Privacy Policy

This policy describes how Granrojo handles personal information when you browse the service, use an account, create projects, or participate in the community. It also covers our AI, build, and publishing features.

For privacy questions or requests, contact the Granrojo team at contact@granrojo.com. Our Terms of Service explain the rules for using the service.

Account information: your name, email address, mobile number, verification status, profile image, bio, and preferences, where provided. Sign-in services such as Google, GitHub, or WeChat supply identifiers and profile details when you choose to use them. Authentication records may include password hashes, provider tokens, sessions, IP addresses, and browser information.

Content you provide: project source files and revision history, notes, wiring diagrams, uploaded files, project descriptions, AI conversations and attachments, forum posts, comments, likes, and favorites. We also receive information you send when contacting us.

Service activity: requested pages, account and project actions, build results, AI usage, timestamps, and diagnostic or security logs. Some records are associated with your account or project identifier. When you use voice input, your audio is processed to produce a transcription.

Google sign-in is optional. If you choose it, Granrojo requests only the OpenID Connect sign-in permissions (openid, email, and profile). Google provides your account identifier, name, email address, email verification status, and profile picture, where available. We do not request access to Gmail messages, Google Drive files, Calendar events, or contacts.

We use these details to create or link your Granrojo account, authenticate you, and display your profile. Your name and profile picture may appear on your public profile and alongside projects or community contributions. Account details and connected-account records, including provider tokens supplied during sign-in, are stored in our authentication database with access controls. Hosting and database providers process these records to operate the service; PostHog also receives your signup email and account identifier as described below.

Google sign-in does not give our AI tools access to your Google account or its contents. We do not use information obtained through Google sign-in to train AI models, target advertising, or sell personal information. The separate project content you choose to submit to AI features is handled as described below.

Our handling of Google user data follows the Google API Services User Data Policy, including its Limited Use requirements.

You can revoke Granrojo’s Google access in your Google Account connections. Revocation stops future access through that authorization; it does not automatically delete your Granrojo account or previously stored data. We retain account and sign-in records while needed to provide your account and for the purposes in Storage and retention below. To request deletion of your account or stored Google data, email contact@granrojo.com.

We use information to create and secure accounts, verify sign-in details, save and restore projects, process AI requests, compile code, publish the revision you select, and provide community features. We also use it to respond to requests, prevent abuse, diagnose errors, understand usage, and improve the service.

Where applicable data protection law requires a legal basis, these purposes may rely on providing the service you request, our legitimate interests in operating and protecting it, compliance with legal obligations, or your consent for optional features. You can withdraw consent for optional browser analytics through the controls below.

New projects start unpublished. Publishing makes the selected project revision, its source and associated published content, and linked public profile details available to others. Later unpublished edits are separate from that published revision. Public projects may be viewed, downloaded, or forked by other users.

Profiles and community contributions are public. General uploads, including avatars and files attached through notes or community editors, may be accessible to anyone with their file URL, even when a project is unpublished. App source assets use separate access controls. Avoid uploading confidential information to a public file URL.

Unpublishing or deleting content does not remove copies, forks, downloads, or search caches held by others. Project pages can run code or contact external services chosen by their authors; those authors and services are responsible for their own data practices.

AI requests can include your prompt, conversation history, attachments, relevant project files, notes, diagrams, and tool results. Cursor and the model services used through Cursor process this information to answer your request. Optional cloud execution sends a task prompt to a separate Cursor-hosted agent. Provider processing and retention are also subject to that provider’s terms; we do not promise that every provider has the same retention or training policy.

Voice input sends audio to the configured transcription service, such as Alibaba Cloud speech recognition or OpenAI transcription. Transcribed text becomes part of your prompt when you submit it.

Build services process source code and build configuration and may retain logs and artifacts. Browser hardware access requires the relevant browser or connection permission. Device output that you include in chat or tool results may be sent to the server and AI provider. Do not include passwords, private keys, or sensitive personal information in prompts, project files, or device logs.

We use service providers for hosting, databases, object storage, builds, authentication, email and SMS delivery, AI and transcription, and analytics. They receive the information needed for those functions. Current integrations include Alibaba Cloud storage and services and PostHog analytics; the providers used depend on the deployment and features you select.

PostHog receives optional browser analytics when enabled, and server-side account and product usage events. Server events can include account and project identifiers, signup email, AI chat activity, and build outcomes. The browser cookie choice does not disable these server-side events or operational and security records.

We may disclose information when required by law, to respond to valid legal requests, or to protect users and the service against fraud, abuse, or security threats. If the service is transferred or reorganized, information may be transferred with it subject to applicable law. We do not sell personal information.

Essential cookies and browser storage support sign-in, security, language, theme, editor preferences, and unsent drafts. Blocking or clearing them may sign you out or remove locally saved preferences and drafts.

Optional browser analytics are off until you accept them. Accept all enables PostHog browser analytics; Reject all leaves them off. You can change your choice at any time, and rejecting does not prevent you from using the service. Your choice applies to this browser; other browsers and devices have their own choices.

If your browser sends Global Privacy Control, that signal is treated as a decline. You can still accept browser analytics for this site; that acceptance applies while the signal stays on. If we change what those analytics cover, the previous choice expires and we ask again before collecting them.

Cookie preferences

Information is stored in our databases, project revision storage, object storage, and the systems of the providers used for a feature. Processing may occur outside your country, depending on the deployment and provider. Contact us for details about the locations and arrangements that apply to your account.

Retention depends on the type of record and why it is needed: maintaining your account and saved work, supporting revision history and recovery, investigating abuse, resolving disputes, and meeting legal obligations. Removing content from the interface does not necessarily erase revision history, uploaded objects, build artifacts, logs, or backups. Provider retention may differ.

For an account deletion or data erasure request, email contact@granrojo.com. We may need to verify your identity and explain any information that must be retained. Do not treat a project delete or unpublish action as a request to erase all associated personal information.

You can edit your profile in profile settings, manage project content, and choose which revisions to publish. Contact us to request access, correction, a copy or export, or deletion of personal information.

Depending on your location, you may also have rights to object to or restrict processing, withdraw consent, and complain to your local data protection authority. Rights and exceptions depend on applicable law. We may request information to verify that a request concerns your own account.

We use access controls and authentication to protect account and unpublished project data. No storage or transmission method is completely secure. Keep account credentials private and contact us if you suspect unauthorized access or a disclosure of personal information.

You must meet the age and parental-permission requirements that apply where you live. If you believe a child has provided personal information without the permission required by law, contact us so we can investigate and address it.

We may update this policy as the service or its data practices change. The date above identifies the latest revision. We will provide additional notice or request consent where required by applicable law.

Send privacy questions and requests to contact@granrojo.com.