Privacy Policy

Version 2026-10-19 · Last updated: October 19, 2026 · Governing law: Belgium (GDPR)

1. Who we are

CronEngine is operated by Furora BV, VAT number BE0656855294, Belgium.

2. What CronEngine does

CronEngine allows you to schedule and execute HTTP requests (webhooks) based on cron expressions. You define when a job runs and which endpoint is called.

CronEngine can also monitor work and websites for you: a heartbeat receives a request from your own system when a task finishes, and an uptime monitor checks a public address you choose. You can publish a status page that shows how selected monitors are doing to anyone with its link.

We do not control or manage the content of the endpoints you configure. You remain fully responsible for the data processed by your own systems.

3. Data we collect

▸Account data: name, email address, hashed password, timezone.
▸Billing and invoice data: company name, VAT number, address, payment and invoice details. Payments are handled by Stripe, while Facturalia is used to generate and deliver invoices automatically through Peppol where applicable or by email/PDF otherwise. We never store card details.
▸Job configuration: cron expressions, request and notification URLs, headers, bot tokens, signing secrets, and other configuration you define. Secret values such as authentication secrets, signing secrets, and bot tokens are encrypted before they are stored, and are decrypted only when a request or notification is sent. See section 6.
▸Execution logs: timestamps, HTTP status codes, response times, error messages, and, when enabled in the job settings, up to 10 KB of the endpoint's response body. Larger response bodies are truncated. Stored response content may include personal or sensitive information returned by your endpoint.
▸Heartbeat pings: the time of each ping, whether it reported a start, a success or a failure, the measured run time, and the IP address and user agent of the system that sent it.
▸Uptime checks: the time, HTTP status code, response time and any error of each check, and the details of the site’s TLS certificate such as its issuer and expiry date. The page content is read only far enough to apply your success rules and is not stored.
▸Status page content: what you choose to publish, such as the page name, the names you give monitors, the updates you write, an uploaded logo and icon, a link to your website, and a custom domain. This content is public to anyone with the page’s link.
▸Two-step sign-in: if you enable it, the secret for your authenticator app, stored encrypted, and your recovery codes, stored only as one-way hashes.
▸Technical data: IP address, user agent, session identifiers for security and abuse prevention.
▸Signup protection: when you create an account, Cloudflare Turnstile checks that the signup comes from a person and not an automated script. It uses signals such as your IP address, browser user agent and connection details. We also check that your email domain can receive email and is not a temporary inbox service. We do not build or store a fingerprint of your browser ourselves.
▸Legal acceptance records: the document type and exact version, acceptance time and method, IP address, and a one-way hash of the browser user agent. We use these records to administer our contract and demonstrate which terms you accepted.
▸Optional analytics data: if you consent, Google Analytics may receive information about pages viewed, interactions, browser and device details, approximate location, and analytics cookie identifiers.
▸Optional advertising measurement data: if you consent, Google Ads may receive sign-up or purchase conversion events and advertising identifiers used to measure our campaigns.

Visitors of status pages. When someone opens a status page published with CronEngine, we process their IP address only to deliver the page and to protect it against abuse, for example by briefly counting requests for pages that do not exist. Status pages set no cookies for visitors and load no analytics or advertising tags.

Email updates from a status page. A status page can offer email updates. Someone who subscribes gives us their email address, and we store it with the page's language, when and from which IP address they subscribed, when they confirmed, and which emails we sent them. Nothing is sent except a confirmation email until they confirm (double opt-in). Every later email has a one-click unsubscribe, and unsubscribing deletes the address. For a status page published by a CronEngine customer, that customer decides to offer email updates, can see their subscribers' addresses, and is responsible for them; we process the addresses on the customer's behalf, only to send that page's updates. For CronEngine's own status page, we are responsible for them.

4. Why we process data

To provide and operate the service (job scheduling and execution, monitoring, and status pages)
To secure the platform and prevent abuse
To handle billing and invoicing
To communicate important service messages
To send status page updates to the people who subscribed to them
With your consent, to understand site usage and improve CronEngine
With your consent, to measure advertising conversions

Legal bases include performance of a contract, legal obligations, and our legitimate interests in securing and operating the service. Optional analytics and advertising measurement are based on your consent, which you may withdraw at any time.

5. Retention

▸Execution logs: retained for 30 days, including any response content stored with those logs.
▸Ping and check history: each heartbeat and uptime monitor keeps a limited number of recent pings or checks, set by your plan. Older entries are removed as new ones arrive.
▸Outage records: kept for as long as the job or monitor exists, so uptime figures stay accurate, and deleted together with it.
▸Status page content: kept until you change or delete it. A replaced logo or icon is deleted, and deleting a page deletes its updates, uploads and settings.
▸Notification delivery records: sent, suppressed, and failed outbox records are retained for 30 days.
▸Status page subscribers: an address that is never confirmed is deleted after 2 days. A confirmed address is kept until its owner unsubscribes, the page owner removes it, or the page is deleted. Records of status emails sent are kept for 30 days.
▸Digest statistics: compact daily run totals used for weekly or monthly email summaries are retained for 120 days by default. They do not contain response bodies.
▸Account data: retained while your account is active and permanently deleted 30 days after closure.
▸Legal acceptance records: retained with your account and deleted when the account is permanently deleted after the 30-day recovery period.
▸Invoice data: retained for 7 years as required by law.

6. How we protect your data

Account passwords are stored only as one-way hashes and are never recoverable.

Job and notification credentials cannot be hashed, because CronEngine has to replay them on your behalf. Instead the following values are encrypted before they are written to the database, and decrypted only at the moment a request or notification is sent: job authentication secrets, custom request headers, request bodies, notification destination URLs, webhook signing secrets, bot tokens, and two-step sign-in secrets. Two-step recovery codes are stored only as one-way hashes.

The encryption key is held outside the database and is deliberately excluded from database backups, so a copy of the database alone does not reveal these values. Database backups are themselves encrypted.

Authentication secrets, signing secrets, and bot tokens are also write-only. Once saved they are never displayed again, including to you. You can replace one at any time.

Stored response content described in section 3 is not covered by this encryption. If your endpoint returns personal or sensitive information, disable response-body storage for that job.

These measures reduce risk but cannot eliminate it. No online service can guarantee that a security incident will never occur.

7. Notification destinations and responsibility

A custom notification email must be verified through a one-time link before it becomes active. Until verification succeeds, job emails continue to use the verified account address or the previously verified notification address.

You are responsible for the endpoints you configure and the data they process.

CronEngine only executes HTTP requests based on your configuration. We do not inspect or control the content of requests or responses beyond what is required for execution and logging.

Because endpoint response content may be saved in run history, configure your endpoints and response-storage setting to avoid retaining personal or sensitive information that is not needed for monitoring. You can disable response-body storage for a job.

You are responsible for what you publish on a status page. Do not include personal data or confidential details in monitor names, updates or uploaded images, because a status page can be read by anyone with its link.

You must ensure that your use of CronEngine complies with applicable data protection laws.

8. Processors

We rely on providers and connected Furora services to operate CronEngine:

Stripe for payment processing
Facturalia, operated by Furora BV, for automatic invoice generation and Peppol or email/PDF delivery
Cloudflare Turnstile, on the signup page only, to tell people apart from automated signups. See Cloudflare’s Turnstile Privacy Addendum.
Hosting provider for infrastructure
Amazon Web Services (Amazon SES) as our email provider, for account messages and status page emails
Slack, Discord, Telegram, or another notification endpoint when you configure that provider or destination
A public certificate authority, when you put a status page on your own domain. Certificates and the domain names in them are recorded in public Certificate Transparency logs, as they are for every website certificate.
Google Analytics and Google Ads for optional analytics and advertising measurement, but only after you consent to the corresponding purpose

You can learn more about how Google handles information in Google's Privacy Policy. We do not sell your personal data.

9. Cookies and similar storage

We always use essential cookies and local storage required for authentication, security, and remembering your privacy choices. Google Analytics and Google Ads tags remain blocked unless you opt in to the corresponding purpose. Status pages published with CronEngine set no cookies for their visitors. The signup page loads Cloudflare Turnstile to block automated signups; it is part of keeping the service secure and is not used for analytics or advertising.

You can accept, reject, or choose each optional purpose separately. Change or withdraw your choice at any time using Cookie settings in the footer. See our Cookie Policy for details.

10. Your rights

You have the right to access, correct, delete, restrict, or transfer your personal data, and to object to certain processing. Where processing is based on consent, you may withdraw it at any time without affecting processing that occurred before withdrawal.

11. Changes

We may update this policy when our service or legal obligations change. We will publish the updated date on this page and provide additional notice where required.