Privacy policy

The controller for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Nicolas Guerrero Tello
Meyerstraße 216
28201 Bremen
Germany

Email: hallo@cracha-app.com

No data protection officer has been appointed, as the statutory requirements for this are not met.

When you visit the website. Our hosting provider processes technically necessary connection data such as IP address, time of the request, address requested, amount of data transferred and browser identifier. This data is needed to deliver the page and serves to fend off attacks.

Audience and performance measurement. We use Cloudflare Web Analytics to see which pages are visited and how fast they load. For this, your browser loads a script from static.cloudflareinsights.com that sends measurements to Cloudflare when a page loads and when you leave it: the page visited, the referring page (referrer) and load and performance values such as load times. According to Cloudflare, URL parameters are not logged. As with every request, your browser technically also transmits your IP address and its browser identifier.

According to Cloudflare, the script sets no cookies and does not read or write any storage in your browser (neither localStorage nor sessionStorage nor IndexedDB). The IP address is discarded at the nearest Cloudflare data center and not stored in databases or logs. According to Cloudflare, it does not recognize visitors by IP address, browser identifier or other characteristics (“fingerprinting”) and does not track individuals across websites. We only see aggregated statistics and cannot identify individual visitors from them. Cloudflare describes the details in the documentation on the Web Analytics beacon. You can prevent the measurement by blocking scripts from this address in your browser, for example with a content blocker; the website then works unchanged.

Error reports. If a program error occurs in your browser, the website sends an error report to Sentry. It contains the error message and the place in the program code, the page visited without URL parameters, the previously visited pages and requests without their content, browser, operating system and the time. We do not transmit names, email addresses, cookies or chat content. As with every request, your browser technically also transmits your IP address. The reports are stored in Sentry's EU region (Frankfurt am Main) and deleted automatically after the service's retention period.

When you sign up. We process your email address, the name you give and your password. We do not store the password in plain text, only as a cryptographic hash at our authentication provider. If you sign in with Google, we receive your email address, your name and your profile picture from Google — no password.

When you use the service. For every knowledge base you create we store its name, the source address you entered, the time of the last update, counts on its size and your user ID. We also store the content created when the website you specified is fetched. Your chat questions are processed to answer them; we store questions, answers and source references as chat history in your account, together with the knowledge base used, so you can open your chats later and on other devices. Only you can see them. A language model at Cloudflare (Workers AI) creates a short title from the first question of a chat. You can rename and delete chats and export answers at any time. To generate answers, the question, a limited conversation history and relevant source texts are sent to the AI services used. Logging of question and answer content at the AI gateway is disabled for these calls.

Content of the websites you fetch. CraCha fetches the website you specify and stores its text content in a search index. If that website contains personal data of third parties — such as names and contact details on a team page — this is processed as well. See section 6 on this processing.

One-time reminder. If you haven't read a website 24 hours after signing up, we send you a single email with tips for getting started. For this we use your email address and store the time it was sent. We send no further emails of this kind. You can object at any time, for example with a short reply to the email or to hallo@cracha-app.com; this costs you nothing beyond the transmission costs at basic rates.

Usage analysis. To understand where new users get stuck, we count from the account and credit records that exist anyway how many accounts were confirmed, read a website, received an answer or used CraCha on several days. We only see totals, not individual people. No additional data is collected for this, and no cookies or tracking scripts are used.

• Providing the service, account and sign-in — Art. 6(1)(b) GDPR (performance of a contract or pre-contractual measures).
• Confirming your email address — Art. 6(1)(b) and (f) GDPR. It prevents other people's addresses from being used for accounts and limits abusive use of our resources.
• Delivering the website, stability and security — Art. 6(1)(f) GDPR (legitimate interest in a working service that is secure against attacks).
• Audience and performance measurement with Cloudflare Web Analytics — Art. 6(1)(f) GDPR (legitimate interest in seeing which pages are used and where load times make the service worse). You can object to this processing under Art. 21 GDPR.
• Error reports with Sentry — Art. 6(1)(f) GDPR (legitimate interest in detecting and fixing program errors before they affect many users). You can object under Art. 21 GDPR.
• One-time reminder email — Art. 6(1)(f) GDPR (legitimate interest in helping new users get started with the service they already signed up for) in conjunction with Section 7(3) of the German Act against Unfair Competition (UWG). You can object at any time under Art. 21 GDPR.
• Aggregated usage analysis — Art. 6(1)(f) GDPR (legitimate interest in improving how people get started with the service). You can object under Art. 21 GDPR.

We use no cookies for analytics, advertising or tracking. No ad networks and no social media plugins are embedded. According to Cloudflare, the audience measurement with Cloudflare Web Analytics described in section 2 works without cookies and without storage in your browser.

We only use:

• Session cookies of the authentication service that keep you signed in between page views. Without them, signing in is technically not possible.
• A language cookie (NEXT_LOCALE) that remembers whether you chose German or English.
• Local storage in your browser for your theme choice, chat histories with sources and ratings, and recently started crawls. Account-related histories are reset when the user changes. Questions and the necessary conversation context are transmitted with a request to our services.

We don't run CraCha on our own hardware but on third-party services. Depending on the service, they process data as processors or under their own data protection responsibility:

• Cloudflare — delivering the website, audience and performance measurement (Web Analytics), storing knowledge bases and fetched content, running the language models that answer your questions, and forwarding emails to hallo@cracha-app.com (Email Routing).
• Supabase — managing user accounts and sign-in, and storing your chat history.
• Resend — sending the confirmation and password emails and the one-time reminder email.
• Modal — running the fetches of the websites you specify.
• Sentry (Functional Software, Inc.) — receiving and storing error reports from the browser in the EU region.
• OpenRouter (OpenRouter, Inc., USA) — routing answer generation to the language model DeepSeek V4.1 Flash, run by DeepInfra, Fireworks AI or Together AI (each USA), alternatively GPT-6 Luna at Microsoft Azure or OpenAI. For generation, the model receives questions, limited conversation history and relevant source texts. We only allow providers that do not use this data for training; providers in China are excluded. According to OpenRouter, it does not store question and answer content.
• Google — for answer generation with Gemini via the Cloudflare AI Gateway and for optional sign-in with Google. For generation, the model receives questions, limited conversation history and relevant source texts. Emails to hallo@cracha-app.com also end up in a Google Mail inbox.

For payments, Stripe processes payment and billing data. We store the link to your account, payment references, credit records and the documented declaration on the immediate start of performance. We do not store full card details. The processing serves the performance of the contract (Art. 6(1)(b) GDPR), statutory retention obligations (point (c)) and the prevention of abuse (point (f)).

Your data is not transferred for advertising purposes or sold to third parties.

Transfers to third countries. Some of these providers are based in the United States or also process data there. Transfers are based on the European Commission's standard contractual clauses under Art. 46(2)(c) GDPR and, where the provider is certified, the EU-US Data Privacy Framework under Art. 45 GDPR.

When you specify a website, we fetch its publicly accessible pages and store the text in a search index only you can access. The following applies:

• We only fetch publicly accessible pages. Areas behind a login are not fetched.
• The instructions in the robots.txt file are respected on request (a setting when reading).
• Only choose content you may lawfully fetch and analyze. The data protection obligations depend on the content and your purpose. Details are set out in the terms of use.
• If you delete a knowledge base, the associated content and search index are deleted.

• Account and usage data is stored as long as your account exists. You can delete your account yourself at any time under “My account”. We then cancel running fetches and immediately delete your login data (email address, name, password hash, Google link), all knowledge bases with the fetched content and the search index, cached search results, your chat history, your balance and your credit records. Any remaining balance, including purchased credits, is forfeited without refund. The crawl history is removed in the browser in which you trigger the deletion; on other devices it only exists locally and can be deleted in the browser there.
• Knowledge bases and content are removed when the knowledge base or your account is deleted.
• Chats are stored until you delete them, delete the knowledge base you used for them, or delete your account.
• Payment records for purchased credit packs (amount, credits, payment reference, status of refunds and chargebacks, documented declaration on the immediate start of performance) are kept for the statutory periods (Section 147 of the German Fiscal Code, Section 257 of the German Commercial Code). After an account is deleted, this happens without a link to your account. Stripe can still match the payment reference; Stripe stores payment and customer data under its own responsibility and retention periods.
• Crawl status data at the crawler service (Modal) contains a job ID, the progress, the last page address fetched and, if applicable, an error message, but no user ID. It is removed automatically once its last update is seven days old and the crawl has been settled.
• Cached search results are discarded automatically as soon as the underlying index changes.
• Sign-in logs of our authentication provider (sign-ins, sign-outs, password and account changes with email address) are deleted after 30 days, and after an account deletion by the following day at the latest.
• Server logs are deleted according to the retention periods set up for the respective service. Technical operating data can include errors, times, user or request IDs and usage values.

You have the following rights towards us:

• Access to the data stored about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on a legitimate interest (Art. 21 GDPR)

An informal message to the email address above is enough to exercise them. Regardless of this, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority where you live.

We adapt this policy when the service or the legal situation changes. The version available on this page applies. We inform registered users of significant changes by email.