Accounts and billing
Security and trust
Sign-in
People sign in with Google, Microsoft, or a one-time code sent to their email. Sign-in happens on crow-nest.com; each app address gets its own short-lived session through a one-time handoff, so apps never see passwords or long-lived tokens. Sessions are signed cookies scoped to one app's address.
Access to apps
Every request to an app, its files, its data and its server code is checked against the app's visibility and the viewer's identity before anything is returned. Rules for data and files are enforced on the server, never in the browser. Changes to who can see an app reach every viewer within 60 seconds.
Keys and secrets
- API secrets and AI keys are encrypted at rest (AES-256-GCM, a separate key per app) and are never sent to the browser or shown again after they're saved.
- Secrets are typed into private prompts, never through an AI conversation.
- Publishing refuses app files that contain API keys or tokens.
- In server code logs, any value of the app's secrets is replaced with
[secret].
Server code isolation
Each app's server code runs in its own isolated Worker on Cloudflare, with CPU and request limits per call. It can only reach its own app's data: SQL runs in a database that belongs to that app alone, and calls back into Crow Nest carry a token tied to the one app. Its outside requests can't reach Crow Nest's own addresses, IP addresses or internal names. Headers starting with x-crow- are removed from every outside request, so a caller can't pretend to be signed in, a schedule or a task.
Uploads
HTML and SVG uploads are always served as downloads, never as pages, so an upload can't run code on an app's address.
Payments
Cards are handled by Stripe. Crow Nest never sees or stores card numbers; it keeps only whether a card is on file. Plans change only when Stripe's signed webhooks confirm them.
Some emails are always sent, because they keep your account safe or your apps running: sign-in codes, account changes, invitations, and billing emails about a card to add or a payment that failed. You can turn off the rest (access requests, usage, domain reminders, organization changes, and notices about your apps) in Settings, Email in the dashboard. Each of those emails also has an unsubscribe link that turns off just that kind with one click.
Abuse and reports
Anyone can publish public pages on a crow-nest.com address, so Crow Nest watches for abuse:
- Public apps carry a small "Made with Crow Nest" badge with a Report link.
- Reports (phishing, malware, illegal content, abuse) go to Crow Nest staff straight away.
- Names that imitate well-known brands are refused, for app addresses and custom domains.
- Staff can suspend an app or an account. A suspended app answers 451 and its server code and schedules stop.
To report something, use the Report link on the app, or email support@crow-nest.com.
Your data
You can export an app's data from the dashboard at any time. Deleting an app or your account stops it working right away; Crow Nest keeps the data for 30 days in case you change your mind, then deletes it. Domains you bought stay yours.