Privacy policy

GREPHT (grepht.app) keeps a shared, living record of the tools and systems your team builds. This policy explains what information GREPHT collects, why, and what happens to it. “We” means the operator of GREPHT; you can reach us at grephtservices@gmail.com.

Three kinds of information, each for a different reason:

• Account information. Your name, email address and sign-in identity, handled by our authentication provider, Clerk. If you sign in with Google or GitHub, we receive your name, email and avatar from that provider — nothing else. GREPHT never sees or stores your password.
• Your workspace record. What you and your team deliberately put into GREPHT: descriptions of tools and automations, ownership, dependencies, notes, runbooks, heartbeat pings from systems you connect, and the questions you ask the product about your own record. This is the product — it exists so your team can read it.
• Billing and usage. Your plan and subscription state. Payments are processed by Stripe; card numbers go to Stripe directly and are never seen or stored by GREPHT. We also keep ordinary operational logs to run and secure the service.

To provide the service you signed up for, and for nothing else: keeping your workspace record, answering the questions you ask over it, monitoring the systems you connect, billing, support, and messages about your account. When GREPHT composes an answer or an analysis over your record, the relevant parts of that record are processed by our AI provider, Anthropic, under terms that do not permit your data to be used to train their models. We do not sell your information and we do not use it for advertising.

Only the service providers that make GREPHT run, each processing data on our instructions: Clerk (sign-in), Stripe (payments), Vercel (hosting), Neon (database), and Anthropic (AI processing). If you choose Google or GitHub sign-in, those providers are involved in exactly that sign-in and nothing more. We would disclose information if the law genuinely required it, and we would tell you unless we were legally prevented from doing so.

Your workspace record is kept for as long as your workspace exists — that permanence is the product’s point. If your subscription lapses, the record stays readable to you; GREPHT stops adding to it. If you ask us to delete your account or workspace, we remove it from our production systems within 30 days, and it ages out of backups after that.

Data is encrypted in transit, access is restricted to what operating the service requires, and sign-in is handled by a dedicated provider rather than passwords we store. No system is beyond failure; if a breach ever affects your data we will tell you promptly and plainly.

GREPHT uses cookies for one purpose: keeping you signed in. There are no advertising or cross-site tracking cookies.

You can ask us for a copy of your data, ask us to correct it, or ask us to delete it — email grephtservices@gmail.com and we will act on it. Depending on where you live these rights may also be backed by law (such as the GDPR or CCPA); we honor them regardless.

If this policy changes in a way that matters, we will say so on this page and update the date above. We will not quietly weaken it.