Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

• Controller: Cronic
• Email: privacy@cronic.team
• Privacy contact: dpo@cronic.team

This policy covers the Cronic mobile app (iOS and Android), the web console at console.cronic.app and this website, cronic.app.

2. Information We Collect

Cronic collects information you provide when you create an account and use our service. We are committed to collecting only what is necessary to deliver our AI-powered news and newsletter reading service.

Account Information

• Name, email address and, if you set one, a username and profile picture
• Password (stored as a secure hash — we never store your plaintext password)
• If you sign in with Google: your Google account name, email address and profile picture
• Your consent choices (terms acceptance and analytics consent, with the date you gave or withdrew them)

Content You Bring to Cronic

• Newsletter emails you forward to your personal Cronic address
• If you connect Gmail: the emails Cronic reads to detect your newsletters and import the ones you select (see Section 5)
• Sources you add (websites, RSS feeds, YouTube channels, podcasts) and sources you follow from our catalog
• Your bookmarks, notes, reading history, likes, archived posts, topic watches and questions you ask in the app
• Voice questions you record for the “Ask the hosts” podcast feature (only when you use it)

Data Generated by the Service

• AI summaries, daily briefs, digests and audio episodes generated from your sources
• “Your AI Profile”: a profile of your interests derived from your reading, used to personalize your feed. You can view and edit it in the app.

Device and Notification Data

• A push notification token for your device (only if you allow notifications)
• Your time zone (detected from your device, used for quiet hours and delivery schedules), language and notification preferences

Payment Information

We never receive or store your full card number or CVC. On iOS, subscriptions are purchased through the Apple App Store and billed to your Apple ID; we use RevenueCat to verify the purchase status. On Android and on the web, payments are processed by Stripe, which may share limited information (e.g., last four digits, card brand) for display in your account.

Automatically Collected Data

• Product analytics (PostHog): how features are used, page and screen views, and device and app version information — only with your consent (see Section 10)
• Cookieless audience measurement of the cronic.app website (PostHog): page views, clicks, performance, referring site, device and browser type, counted anonymously with an identifier that changes every day, with no IP address kept and no link to your account (see the Cookie Policy)
• Error and performance data (Sentry): crash reports and performance traces. On the web console, masked session replays are recorded only with your consent.
• Click measurement in our service emails: links in our emails pass through our email provider (Resend), which records that a link was clicked. We do not use open-tracking pixels: we do not know whether you opened an email.
• Server logs, including IP addresses, kept for security and troubleshooting
• Theme preference and cookie-consent choice (stored in your browser's localStorage)

3. Legal Basis for Processing

Under Article 6 of the GDPR, we process your personal data on the following legal bases:

Where we rely on consent, you may withdraw it at any time (see Section 10). Where we rely on legitimate interest, we have assessed that our interest in maintaining service reliability and security does not override your rights and freedoms.

4. How We Use Your Information

• Provide, operate, and maintain the Cronic service
• Import, summarize, translate and curate your content using AI, and generate briefs and audio versions
• Send the push notifications and emails you have enabled
• Process payments and manage subscriptions
• Monitor and fix errors to improve service reliability
• Understand how the product is used to improve it (with your consent)
• Communicate with you about your account
• Comply with legal obligations

We do not use your emails or content for advertising.

5. Gmail Access

If you choose to connect a Gmail account:

• Cronic requests read-only access (gmail.readonly) plus your basic profile (name and email address). Cronic cannot send, delete, label or otherwise modify your emails.
• Cronic reads your mailbox to detect newsletters, lets you choose which ones to import, and then imports new emails as they arrive.
• Your Google access credentials are stored encrypted at rest.
• You can disconnect Gmail from the app at any time, and revoke Cronic's access from your Google Account permissions page.

Cronic's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. Sub-Processors and Third-Party Services

We share data with the following sub-processors, each for a specific purpose:

Apple (App Store and push notifications on iOS) and Google (Google Play services and push notifications on Android, Sign in with Google) also process data under their own privacy policies when you use their platforms.

We do not sell, rent, or trade your personal information to any third party.

7. International Data Transfers

Some of our sub-processors are located in the United States. When personal data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place:

• EU-US Data Privacy Framework — for sub-processors certified under the framework
• Standard Contractual Clauses (SCCs) — approved by the European Commission, used with sub-processors not covered by an adequacy decision

You may request a copy of the applicable safeguards by contacting dpo@cronic.team.

8. Data Retention

We retain your data for the periods described below:

You can delete your account at any time in the app (Settings → Security & Sessions → Delete account). Deletion is immediate and erases your account and the data linked to it; connected Google access is revoked and Stripe subscriptions are cancelled. You can also email privacy@cronic.team from the address registered on your account, and we will delete it within 30 days. Records we must keep by law (e.g., financial records) are retained only as required. Deleting your account does not cancel an App Store subscription: cancel it in your Apple ID settings first.

9. Cookies and Local Storage

We use a small number of cookies and browser storage, detailed in our Cookie Policy:

• Authentication cookies (httpOnly, secure) on the web console — access token (7-day expiry) and refresh token (30-day expiry)
• Analytics cookies (PostHog) — require your consent before being set
• Theme preference and consent choice — stored in localStorage (not cookies)

10. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Access — obtain a copy of your personal data (Art. 15)
• Rectification — correct inaccurate or incomplete data (Art. 16)
• Erasure — request deletion of your data ("right to be forgotten") (Art. 17)
• Restriction — restrict processing in certain circumstances (Art. 18)
• Data portability — receive your data in a structured, machine-readable format (Art. 20)
• Object — object to processing based on legitimate interest (Art. 21)
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing (Art. 7(3))

Withdrawing analytics consent: in the app, open Settings → Privacy & Analytics and turn off the analytics toggle. This stops product analytics from the app and from our servers for your account, as well as click measurement in our emails attached to your account. You can also object to click measurement at any time (Art. 21) by writing to privacy@cronic.team. On the web, use the cookie banner choice (see the Cookie Policy). Error monitoring for service reliability stays active.

To exercise any of the other rights, contact us at privacy@cronic.team. We will respond within 30 days.

11. Right to Lodge a Complaint

If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority in the EU member state of your habitual residence, place of work, or place of the alleged infringement (GDPR Art. 77). In France, this is the CNIL.

A list of EU data protection authorities can be found on the European Data Protection Board website.

12. Data Security

• Passwords are hashed using industry-standard algorithms (bcrypt)
• Credentials for connected accounts (such as Gmail) are encrypted at rest
• Authentication on the web uses httpOnly, secure cookies to prevent XSS attacks
• All connections use HTTPS/TLS encryption in transit
• Access to production systems is restricted on a need-to-know basis

13. Children's Privacy

Cronic is not intended for children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

14. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email or a notice on our website. We encourage you to review this page periodically.

15. Contact Us

If you have questions about this privacy policy or your personal data, contact us at:

• Privacy inquiries: privacy@cronic.team
• Privacy contact: dpo@cronic.team
• General support: support@cronic.team — see also our Help Center