Privacy Policy

Granite is a permanent vault for the documents that matter to you. We built it on the assumption that your archive should outlive the company holding it, and that you should be able to take everything with you at any time.

This policy explains exactly what we collect, why we collect it, and how we protect it.

What we collect

Account data. When you create an account we collect your email address and (optionally) your name. We never sell, rent, or advertise against this data.

Documents you upload. Every file you upload is encrypted with per-upload envelope encryption on our servers and stored as ciphertext in our blob storage. We extract structured metadata (document type, dates, vendor names, key values) so the vault can be searched. That metadata is also stored encrypted at rest in our database, with a short list of exceptions that have to stay queryable to power search and library ordering: a full-text index, vector embeddings, a sort key, an index of the digit sequences in the document so you can search an account number by its last few digits, and invoice amounts as plain numbers so Ask can add them up (see security for details).

Usage telemetry. We log technical events (uploads, searches, errors) so we can keep the service running. User-typed strings that could reconstruct private content, including search queries, magic-link and password-reset tokens, are redacted from request logs before they are written.

How we encrypt your archive

Every uploaded file is wrapped with per-upload envelope encryption using AES-256-GCM. The data-encryption key (DEK) is itself wrapped with a per-user key-encryption key (KEK) derived from a master KEK held only in our infrastructure. The bytes stored in object storage are always ciphertext. Decryption happens on our servers, only for requests authenticated as you.

Granite staff do not open your documents. The one exception is a document you deliberately submit to us for schema review, when our library has no match for it: that is a per-document consent you give, you can withdraw it, and every view or download by our team is written to your audit log.

Subprocessors

Granite uses a small number of third-party services to operate.

• Hosting & background jobs: Hetzner (servers, managed through Hatchbox), Cloudflare (edge proxy and TLS for app traffic, plus R2 for encrypted blob storage)
• Database: Neon (managed Postgres)
• Document understanding: Google Vertex AI (Gemini, for OCR, classification, extraction of structured metadata, and the summary shown on a document)
• Judgment checks: TypeSafe AI (Jev, a small decision model that receives extracted page text to give a second opinion on a document's type, judge whether native PDF text should be routed through OCR, verify extracted field values against the source text, decide what a document asks of you and how soon, and apply the plain-English filing rules you write to your documents. For Ask, it receives your question, and then the answer together with the cited page text, to check that the answer is supported. To match a name on a document to one you already have, or to spot a re-scan of a document already in your vault, it receives the names, titles, dates, extracted fields, and a short excerpt or summary of the documents being compared. When you scan an Evernote export, it receives each note's title, the first 3,000 characters of visible text, attachment MIME types, and source URL to triage the note for import)
• Ask, search, and titles: Anthropic (Claude, for answering questions over your documents with the relevant page text, summaries, and extracted field values attached, for interpreting a search query, for the short generated title, for the internal summary we embed, and for suggesting entity links and collection groupings from titles and extracted fields. If you send feedback from inside the app, Claude also writes the subject line of that email from your message)
• Semantic search: Voyage AI (vector embeddings and rerank)
• Email: Resend (transactional email, the marketing contact list, and, if you use email-in, the inbound messages and attachments sent to your vault address)
• Email validation: Emailable (your email address at signup, to catch throwaway mailboxes)
• Billing on the web: Stripe (your email address and payment details; we never see or store your card number)
• Apple: Sign in with Apple, in-app purchase for the iPhone app, and push notifications. A push alert carries the document title only, never a field value
• Dropbox: only if you connect it. Granite reads files out of your Dropbox. It never writes to it and never deletes anything there
• Error monitoring: Sentry (errors only, no document content)
• Marketing site: Vercel (hosting and analytics), Fathom Analytics (cookieless page views)

Each of the AI providers above receives only the data needed for their specific call (raw PDF or image bytes, extracted page text, extracted field values, or a generated summary); we do not opt them into model training. What a model returns about a document (OCR text, classification, extracted fields, summaries) is cached encrypted at rest in our database so we don't re-send the same content. Ask answers and search results are cached for up to a day in a server-side cache so a repeated question is answered without a second model call. That cache holds the answer text and the list of matching documents, not your files, and it is not encrypted at rest. When this list changes, we update this page. (A dedicated subprocessors page with versioned history is coming soon.)

Analytics and cookies

The marketing site uses Fathom Analytics, which is cookieless and receives the page path, the query string, and the referring page. It also uses Vercel Analytics and Speed Insights for traffic and performance numbers.

The app itself sets one cookie: your session cookie. It is encrypted, HttpOnly, Secure, and SameSite=Lax. Signing in with Apple sets a second short-lived cookie to carry the sign-in state, and it is deleted as soon as the sign-in finishes. We run no advertising or tracking cookies anywhere.

We use Sentry for error reporting in the app. Session replay is off. We attach your account id and email address so an error can be traced to the right account, and Sentry's own "send everything about the request" default is turned off. Tokens and other sensitive strings are scrubbed before an event leaves our servers or your browser. Document content is never sent.

How long we keep it

Your documents are retained for as long as your account is active. When you delete a document it disappears from your library, your search results, and your collections straight away. The encrypted original stays in storage until you delete your account. There is no way to bring a deleted document back, and there is no scheduled purge of the original.

When you delete your account we hold it for three days so you can change your mind, then the purge runs and cannot be undone: the document bytes, the export files, every row we hold about you, and your contact at our email provider are all deleted. What survives is a tombstone that carries no personal data. Error reports already sent to Sentry expire on that provider's retention schedule.

Your rights

You can export your entire archive, original files plus extracted metadata, at any time. You can delete any document or your whole account at any time. If you are in the EU, UK, or California you have additional rights to access, correct, or restrict the processing of your personal data; email us and we will help.

Contact

For any privacy question, write to hello@granite.co.