Terms of service

Effective 23 October 2026. Operated by Georgi Kalchev. Contact: abuse@402cron.com.

1. What we promise

We guarantee that we tried to deliver your task: that we made a real HTTP request to the destination you verified, at the time your schedule asked for. We do not promise what your server does with it, and we cannot — that is your code, not ours.

2. What you pay for

You pay per delivery attempt, not per outcome. A 2xx, a 4xx, a 5xx, a timeout and an unreachable host each consume one credit. A failure on our side consumes none, and a skipped execution consumes none. Credits are prepaid, counted in attempts rather than money, and do not expire. A change of tariff never re-prices credits you already hold.

3. When a task stops

A timeout or an unreachable host is retried at most three times per execution, then the task pauses. A 4xx or 5xx is never retried; twenty refusals or ten server errors in a row also pause the task. Pausing is protection, for your budget and for the server on the other end. Resuming is one call.

4. What you may schedule

Only destinations you control and have verified, and only over https://. We refuse plain http://, IP literals, internal names, non-standard ports, credentials in the URL, our own infrastructure, and any path that hides a dot segment.

That last one is narrower than it sounds, and the difference is yours to keep: an encoded separator is not refused on its own — a plain %2F inside a segment is kept and matched as it stands, so a GitLab-style project path keeps working. What we refuse is a path where .. or . appears once you decode it (we try up to twice), drop a ; parameter from a segment, or strip control characters. So /hook/..%2Fadmin is refused and /api/v4/projects/group%2Fproject/trigger is not — do not hand us a decoded URL to satisfy a rule we do not have. The refusal carries reason encoded-separator; the name is older than the rule.

The permission you verified covers that path and everything beneath it — nothing above it. If you use the service to reach an endpoint that is not yours, we suspend the account without refund of the attempts already spent.

5. If the service stops

If we shut the service down, we announce it on 402cron.com at least 30 days in advance, and we return the unused balance. Credits do not expire, but they are also not a claim on eternity: this paragraph is what stands behind the word “never”.

6. Limit of liability

Our total liability for any claim is capped at what you paid us for the credits in question. We are not liable for what your own systems do, or fail to do, after we deliver — including missed business outcomes.

7. What we store

Destination URLs, the wallet address that paid, and a log of delivery attempts (kept 90 days) plus daily usage counters (kept 400 days). We also store what you asked us to send: the request body and any headers you attached to the task. The signing secret for your destination and the headers you attach to a task are encrypted at rest; the request body is not — if something is a credential, put it in a header, not in the body. Encryption at rest is not encryption in transit: we call the address you registered, which is why we accept https:// destinations only.

When you attempt a payment, we also record the network address the attempt came from — an IPv4 address in full, an IPv6 address by its /64 prefix — and, when we can verify your signature ourselves, the paying wallet address next to it. That record is an hourly counter of payment attempts, used only to rate-limit them and to block abuse; it is kept for 7 days, then deleted. The address your other API calls come from is not recorded.

We do not sell any of it, and there is nothing to sell: we never see the content of your systems, only whether the request landed.

8. Changes

Changes are published on this page with a new effective date. Credits bought under earlier terms keep the price they were bought at.