Privacy Policy: DRAFT FOR REVIEW
THIS IS A STARTING DRAFT, NOT FINAL LEGAL TEXT. It reflects how Grain currently appears to handle data, based on the app as built. It is not legal advice and was not written by a lawyer. Confirm every statement against what the software actually does before publishing, and have it reviewed before Grain takes payment. Fill in every [BRACKETED] item. Because Grain is being built by a minor, the legal operator below should be an adult (parent or guardian).1. What this covers
This policy explains what information Grain collects, how it is used, and the choices you have. [VERIFY every claim below against the actual implementation before publishing.]
2. Information we collect
Account information. When you sign up, we collect your email address and authentication information, handled through our authentication provider (Supabase).
Text you submit. When you use the rewrite tool, your text is sent to our processing provider (Anthropic) to generate the rewrite. [VERIFY retention:] For anonymous demo use, submitted text is not stored after the rewrite is returned. For signed-in users, rewrites (input and output) are saved to your history so you can see and manage them, up to the per-plan limit, and you can delete them at any time.
Usage information. We record limited usage metadata, such as word counts and timestamps, to enforce plan limits and protect against abuse. For rate-limiting we store a hashed value derived from your IP address, not the raw IP address itself.
Analytics. We use privacy-respecting analytics (Vercel Analytics) that record page views and basic events. [VERIFY:] These analytics do not receive the content of your text.
3. How we use information
- To provide the rewrite service and your account.
- To enforce plan limits and prevent abuse.
- To save and display your rewrite history (signed-in users).
- To communicate with you about your account (for example, a welcome email or a
password reset), where email is configured.
- To understand aggregate usage and improve the service.
We do not sell your personal information. We do not use the content of your submitted text to train our own models. [VERIFY this statement is accurate before publishing.]
4. Third parties who process data for us
- Supabase: authentication and database.
- Anthropic: AI processing of the text you submit for rewriting.
- Vercel: hosting and analytics.
- Resend: email delivery, where configured.
[VERIFY this list is complete and current. Link each provider's own privacy terms if appropriate.]
5. Data retention
[VERIFY and complete:] Account data is kept while your account is active. Signed-in rewrite history is kept up to the per-plan limit and can be deleted by you. Anonymous demo text is not stored after processing. Abuse-prevention records (hashed keys and counts) are kept for a short window and then pruned.
6. Your choices and rights
- You can delete individual rewrites from your history.
- You can request deletion of your account and associated data by contacting
[SUPPORT EMAIL].
- [REVIEW: UAE data-protection law (the PDPL) may grant specific rights such as
access, correction, and deletion. Confirm the applicable rights and how to honor them.]
7. Children's privacy
[REVIEW CAREFULLY:] Grain is not directed to children under 18. If Grain may be used by minors, assess what protections and disclosures are required, including any parental-consent obligations. The operator should resolve this before broad launch.
8. Security
We take reasonable measures to protect your information, including hashing IP-derived identifiers and restricting server-side database access. No method of transmission or storage is completely secure.
9. Changes to this policy
We may update this policy. Material changes will be reflected by updating the "last updated" date and, where appropriate, by notice in the app.
10. Contact
Questions about privacy: [SUPPORT EMAIL]
Draft prepared from the app as built. Verify every claim against actual behavior. Not legal advice. Requires review before Grain accepts payment.