Privacy Policy
Version 2026-10-11 · Effective October 11, 2026
What we collect and why
| Information | Purpose | Kept |
|---|---|---|
| Email, name, profile picture (when supplied), sign-in method | Identify your account and sign you in | Until you delete the account |
| Display name, appearance preferences | Show the app the way you set it | Until you delete the account |
| Sessions and desktop devices (hashed credentials, browser type, IP address) | Keep you signed in, let you sign out other devices, protect the service | Until the session ends or is revoked, at most 30 days |
| Agreed document versions and the time of agreement | Show which terms you accepted | Until you delete the account |
| Documents you save to a vault and the Google Drive accounts you connect | Provide storage, sharing, and Drive access | Until you delete them or the account |
Date of birth
At sign-up we ask for your date of birth only to confirm that you are at least 14. We do not store it; we keep only the fact that the check passed and when. If you are under 14, the account and everything entered for it are deleted at once and we do not collect anything further.
Stored only in your browser
The web app keeps some things in your own browser and never sends them to us: display settings and language, panel layout, the titles of the last 8 documents you opened, and, if you choose a folder on your device, the browser’s permission to open it again. Clearing the site’s data in your browser removes them. Signed-in sessions use one sign-in cookie, plus a short-lived cookie during sign-in.
What we do not do
We do not use analytics, advertising trackers, or session-recording tools, and we do not record keystrokes, mouse movement, or screen content. Fonts and scripts are served from our own servers. We do not sell personal information or share it for advertising.
We send sign-in codes and security notices from noreply@thegram.one. We do not send marketing email unless you ask for it; if we ever do, each message will include a one-click unsubscribe link and our postal address, and unsubscribing takes effect within 10 days.
Google Drive
Google Drive is a separate connection from your sign-in. Each connected account uses Google’s drive.file scope and has its own encrypted refresh token, which you can disconnect at any time. Our use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Processors and backups
Sign-in code emails are delivered through Resend, Inc. (United States), which receives your email address and the message to send it; we do not use it for anything else. Encrypted backups of vault data are kept in the operator’s Google Drive for up to 14 days; only we hold the key. Google and Apple process your information under their own policies when you sign in with them or connect Drive.
Your rights
You can view and change your profile, sign out sessions and devices, disconnect Drive accounts, and delete your account in Settings. You can also ask us to show, correct, delete, or stop processing your information at support@thegram.one; we answer within 10 days.
Changes
We post a new version before it takes effect and ask you to agree again when you next sign in.