Privacy policy
Last updated: October 4, 2026
Granite is operated by [company legal name], [registered address] ("Granite", "we"). This policy explains what we collect when you use granite.md, the Granite apps, and the API, and what you can do about it. For workspaces, the workspace's organization decides what goes into it; for that content we act as its processor under our data processing agreement.
What we collect
- Account: your email address, name, password hash, and two-step verification settings.
- Your content: notes, attachments, comments, and their history, stored encrypted (see Security).
- Devices and sessions: device names and platforms, IP addresses and browser user agents for sign-ins, kept to protect your account.
- Billing: your plan and payment status. Card details are handled by our payment providers and never reach us.
- Usage needed to run the service: logs of requests (without note content), storage used, and errors.
We do not sell your data, show ads, or use your content to train AI models. The website uses no cookies or trackers; the app uses one cookie to keep you signed in.
Why we use it
- To provide the service you signed up for (contract).
- To keep accounts and the service secure, and to prevent abuse (legitimate interest).
- To send emails you need: confirmations, password resets, security alerts, and mentions you can turn off (contract, legitimate interest).
- To meet legal obligations, such as tax records for payments.
Who processes it
Our service providers are listed on the sub-processors page. When you connect an AI tool or another app, it receives only what you allow, under its own terms.
How long we keep it
- Your content stays until you delete it. Deleted vaults stay in the trash for 30 days; then they are purged.
- When you delete your account, it and your personal vaults are deleted within the hour. Encrypted backups are kept for 35 days and then expire.
- Security logs are kept for up to 12 months; workspace audit logs as the workspace's plan provides.
Your rights
You can access, correct, export, and delete your data at any time from the app (Settings → Your data), or ask us at privacy@granite.md. Depending on where you live, you may also object to or restrict some processing and complain to your data protection authority. We answer requests within 30 days.
International transfers
Your data is stored on our server in [server location] and backed up in the United States. Transfers outside the European Economic Area rely on the European Commission's standard contractual clauses.
Changes
We will tell you by email or in the app before material changes take effect.
Contact
[Company legal name], [registered address]. privacy@granite.md