01 / 04
HTTPS everywhere
Crow uses HTTPS to protect information moving between your browser and our services.
Your pages and leads, looked after.
Clear security practices, data boundaries and a direct way to contact our team.
No plain-text passwords. Not now, not ever.
At a glance
Security controls and retention practices described in Crow's Privacy Policy.
02 / 04
Bcrypt-hashed passwords
Passwords are hashed with bcrypt, never stored as plain text.
03 / 04
Server-side sessions
The app uses one first-party session cookie to keep you signed in. It uses no advertising cookies. Any platform-affinity cookie used for routing is not used for tracking.
04 / 04
Personal data deleted within 30 days
After account deletion, personal data is deleted within 30 days, except where legal or financial compliance requires retention.
Your data
We don't sell, rent or trade it.
For visitor data CrowCode collects on your website, you are the data controller and Crow acts as your data processor. Crow is the controller for account, product usage and support information, as described in the Privacy Policy.
What CrowCode collects
- An anonymous visitor identifier
- Page URL and referrer
- Experiment and variant assignments
- Configured conversion events
- Privacy-bounded click and scroll coordinates
What it never collects
Optional behavioural diagnostics are consent-gated. CrowCode does not:
- Form values or page text in behavioural diagnostics
- Collect passwords or payment card details
- Build advertising profiles from CrowCode behaviour
Hosting and subprocessors
Ask our team for current provider and data-location details.
Crow's application is hosted on Replit infrastructure. CrowCode visitor event data is sent to Crow servers and stored against the relevant account.
For provider and location details, contact our support team.
For procurement
Data Processing Agreement
Need a DPA for your procurement team? Covers the Australian Privacy Principles and GDPR, including Standard Contractual Clauses where needed. Send us your work email and we'll be in touch.
Security reporting
Found a vulnerability?
Send Crow support a concise description and a way to reach you. Please do not include passwords, live credentials or other sensitive personal information.
Good questions to ask
Quick answers to what agencies and IT teams usually ask.
Can Crow sign a data processing agreement?
Yes. Request one using the form above and we'll work through your requirements with you.
Where is data stored?
CrowCode visitor events are sent to Crow servers and stored against your account. Crow's application is hosted on Replit infrastructure. Contact support for current provider and data-location details.
Who is the controller for CrowCode visitor data?
For visitor data collected by CrowCode on your website, you remain the data controller and Crow acts as the data processor. Crow is the controller for account, product usage and support information described in our Privacy Policy.
Does Crow collect information from every form field for diagnostics?
No. Optional behavioural diagnostics require the diagnostic consent setting and do not capture form values or page text. See the Privacy Policy for the data CrowCode collects and how it is used.
Does Crow store UTM parameters and click IDs?
Only when you switch on hidden fields for a form. The values are saved with each lead so you can see which campaigns drive enquiries, and you can export or delete them at any time.
What is the difference between cancelling and deleting my account?
Cancelling a subscription is not the same as requesting account deletion. If you want your account data deleted, make a separate deletion request through the account controls or support. After account deletion, account personal data is deleted within 30 days except where legal or financial compliance requires retention; CrowCode event data is deleted within 30 days.
How do I report a security concern?
Email support@yourcrow.com with a concise description and a way for us to reply. Please do not include passwords, live credentials or other sensitive personal information.