Privacy
last updated: 12 July 2026Crux is a tool for running coding agents, and the things you point it at are your work and your clients' work. This page says exactly what it keeps, exactly what leaves the server, and exactly how to destroy all of it. It is written to be true rather than to be reassuring, so it names the two services your content is sent to, and it does not claim that nobody can read your data.
What crux stores
Everything below is stored because the product does not work without it. Crux has no second purpose for any of it — nothing here is collected in order to be analysed, profiled, sold, or kept against a future use.
| What | Why it exists |
|---|---|
| Your account — name, email, and a password | To be able to sign you in, and nobody else. The password is stored as a bcrypt hash; it is not recoverable, by us or by anyone. |
| Threads — everything you or your agents capture, and every reply on it | This is the product. It is whatever you typed or your agents reported: notes, questions, status, code, client work. |
| Projects — name, description, keywords | What threads get routed into, and what the router matches against. |
| Images you attach to a thread or a reply | Screenshots and photos are how an agent shows you a thing. Held on a private bucket, streamed back only through an authenticated request — never a public URL. |
| Decisions — a title, the options, and the page or audio artifact generated for it | The thing you were asked to decide, and the answer you gave. |
Secrets handed to an agent through crux need --kind secret |
A one-time credential, an OTP, an API key. Encrypted at rest, never returned in any API response, and never written into a thread, the feed, or a log. |
| An API token per device or agent you sign in from | What authenticates the CLI and the app. Only a SHA-256 digest is kept — the token itself is shown once and cannot be read back out of the database. |
| A push token per phone you sign in on | The address your phone can be reached at. Without it, crux cannot buzz you, which is most of what crux is for. |
There is no location data, no contact list, no advertising identifier, no device fingerprint, and no behavioural analytics. The app contains no analytics SDK, no advertising network, and no third-party tracker; this website loads no script at all. Crux does not send marketing email, because crux does not send email.
What leaves the server
Two services receive your content. Both are load-bearing, both are named here, and the sentence every privacy policy wants to contain — the one promising that nothing is ever passed to anybody — would have been a lie, and an easy one to write.
Expo, when your phone buzzes
A push notification is not a signal that content exists — it is content, and it travels through other people's computers to reach a lock screen. When crux notifies you, the notification carries up to 140 characters of the thing that caused it: the thread's text, the decision's title, or the message an agent flagged for you. That preview goes to Expo's push service, which hands it to Apple (APNs) or Google (FCM), which deliver it to your phone.
This is what a push notification costs, in every app that has one. It stops the moment you sign out of the app or delete your account, and it never starts if you never register a device.
Anthropic, when crux has to guess where a thread goes
When something arrives with no obvious project, crux asks a model which of your projects it belongs to. That request contains the content of the item being routed and your project names, descriptions and keywords, and it goes to Anthropic's API. It happens on capture, and on nothing else — crux does not send your threads anywhere to be summarised, indexed, embedded, or trained on.
This one is conditional. The routing model is only consulted when the server is configured with an Anthropic API key. Without one — which is the default — crux routes by matching your project's keywords, locally, and nothing about the item leaves the database.
Not a third party: the agents themselves
Crux orchestrates coding agents that run on your own computer, and those agents talk to their own model providers directly, over their own credentials, without crux in the middle. What they send is between you and them, and this page cannot honestly speak for it. It covers the crux service: the API, the app, and this site.
Where it lives
The application, its Postgres database and the private bucket holding your images and artifacts are all hosted on Laravel Cloud. Everything moves over TLS. Those providers hold the data in order to store it; they are not an audience for it.
Who can see it
No other crux user can see any of your data. Crux is one operator per account, and that is enforced in the database rather than promised in prose: every table carrying your content carries your user id, every query in the product filters on it, and a test walks the entire route table on every build and fails it if any endpoint can be made to answer one user with another user's row.
The person who runs crux can. Crux is operated by one person, and that person has administrative access to the database the same way the operator of any service does. Your content is not read, mined, or shared — but the honest word is "not", not "cannot", and any service that tells you otherwise while holding the database credentials is telling you something it has not arranged to be true. Two things are genuinely out of reach even so: your password, which is a bcrypt hash, and your handed-off secrets, which are encrypted.
How to delete it
From inside the app: Settings → Delete account. It asks for your password — a token sitting in your phone's keychain should not be enough, on its own, to destroy your archive — and then it deletes, immediately and permanently:
- every thread, reply, need and decision;
- every project;
- every image and every generated artifact, from the database and from the bucket;
- every secret, API token and push registration;
- and the account itself.
There is no soft-delete, no grace period, and no archive we keep for ourselves. Nothing of yours is left holding an owner id that no longer points at anybody. The same thing is reachable from a terminal, if the phone is not where you are:
$ curl -X DELETE "$CRUX_BASE_URL"/api/account \
-H "Authorization: Bearer $CRUX_API_TOKEN" \
-d '{"password":"…"}'One caveat, told plainly. Our host takes encrypted infrastructure backups of the database on its own schedule. A deleted account can persist inside those backups until they age out, and they are only ever read to recover the database from a failure — never to restore an individual account, and never to look at.
How long it is kept
For as long as you keep it. Crux does not expire your threads and does not delete your account for inactivity — the archive is the point of the product. Delete an account and its contents go with it, in the same request.
Children
Crux is a developer tool and is not directed at children. It is not knowingly used to collect anything from anyone under 13.
Changes, and how to reach a human
If this page changes in a way that affects what is collected or where it goes, the date at the top changes with it, and the change will be described here rather than quietly applied.
Crux is made and operated by Daniel Coulbourne in Philadelphia. Questions about your data, requests for a copy of it, or anything else on this page: [email protected]. A real person reads that address.