Privacy Policy
What personal data Chronos collects, why, who it goes to, how long it is kept, and your rights.
Effective 22 October 2026
1. Who we are
Chronos is offered by Abhishek DG, an individual in India trading as 2090.tech (“we”, “us”). For your account data, we decide why and how it is processed: we are its data fiduciary under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”), and its controller under laws like the EU and UK GDPR. Contact: legal@2090.tech.
2. Two kinds of data
| Data | Whose decisions | This policy |
|---|---|---|
| Account data: about you as a user of Chronos (your sign-in, your org, how you use the service) | ours: we are the data fiduciary / controller | covers it in full |
| Customer data: what you and your tools put in your databases, and the data of your app’s users in Chronos Auth | yours: we process it on your instructions, as your data processor | governed by the Data Processing Terms; your own privacy policy tells your users about it |
If you are a user of an app built on Chronos, the app’s operator is responsible for your data. Ask them first; we help them answer.
3. What we collect
You give us
- Sign-in details: your email address, and if you sign in with GitHub, your GitHub username, account id, display name and avatar, as GitHub shares them. We never receive your GitHub password, and Chronos sign-in has no password of its own.
- Org and team details: org names, who you invite (email or GitHub username) and their roles, project names, the git remote of a project you connect.
- Messages: what you write to us, and your notification choices.
Collected as you use the service
- Usage: per project, storage used, open worlds, data sent, time awake; per agent, what it did (forks, writes, merges) and the name and version of the program that connected (for example an AI coding tool).
- Security and service logs: IP address, browser or client type, request times and outcomes, sign-in events, and errors.
- Device sign-in: the codes your command-line tool shows, until they are used or expire.
From others
- Your sign-in provider: the details above, when you choose it.
- People in your org: an owner who invites you gives us your email or GitHub username.
For your apps (as processor)
If you turn on Chronos Auth, we hold your app users’ email addresses, password hashes (Argon2id; never the password), sessions, sign-up and sign-in times, and failed sign-in counts per email and per IP address, for you. Data in your databases is whatever you put there.
4. What we don’t do
- We don’t sell or rent personal data.
- We don’t show ads, and the site and dashboard use no analytics or advertising trackers.
- We don’t use your data, or your databases’ contents, to train AI models.
- We don’t look at customer data, except as needed to keep the service running, to fix a problem you ask us to fix, for security, or where the law requires it.
5. Why we use it
| Purpose | Basis |
|---|---|
| create and run your account, sign you in, provide the service and its features | your consent when you sign up (DPDP Act); performing our contract with you (GDPR) |
| enforce plan limits, show your usage, and (when paid plans exist) bill you | your consent / contract |
| keep the service and its users secure: detect abuse, slow repeated failed sign-ins, investigate incidents | legitimate uses permitted by law / our legitimate interests |
| send service emails: sign-in codes, reviews waiting (if you keep them on), important changes | your consent / contract |
| answer your messages and complaints | your consent / contract |
| comply with law and legal requests | legal obligation |
You can withdraw consent at any time by closing your account; processing done before that stays lawful, and without it we can’t provide the service.
6. Who we share it with
We use service providers who process data for us, under contracts that limit them to doing so:
| Kind of provider | For |
|---|---|
| cloud hosting and storage | running databases, the platform and backups |
| website hosting and content delivery | serving the site and dashboard |
| DNS and network security | routing traffic to the service and protecting it |
| sign-in and identity | signing you in with an email code or your chosen provider |
| email delivery | sending sign-in codes and notifications |
| payments (when paid plans launch) | taking payment; we never see full card numbers |
Ask legal@2090.tech for the current list of providers by name. We also share data: with your sign-in provider when you choose it; with people in your org (your name or username and role); when the law requires it or to protect rights, safety and security; and with someone who takes over the service, who must keep to this policy.
7. Where it is processed
We and our providers process data in India and in other countries, including the United States and countries of the European Union. Where we transfer personal data out of India, we do so as the DPDP Act allows; for data of people in the EU or UK, with safeguards such as the European Commission’s standard contractual clauses.
8. How long we keep it
| Data | Kept |
|---|---|
| account and org details | while your account is open; deleted within 30 days of closing it, except what law requires us to keep |
| customer data | until you delete it or the project; past versions for the plan’s history window (1 hour on the free plan); backups for the plan’s backup period (7 days on the free plan) |
| agents’ activity records | with the database: for its history window |
| security and service logs | up to 90 days, longer only while investigating an incident |
| sign-in codes | until used, or 15 minutes |
| messages to us | as long as needed to deal with them, and then up to 2 years |
9. How we protect it
- All connections use TLS; Postgres connections require it.
- API keys, tokens and session secrets are stored only as hashes; secrets we must use again are encrypted (AES-256-GCM).
- Each project’s database runs separately, with its own files and credentials.
- Access to production systems is limited to what running the service needs.
- If a breach affects your personal data, we tell you and the authorities as the law requires, without undue delay.
No system is perfectly secure; we can’t promise data will never be lost or exposed.
10. Your rights
Depending on where you live, you can:
- get a summary of the personal data we hold about you and how we process it, and who we shared it with;
- have inaccurate or incomplete data corrected or completed, and have data erased;
- withdraw consent;
- object to or restrict processing, and receive your data in a portable form (EU and UK);
- nominate someone to exercise your rights if you die or can’t (DPDP Act);
- complain to us (below), and, if we don’t resolve it, to the Data Protection Board of India, or your local data protection authority.
Write to legal@2090.tech from your account’s email address. We may ask you to confirm it’s you. We answer within 30 days, and don’t charge for it. Much of your data you can see and change yourself in the dashboard.
11. Children
Chronos is for people 18 and over. We don’t knowingly collect data of anyone younger. If you think a child has given us personal data, write to legal@2090.tech and we will delete it.
12. Cookies
We use only the cookies and browser storage the service needs to work: to keep you signed in, protect sign-in and remember dashboard preferences. No tracking or advertising cookies. See the Cookie Notice.
13. Changes
We may update this policy. If a change matters, we tell you by email or in the dashboard before it takes effect. The date at the top says when it last changed.
14. Contact and grievances
Privacy questions and requests: legal@2090.tech. Grievance Officer (DPDP Act and Information Technology Act, 2000): Abhishek DG, legal@2090.tech. We acknowledge a complaint within 24 hours and resolve it within 15 days.