Privacy policy
Last updated: 9 October 2026
This policy covers Cronum Work, the apps of Cronum Studio (Tasks at tasks.cronumstudio.com, Next at next.cronumstudio.com, Notes at notes.cronumstudio.com, and Projects at projects.cronumstudio.com), their connectors for AI assistants, and this website. In short: we keep what you put in the apps so the apps work, we don't sell it, we don't show ads, and we don't use your content to train AI models.
Who is responsible
The controller of your personal data is Martin Andersen, self-employed, trading as Cronum Studio (“we”), tax ID (NIF) X3766667A, Juan de la Cierva 13A, 1º, 15008 A Coruña, Spain. Write to privacy@cronumstudio.com about anything in this policy.
What we collect
Your account
Your name and email address, and how you sign in. Sign-in is handled by WorkOS: if you sign in with Google or another provider, we receive from it your name, your email address and your profile picture, if there is one. We never see your Google password.
What you put in the apps
In Tasks: your lists, tasks, subtasks, notes, due dates, attachments and the people you share lists with. In Next: your projects, branches, steps, the progress you log and the names of the assistants that log it. In Notes: your notebooks, notes, tags, earlier versions, attachments and the people you share notebooks with. In Projects: your projects, phases and tasks, with their dates, dependencies and deadlines, and the people you add to them. This is the content of the service: we only use it to provide the service to you.
Connections with AI assistants
When you connect an app to an assistant such as Claude or ChatGPT, you authorise it on a consent screen, and we keep the access token, the name of the assistant (the client) and when it was used. We log which tool each request ran, when, and for which account, so we can show you the history, investigate abuse and fix errors.
Technical data
IP address, browser and device, in your sessions and in security logs (sign-ins, failed attempts, changes to your account), and in the request logs of this website. If you turn on notifications, your browser's push subscription.
Payments
Paid plans are sold by Paddle (Paddle.com Market Limited), our reseller and Merchant of Record: Paddle takes the payment, issues the invoice and handles taxes, and it processes the data you give it at checkout as its own controller, under the Paddle privacy policy. Paddle tells us your name, email address and country, the plan, its price and status, and the identifiers of your subscription and payments. We never see your card or bank details.
Early-access requests and emails
If you ask for early access on this website, we keep your email address, the apps you chose and the date, to answer you. If you write to us, we keep your message and our reply. We send emails only to run the service: confirmations, sign-in links, invitations and notices about your account or your plan.
What the AI assistants do with your data
When you connect an assistant, it can read and change the data of your account through the tools you allow, only while you use it and only with your authorisation. What you write to the assistant, and what it reads from the apps, is also processed by the assistant's provider under its own terms and privacy policy (for example Anthropic for Claude and OpenAI for ChatGPT). We send nothing to those providers on our own: the assistant asks, and we answer. You can disconnect an assistant at any time, in the app's settings or in the assistant, and its token stops working.
Why we use it, and on what basis
- To provide the service you signed up for (your account, your content, the connections you make): performance of our contract with you.
- To manage paid plans with Paddle and keep the records the law requires: our contract with you and our legal obligations.
- To keep the service secure and working (security logs, abuse prevention, error logs): our legitimate interest in running a safe service.
- To answer your early-access request or your messages: the steps you ask us to take before a contract, and our legitimate interest in answering you.
- Push notifications: your consent, which you can withdraw in the app or in the browser.
We don't sell or rent personal data, we don't use it for advertising, we don't build profiles of you, and we don't use your content to train AI models.
Who processes it for us
We use these providers, each bound by a data processing agreement, and only for what is described:
| Provider | What for | Where |
|---|---|---|
| Hetzner Online GmbH | Servers where the apps and their data live, and their backups | Germany (EU) |
| WorkOS, Inc. | Sign-in, accounts, the sign-in and sign-up emails, and the early-access list | United States |
| Cloudflare, Inc. | This website, DNS, network protection and request logs | Global network |
| HostArmada | Our mailboxes (hello@ and privacy@) | Germany (EU) |
Paddle is not one of them: it sells the paid plans and handles payment data as its own controller, as explained above.
Transfers outside the European Economic Area are covered by the EU–US Data Privacy Framework where the provider is certified, by the European Commission's standard contractual clauses, or, for the United Kingdom, by the Commission's adequacy decision.
How long we keep it
- Your account and content: while your account exists. When you delete something it is gone from the app at once. When you delete your account, it stops working at once and is deleted with everything in it 30 days later; until then, signing in takes it back. What you share with other people (a list, a notebook, a project) passes to one of them, so they keep it.
- Backups of the servers rotate and are overwritten within 7 days: what is deleted from the apps leaves them 7 days later.
- Security and access logs: up to 12 months.
- Records of plans and payments: as long as tax and commercial law require (in Spain, up to six years).
- Early-access requests: until we answer them, and at most 12 months.
- Your messages to us: as long as needed to deal with them, and at most two years after the last one.
Your rights
You can access, correct, export or delete your data, object to or restrict its use, and withdraw any consent you gave. In every app, Settings → Your data lets you download a copy of your data (Download my data), erase what you have in that app and keep your account (Erase my data), or delete your account (Delete my account). For anything else, write to privacy@cronumstudio.com from the email of your account. We answer within one month. If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (aepd.es) or to the authority where you live.
Cookies
We only use the cookies the service needs, and no advertising or analytics cookies. The details are in the cookie policy.
Security
All traffic is encrypted (HTTPS). Access tokens for assistants are stored hashed, expire, and can be revoked; passwords, when used, are handled by WorkOS; two-factor authentication is available.
Children
The service is not meant for children under 16, and we don't knowingly collect their data.
Changes
If we change this policy in a way that matters, we will say so in the apps or by email before the change applies. The date at the top shows the latest version.