy@crawlune.com. Support: support@crawlune.com.