Privacy
Last updated November 9, 2026. GRAPNEL runs the tools on grapnelhq.com. Questions or requests: grapnel.team@gmail.com.
The short version
- Most of our tools work on your own device. Files you drop, photos you take and things you film are not uploaded to us.
- We keep a count of visits so we know which tools are used. It has no name, email or address in it.
- When you type something into a form (a request, a sign-up, a Rally bar), we keep what you typed.
- No ads, no ad trackers, no session recording, no cookies. We do not sell or share your information.
- What you drop or film in a tool is never sent to an AI service. The one exception is the job you describe in "Tell us": our research team, which runs on AI, reads it (never your email). Nothing is used to train AI.
What we collect
Visit counts. On each page your browser keeps a random code (stored as "bv_vid"), and our database records that code with the page, what happened (a visit, a button pressed) and the link tag that brought you there (for example ?src=tiktok). It does not record your name, email or network address. If your browser sends Global Privacy Control or Do Not Track, we do not record visits at all (joining a Rally bar is still saved, because you asked for it).
If we write to you first. Sometimes we email a business about one of our tools. We find that address from open sources: the business's own pages, public records and listings. We keep the name, the business address we wrote to, what we sent and what you wrote back. Reply with the word "no" and we stop and keep only your address on a do-not-write list, so we never write again. We never buy lists and never use personal mailboxes.
What you type into a form.
- "Tell us" on the home page: the job you describe and, if you give it, your email. Our research team reads the job you describe to decide what to build next (see AI below).
- Sign-ups on a tool page: your email and any note.
- Rally: a bar's name, what it releases, its goal, its link and its look (name, color and a logo: either a web address or a small image you upload, shrunk and stored with the bar). Fans who join give an email if they choose, and the maker of that bar can see and save it so they can send what they promised; after that, the maker's own privacy rules apply. A join also saves your browser's random code and the link tag. To stop one person joining many times or making many bars, Rally turns the network address of each join and each new bar into a scrambled code (a hash) and stores only that code, never the address.
Things that stay on your device. Keepsake (your sales export), Uncheck (your item list), Reclaim (your scale export), Declare (your ingredients and label sheet), Vigil (the photo of your alarm label) and Exhibit (the customer's clip and PDF) do their work inside your browser. We never receive those files. In Exhibit, the customer sends the clip and PDF straight to the shop by their own email or share button. Some tools remember your last choice in your browser (Declare's label sheet, your state in Uncheck, your height in Reclaim, your alarms in Vigil, the bars you made or joined in Rally); clearing your browser's site data removes them.
The Exhibit claim link. The link a shop makes in Exhibit carries the shop's name and email, the order number and the item in its web address, so our host (Vercel) receives them when the customer opens the link. Our database does not store them.
Why we use it
To run the tools, to answer you, to count which tools help people and to stop abuse. We do not use it for advertising.
Who handles it for us
- Vercel hosts the site. Like any web host, its servers see your network address to deliver pages.
- Supabase stores the visit counts and what you type into forms. Access is locked: a page can add a row and read a public Rally bar's details, but cannot read anyone's emails or entries.
- DigitalOcean hosts our own server. It keeps an encrypted backup copy of what Supabase stores, so your entries are not lost if the database fails.
- Google (Gmail) carries our email if you write to us.
- Anthropic (Claude) runs our research team. It reads the job text sent through "Tell us", without your email.
- jsDelivr (cdn.jsdelivr.net): only when you tap "Read the label with the camera" in Vigil, your browser downloads the open text-reading library Tesseract (its code, its engine and its English language file) from jsDelivr. Your photo is not sent; it is read on your device.
- A Rally maker's logo loads from the web address the maker gave, so that address's owner sees the request.
- Rally makers see the emails of fans who joined their bar with an email.
Links to outside sources (government pages, news) take you to sites with their own privacy rules.
AI
The tools do not send what you type, drop or film to any AI service, and there are no chatbots on this site. Vigil's text reading runs on your device. We use AI (Anthropic's Claude) to research, write and build GRAPNEL. The only visitor text it sees is the job you describe in "Tell us", which our research team reads without your email; please do not put personal details in it. We do not use your information to train AI.
How long we keep it
| What | How long |
|---|---|
| Visit counts | 13 months, then deleted |
| Emails from "Tell us" and sign-ups | 12 months, then deleted |
| Emails we sent to a business first, and the answers | 12 months, then deleted |
| The do-not-write list (address only) | Kept, so we never write to you again |
| Rally join emails | 90 days after the bar opens, or 12 months after joining, whichever is first |
| Rally's scrambled network codes (joins and new bars) | 90 days |
| Rally maker emails (older bars only) | 12 months |
| What you wrote in a request or note, and Rally bars | Until you ask us to delete it |
| Encrypted backup copies of the above | 7 days, then deleted |
A job runs every night to delete what has passed its time.
Your choices
Write to grapnel.team@gmail.com to see, correct or delete what we hold about you. We answer within 30 days and do not need a reason. You can also clear your browser's data for grapnelhq.com at any time.
Security
The site is served over HTTPS only. The database refuses public reads of anyone's entries, there is no public file storage, and the only upload we keep is a Rally maker's logo, shrunk to a small image.
Children
GRAPNEL is for business owners and adults. It is not made for children under 13 and we do not knowingly collect their information. If you believe a child has given us information, write to us and we will delete it.
Changes
When this page changes, the date at the top changes. We will not use information we already hold in a new way without asking you first.
Questions: grapnel.team@gmail.com · Privacy · Terms · Accessibility