Privacy Policy

Crewly (“Crewly,” “we,” “us”) builds an open-source multi-agent orchestration platform and the companion Chrome extension “Crewly in Chrome.” This policy describes what data we collect, why we collect it, and how it’s used. We minimize collection by design: most data stays on your machine, and what we route through our cloud is the minimum needed to coordinate your agents and your browser.

1. What the Chrome extension does

The “Crewly in Chrome” extension lets a Crewly agent running on your machine (the “OSS engine”) drive Chrome tabs on your behalf — opening pages, reading the DOM, clicking elements, filling forms. Commands originate from your agents and are carried over a WebSocket to the extension via our Cloud Relay at wss://api.crewlyai.com/relay.

The extension does not browse on its own and does not transmit page content to any third party. It executes only the commands sent by the agent you are signed in as.

2. Permissions and why we need them

• tabs / tabGroups / activeTab — list, focus, and navigate tabs you have asked the agent to operate.
• scripting — run small read-only scripts in the page context to extract data your agent asked for (e.g. visible text, link list).
• debugger — used as a fallback to dispatch clicks and keystrokes via Chrome DevTools Protocol when the regular scripting path is blocked by site-level CSP. Only attached to tabs the agent is actively driving and detached when the task ends.
• cookies — read existing cookies for sites you instruct the agent to interact with (e.g. so an authenticated workflow continues to work). The extension does not export cookies off your machine.
• storage — store the OAuth session token, instance identifier, and a small set of UI preferences in chrome.storage.local. Cleared on logout.
• identity — initiate the Google OAuth sign-in flow so the extension can pair with your Crewly account.
• alarms — keep the service worker alive long enough to maintain the WebSocket connection between commands.
• host_permissions: <all_urls> — the agent may direct the extension to operate on any site you choose. We do not enumerate or scan sites; the extension only acts on the URL the agent has been told to visit.

3. Data we collect

• Account data: your Google email and profile name (from OAuth), used only to identify your account and route browser commands to the right session.
• Authentication tokens: a session JWT signed by crewlyai.com, stored locally in chrome.storage.local and used to authenticate the relay WebSocket. Tokens are refreshed automatically and cleared on logout.
• Browser commands and responses: the agent commands (e.g. “navigate to URL X,” “click selector Y”) and the results (status, optional snippet of page content the agent requested) pass through the Cloud Relay. We do not persist command bodies beyond what is required to deliver them (queued items expire within minutes of delivery).
• Operational logs: connection metadata (timestamps, instance IDs, error codes) are logged for diagnostics and capped to a short retention window. We do not log page content.

The extension does not collect browsing history, passwords, financial data, health data, personal communications, or location.

4. How data is used

Data is used solely to operate the service you asked for — pairing the extension with your account, delivering agent commands, returning responses, and maintaining the connection. We do not sell user data and we do not use your data for advertising. We do not transfer data to third parties for marketing or analytics purposes.

5. Where data is stored

• Locally on your machine: agent sessions, conversation history, command logs, and (for the extension) auth tokens. None of this leaves your machine unless your agent explicitly transmits it.
• On our Cloud Relay (api.crewlyai.com): only what is required to deliver a command in flight. Queued payloads are short-lived; we do not maintain a long-term store of your browser commands or their responses.
• On the Crewly account service: your account identity (Google sub, email, name) and subscription tier.

6. Data sharing

We do not share, sell, rent, or trade personal data with third parties. The only third-party data flow is the Google OAuth handshake (initiated by you), which is handled by Google directly. Our hosting infrastructure (currently Vercel and DigitalOcean) may process traffic in transit; they operate as data processors and do not access content.

7. Your controls

• Logout in the extension popup clears all local tokens and disconnects the WebSocket.
• Uninstall the extension removes all chrome.storage.local data it stored.
• Account deletion: email [email protected] and we will delete the associated account record within 30 days.

8. Children

Crewly is intended for software developers and is not directed at children under 13. We do not knowingly collect data from children.

9. Changes to this policy

When we make material changes we will update the Effective date above and, when appropriate, notify active users. Continued use of the service after a change constitutes acceptance.