# agent-cronjob — Terms of Service

Version: 2026-11-03 · Effective: 2026-11-03 · Operator: agentasy.ai · Contact: hello@agentasy.ai

## English (authoritative for agents)

1. **What this is.** agent-cronjob (cronjob.agentasy.ai, new-cronjob.agentasy.ai) sends signed HTTP POST
   triggers to a webhook you control, on a cron / interval / one-off schedule. No accounts: a job is owned
   by whoever holds its management token. Default time zone is UTC.
2. **Beta, best effort, no SLA.** The service is in public beta and runs on a single host. That host can be
   paused or restarted without notice; triggers may be late, missed (handled by your `catchup_policy`),
   or delivered more than once. Always de-duplicate on `delivery_id`. Do not use it for anything
   safety-critical or where a missed or duplicate trigger causes harm. We may change or end the service.
3. **Acceptable use.** You must:
   - register only webhook URLs you control (ownership is proven by the challenge; never point jobs at
     third-party URLs);
   - stay within the published limits (see /pricing) and not try to get around them
     (e.g. many IPs or hosts to multiply quotas);
   - not use the service to attack, flood, scan, or spam any system, or to send unlawful content in `payload`.
   We may rate-limit, pause, disable, or delete any job, and block IPs or webhook hosts, without notice when
   we believe these terms are broken or the service is at risk. Jobs are disabled automatically after 20
   consecutive finally-failed runs.
4. **Data we store.**
   - Job settings: webhook URL (encrypted at rest, AES-256-GCM, never shown back), its host name in plain
     text, schedule, name, payload (≤ 8 KB).
   - Credentials: HMAC secret (encrypted); management and setup tokens are stored only as hashes.
   - Run and delivery log: scheduled/sent times, delay, HTTP status, error, and up to 1 KB of your
     webhook's response body.
   - Retention: run/delivery detail older than 30 days is reduced to daily aggregate counts and deleted;
     deleted jobs are purged 30 days after deletion. Unverified jobs are deleted after 15 minutes, and
     verified jobs whose credentials are not collected within 15 minutes are deleted. Database backups
     are kept up to 30 days.
   - We do not sell this data.
4a. **Privacy.**
   - No accounts, cookies, analytics scripts or trackers.
   - Your IP address is used in memory only, for rate limiting; it is not written to the database or
     to our service logs. Our request logs record method, path (job ids collapsed), status code, time
     and a coarse user-agent class (e.g. browser, AI crawler name) — not the raw user-agent string and
     not your IP. These logs rotate by size (at most ~60 MB kept) and are not shared.
   - Cloudflare, Inc. acts as our network provider and processor: all traffic passes through Cloudflare,
     which processes IP addresses, user-agents and request metadata under its own privacy policy
     (https://www.cloudflare.com/privacypolicy/). We see only aggregate analytics from Cloudflare.
   - Data deletion: delete your job via the API (`DELETE /v1/jobs/{id}`), or email us; detail is purged
     per the retention rules above.
5. **Your security responsibilities.** The HMAC secret and management token are shown once. Keep them
   secret, rotate them if exposed, and verify the `X-Cronjob-Signature` on every trigger. Anyone with
   the management token can control the job. We cannot recover lost credentials.
6. **No warranty; limitation of liability.** The service is provided "as is" and "as available", free of
   charge, without warranties of any kind. To the maximum extent permitted by law, the operator is not
   liable for any indirect or consequential damages, or for loss caused by late, missed, duplicate, or
   failed triggers, data loss, or suspension. In any case the operator's total liability for all claims
   relating to the service is limited to USD 100.
7. **Changes.** We may update these terms; the version and date at the top change, and material changes
   are announced on cronjob.agentasy.ai at least 14 days before they take effect. Continued use means acceptance.
8. **Governing law.** These terms are governed by the laws of the Republic of China (Taiwan). The Taiwan
   Taipei District Court has jurisdiction as the court of first instance.
9. **Contact.** hello@agentasy.ai (abuse reports, questions, privacy and data deletion requests).

---

## 繁體中文（台灣）

1. **服務內容：** agent-cronjob 依 cron／固定間隔／單次排程，對你掌控的 webhook 送出有簽章的 HTTP POST 觸發。沒有帳號；持有管理 token 的人就是 job 擁有者。預設時區 UTC。
2. **測試版、盡力而為、無 SLA：** 服務在公開測試階段，跑在單一主機上，主機可能未經通知暫停或重啟；觸發可能延遲、漏跑（依你設定的 `catchup_policy` 補跑）或重複送達，請一律以 `delivery_id` 去重。請勿用於攸關安全、或漏送／重送會造成損害的用途。我們可能變更或終止服務。
3. **使用規範：** 只能登記你自己掌控的 webhook URL（以 challenge 證明，不得指向第三方網址）；遵守公布的限制、不得規避（例如用多個 IP 或主機放大額度）；不得用來攻擊、灌流量、掃描、濫發或傳送違法內容。我們認為違反條款或危及服務時，可不經通知限速、暫停、停用或刪除 job，並封鎖 IP 或 webhook 主機。連續 20 次最終失敗的 job 會被自動停用。
4. **儲存的資料：** webhook URL（AES-256-GCM 加密、不回顯）及其主機名稱（明文）、排程、名稱、payload（≤ 8 KB）；HMAC 密鑰加密保存，管理／setup token 只存雜湊；執行紀錄含排程與送出時間、延遲、HTTP 狀態碼、錯誤及回應內容前 1 KB。超過 30 天的明細只保留每日彙總後刪除；已刪除的 job 30 天後清除；15 分鐘內未驗證、或驗證後 15 分鐘內未領取憑證的 job 會被刪除；資料庫備份最多保留 30 天。我們不販售資料。
4a. **隱私：** 不需帳號，不使用 cookie、分析腳本或追蹤器。你的 IP 只在記憶體中用於限速，不寫入資料庫或服務日誌。服務日誌只記錄方法、路徑（job id 已遮蔽）、狀態碼、時間及粗略的 user-agent 類別（例如瀏覽器、AI 爬蟲名稱），不記錄原始 user-agent 或 IP；日誌依大小輪替（最多約 60 MB）且不對外提供。Cloudflare, Inc. 為我們的網路服務商與資料處理者，所有流量都經過 Cloudflare，其依自身隱私政策（https://www.cloudflare.com/privacypolicy/）處理 IP、user-agent 等請求資料；我們只看得到彙總統計。刪除資料：可透過 API（`DELETE /v1/jobs/{id}`）刪除 job，或來信；明細依上述保留規則清除。
5. **你的安全責任：** HMAC 密鑰與管理 token 只顯示一次，請妥善保管、外洩時輪替，並驗證每次觸發的 `X-Cronjob-Signature`。持有管理 token 者即可控制 job；遺失無法找回。
6. **不提供保證、責任限制：** 本服務免費、依「現狀」提供，不作任何保證。在法律允許的最大範圍內，營運者不對間接或衍生損害，或因觸發延遲、漏送、重送、失敗、資料遺失或停權造成的損失負責。無論如何，營運者就本服務相關之所有請求，賠償總額以 100 美元為上限。
7. **條款變更：** 我們可能更新條款，頂端版本與日期會隨之變更，重大變更會在 cronjob.agentasy.ai 至少於生效前 14 天公告。繼續使用即視為同意。
8. **準據法與管轄：** 本條款以中華民國法律為準據法，並以臺灣臺北地方法院為第一審管轄法院。
9. **聯絡：** hello@agentasy.ai（濫用檢舉、問題、隱私與資料刪除請求）。