Privacy Policy
What we collect
Only what the product needs in order to run. This is the whole list.
- Account information
- Your name, email address, and profile image. If you sign in with Google or GitHub we receive these from that provider and never see your password there. If you sign up with an email and password, we store the password only as a salted hash.
- Workspace content
- The files you upload, along with their paths and sizes. This is your data, and serving it back to your agents is the reason the service exists.
- Credentials
- API keys and access tokens, stored hashed. We keep a short display prefix and a last-used timestamp so you can tell credentials apart in the console. We cannot recover the secret itself.
- Read activity
- Every read your agents perform is written to an append-only audit log: the workspace, which credential acted, which tool ran (ls, find, cat, or grep), a summary of the path or pattern, how many results came back, the latency, and the timestamp. The audit log never stores file contents.
- Technical data
- Sign-in sessions record an IP address and a user agent. We use request IP addresses to apply rate limits and to throttle repeated failed sign-in attempts.
- Billing data
- If you subscribe to a paid plan, Stripe processes the payment. We store your Stripe customer id and your subscription status. We never see or store your card number.
How we use it
- To run the service: authenticate you, serve your files to your agents, and enforce your plan quotas and rate limits.
- To show you what happened: the Logs and Usage pages in the console are built from the audit log.
- To keep the service available and safe: detect abuse, stop runaway usage, and debug failures.
- To bill you, if you are on a paid plan.
- To contact you about the service: security notices, material changes to these policies, and replies to support you asked for.
That is the complete list of purposes. We do not use your data for anything else.
What we never do
- We do not train AI models on your files, and we do not let anyone else train on them.
- We do not sell your personal information, and we do not share it with advertisers or data brokers.
- We do not read your file contents. Serving them is automated. Someone at Grepticon looks at your content only if you explicitly ask us to, for example while we debug a support ticket you opened.
- We do not send you marketing email you did not ask for.
Who we share it with
A short list of vendors process data on our behalf, each under contract and only so the service can run:
- Railway
- Application hosting and the primary Postgres database.
- Cloudflare R2
- Object storage for the contents of the files you upload.
- Vercel
- Hosting for this site, the console, and the documentation, plus cookieless analytics.
- Stripe
- Payment processing for paid plans.
- Google and GitHub
- OAuth sign-in, and only if you choose to sign in that way.
Beyond those, we disclose data only when the law requires it, and where we are legally permitted to tell you first, we will. If Grepticon is ever acquired or merged, your data may transfer as part of that transaction; this policy continues to apply until we replace it, and we will give you notice before it changes.
Where your data lives
In the United States. Our application servers and database run in Railway's us-west2 region, and file contents sit in Cloudflare R2. If you use Grepticon from outside the United States, your data is transferred to and processed in the United States.
How long we keep it
- Workspace files
- Until you delete the workspace or ask us to close your account. Deleting a workspace removes its file records immediately and tags the stored contents for deletion, which our storage provider then purges on its lifecycle schedule.
- Read activity
- The audit log is append-only, which is what makes it worth trusting. Entries outlive the workspace they describe so the history cannot be quietly rewritten. If you want yours purged, ask us and we will purge it.
- Account records
- Until you ask us to close your account. There is no self-serve account deletion yet: email support@grepticon.com and we will do it, normally within a few days.
- Backups
- Our database provider takes automatic backups. Deleted data can persist inside a backup for a short window before it rolls off.
How we keep it safe
- Every workspace is isolated inside the database by row-level security, so a credential scoped to one workspace structurally cannot read another.
- Data is encrypted in transit with TLS, and encrypted at rest by our hosting and storage providers.
- API keys and access tokens are stored hashed, never in plain text. Access tokens can be scoped to a subtree of a single workspace, expire on their own, and can be revoked at any time.
- The agent-facing API is read-only. The four tools your agents call cannot modify or delete anything.
- We are a small team and we do not hold a SOC 2 report today. If your organization needs one, tell us and we will be straight with you about where we are.
Cookies and analytics
The console sets one essential cookie, the one that keeps you signed in. There are no advertising cookies and no third-party trackers anywhere on our sites. Our analytics come from Vercel Analytics, which is cookieless and does not follow you across other sites.
Your rights and choices
From the console you can, at any time, delete a workspace and everything in it, and revoke an API key or an access token. You can export your audit log through the API.
Depending on where you live, for example the European Economic Area, the United Kingdom, or California, you may also have the right to access, correct, delete, or port your personal information, and to object to how we process it. Email support@grepticon.com and we will respond within 30 days, free of charge. We will not treat you differently for exercising a right, and because we do not sell personal information there is no sale for you to opt out of.
Children
Grepticon is a developer tool and is not directed at anyone under 16. We do not knowingly collect personal information from children. If you believe a child has given us data, email us and we will delete it.
Changes to this policy
When we change this policy we update the date at the top. If a change materially affects how we handle your data, we will email account holders before it takes effect. Continuing to use Grepticon after that date means you accept the updated policy.
Contact us
Email support@grepticon.com with any privacy question, including a request to access, export, or delete your data. Grepticon is the controller of the personal information described on this page.