What Grenier does with your data

What Grenier reads

If you connect Gmail, Grenier reads the bodies of your messages (the "gmail.readonly" scope from Google). It needs the full text — not just the subject and sender — so it can understand what each conversation was about and how you typically write to that person.

If you upload a LinkedIn data export (CSV or ZIP), Grenier reads the full contents of every file you provide.

If you connect Google Calendar, Grenier reads event titles, descriptions, attendees, and times.

How Grenier uses it

Every message body and CSV row is processed by a language model to produce a short summary capturing the topic, the relationship cues, and your tone. That summary — plus the basic metadata (sender, recipient, date) — is what gets saved. The original text is discarded after the summary is written.

That processing runs on external inference providers based in the United States. We send them the message text needed for that specific job and nothing else. Every provider your content reaches operates under zero data retention for our account: your content is not stored after the response is returned, and each is contractually barred from using it to train or fine-tune any model. We name every one of them, and say exactly what each receives, at our sub-processor list — and we do not route your content to a provider that is not on that page.

Which provider handles a given request depends on your plan and on the kind of request, and that routing changes as models improve. What does not change is the rule above. There is no fallback provider: if the provider handling a request is unavailable, the operation fails and is retried later — your content is not re-routed anywhere else to get the job done.

We keep an encrypted log of the prompts and responses sent to the model for debugging and quality work. By default a Grenier admin cannot read your prompt or response text in that log — only operational metadata (timestamp, type, model, latency). You can opt in to let our team read your prompts to improve prompt quality under Settings → Privacy (“Help improve Grenier's AI”); it is off unless you turn it on. This is an access-control rule at our admin tools, not a cryptographic guarantee.

What gets stored

• Contact records: name, email, company, title, phone, LinkedIn URL.
• Per-interaction summaries (short, AI-generated, redacted of obvious PII).
• An encrypted rolling history per contact, used to draft better tends.
• Free-form notes you write — stored as you typed them, not encrypted. The user-held-key tier that would encrypt them is built but switched off; see the correction at the foot of this page.
• OAuth refresh tokens — encrypted at rest with AES-256-GCM.

We do not store the raw text of your emails or LinkedIn export after summarization. We do not store message attachments. We do not store calendar event bodies past the summary stage.

Analytics — what Grenier counts about how you use it

Grenier records that something happened. It never records what was said.

An analytics event may carry: which action you took, when, and — where the action is about a specific person in your graph — which record it concerned, by internal identifier. An analytics event may never carry: message bodies, subjects, note text, draft text, AI prompts or completions, contact names, email addresses, company names, or any free text you typed.

These counts stay in our own database. They are not sent to an advertising network, a data broker, or a third-party analytics vendor. The only third party that sees anything is our hosting provider's pageview counter, and it is scoped to the public marketing pages — it never sees a page you visit while signed in.

We also keep a record of each visit: when it started and ended, how many steps it contained, which screen you entered on, and the ordered list of screens you moved through. Those records carry no account identifier at all — there is no column linking a visit to you, by design, so they cannot be queried back to a person. What that costs us is stated plainly below.

Who sees it

You see it. Grenier operators see aggregate metrics and error logs but do not have routine access to your contact summaries. Message summaries are encrypted at rest and operator access requires an audited Vault call. Private notes are not encrypted today, so an operator with database access could read one; the user-held-key tier that would prevent that is built but switched off.

We do not sell, rent, or share your data with advertisers, data brokers, or model training pipelines.

Your controls

• Export: Download everything we have on you as a ZIP from Settings.
• Delete: Request deletion from Settings; we hard-delete after a 30-day grace period.
• Disconnect: Revoke Gmail or Calendar access at any time from Settings or your Google account dashboard.
• Per-contact opt-out: Mark any contact "do not surface" to exclude them from tends.

One exception, and it runs in your favour. The visit records described above are not attached to your account — there is no identifier on them to match, so deleting your account cannot find them, and they survive it. They are instead erased on a clock of their own: every visit record is deleted 30 days after the visit, for everyone, whether or not anyone ever asks. So nothing we hold about how the product is used outlives a month, and none of it was ever labelled with you.

The trade-off we accepted to make that true: because those records carry no account identifier, we genuinely cannot tell you which visits were yours, and we cannot include them in your export. We would have to add the link back to answer either question, and adding it is the thing we are not willing to do.

When this changes

If we ever change what Grenier reads, where it's processed, or what we store, we bump the privacy promise version and ask you to re-accept before any new behavior kicks in. We do not quietly expand scope.