How we keep it safe.

• It stays on your phone. an app keeps what you save in your phone’s own storage. We never receive it, and nothing on our side needs to read it. The only exception is what an app sends to the sites it lists, which you see before you open it.
• Not even your assistant sees it. assistants can read and change an app’s code, never what you saved in it.
• The code isn’t private. anyone with an app’s link can open it and read its code. Apps are checked for personal details written into the code, and warned about.

What we do keep, who can see it, and for how long is in the Privacy policy.

• Its own address. each app runs on a subdomain of its own, so no app can read another’s data, or your CloudCrane account’s cookies.
• Only the sites it lists. an app can talk to at most five websites, each named with why in its blueprint. The browser blocks every other site: every app is served with a content security policy that allows nothing else.
• No framing, no leaks. apps can’t be put inside another site’s page, and send no referrer when they link out.

Before a version is kept, it’s checked. These refuse it outright:

• a password or card field, written in the page or made by its script;
• a form that sends what’s typed in it to another website;
• an app that names a site its blueprint doesn’t list, or is too big.

Every version is kept for good and never changed, so an app can always be rolled back. An app that breaks the rules is taken down: it stops opening on every phone that has it.

• Sign-in. with Google, or a code sent to your email. We don’t hold a password for you.
• Assistants ask first. an assistant connects over OAuth, with PKCE, and only after a workspace owner approves it, choosing read only or read and build. Its keys are kept only as hashes, and an owner can sign it out in Apps at any time.
• Cookies. are locked to our own domain over HTTPS (__Host- cookies), so no app’s address can read or set them.
• Roles. every member of a workspace can see it; only the roles that need to can change things, and a workspace always keeps an owner.
• Workspaces kept apart. the database itself keeps each workspace’s records apart, with row-level security.
• Error reports. hold ids, a route and a status, never what was sent or saved.

If you think you’ve found a security issue, email support@cloudcrane.ai with what you found and how to see it. Please give us a chance to fix it before telling anyone else. To report an app that breaks the rules, use the Report this app link on its install screen (how).