Read-only by design

Cronwake watches your GitHub Actions crons from the outside. It is a read-only GitHub App: it can look, but it cannot touch your code, your workflows, or your settings. This page lists exactly what it can access, what it stores, and who processes your data, so your security review can be quick. Like any external monitor, it is a best-effort watchdog, not a guarantee of detection: see our Terms of Service.

Exact GitHub permissions requested

Every permission is read-only. There is not a single write scope. GitHub shows this same list on the install screen before you approve.

Permission	Access	Why we need it
Repository metadata	Read-only	Mandatory baseline for any GitHub App. Lets us list which repositories the install covers.
Actions	Read-only	List your workflows, read their scheduled-run history, and read each workflow's current on/off state so we can flag one that was silently disabled.
Contents	Read-only	Read your workflow files (.github/workflows/*.yml) to parse their cron: schedules. This is the only file content we look at; your source code is never copied or stored.

What Cronwake cannot do

Push, edit, or delete any code
Create, edit, disable, trigger, or cancel any workflow or run
Read repository secrets or environment variables
Change repository, org, or account settings
Open issues or pull requests, or comment anywhere

Install on selected repositories

You choose the scope, not us

On GitHub’s install screen you can pick Only select repositories instead of All repositories. Start with a single test repo if you like. You can change the selection at any time from your org’s Settings → GitHub Apps, and Cronwake only ever sees the repos you grant.

What we store, and where

Stored (metadata only)

Which orgs and repositories have the App installed (account login, repository full names)
Per scheduled workflow: its name, file path, cron expression(s), timezone, and current state
Observed run history: run id, start time, conclusion (success/failure), duration, and the GitHub link to that run
Your alert routing per org (the alert destinations you enter yourself, e.g. a Slack or webhook URL, or an on-call / chat integration)

Never stored

Your repository source code
Secrets, tokens, or environment variables
Workflow run logs (we link to them on GitHub, we never copy them)

At rest: data lives in Neon (managed Postgres), encrypted at rest. Your GitHub access token is held only in an encrypted, httpOnly session cookie, never exposed to the browser.

Retention: uninstalling the App revokes its access instantly (GitHub invalidates the token). Stored monitoring metadata is then deactivated; ask us and we purge it in full.

Subprocessors

Provider	Role	Notes
Vercel	Application hosting	Runs the dashboard and the serverless functions. US-based.
Neon	Managed Postgres database	Stores the metadata listed above, encrypted at rest.

Alerts are delivered to the destinations you configure yourself (Slack, a webhook, or an on-call / chat integration); those endpoints are your choice, not a subprocessor we impose.

Ready when your review is

Install on a single repository first, watch it, then widen the scope when you are comfortable.

Install on GitHub Back to home