Privacy policy

Who we are

Gridwork is a planner for social media posts, run by Tomtar LLC (“we”). Write to {{CONTACT_EMAIL}} with any question about your data.

What we store

• Your account: your name, your email address and your password, which we store only as a one-way hash.
• Sessions: for each device you sign in on, a session record with its expiry, the IP address and the browser's user agent. They let you sign out of a device and help us spot misuse.
• What you plan: workspaces and their time zones, the social accounts you add by hand (handle, display name, avatar), posts, captions, first comments, dates, grid order and crops, saved captions, hashtag groups and calendar notes.
• Your media: the photos and videos you upload, stored as you sent them (including any metadata inside them, such as camera details or location), the thumbnails and preview frames we make from them, and their filename, size, dimensions and duration.
• Sign-in throttling: counts of recent sign-in attempts per email address and per IP address, so nobody can guess passwords. They're only needed for 15 minutes and are deleted within a day.
• Server logs: our hosting provider records requests (time, path, IP address) to run and secure the service, and keeps them for a short time.

We use your data only to provide Gridwork to you. We don't sell it, share it for advertising, or use third-party analytics or ad trackers.

Who processes it for us

Two service providers store and process data on our behalf, under their data processing terms:

• Vercel hosts the app and runs its servers, and Vercel Blob stores your uploaded media and thumbnails, privately. Files are only ever served through short-lived signed links after we check you belong to the workspace. Vercel's privacy notice.
• Neon, part of Databricks, runs the Postgres database that holds everything else listed above. Databricks' privacy notice.

Both store our data in the United States.

Cookies

Gridwork sets only the cookies it needs to work. None of them track you across other sites.

• Session: keeps you signed in. It's removed when you sign out or delete your account.
• Workspace: remembers which of your workspaces you last opened.
• Theme: remembers whether you chose light, dark or system appearance.

Connected social accounts (coming soon)

Today you add social accounts by hand and post yourself, so Gridwork never signs in to them. A coming version will let you connect accounts so Gridwork can post for you. Connecting is always your choice, and you can disconnect at any time. When you connect one, we'll store the access token the platform gives us and use it only for the purposes below:

• Instagram (professional accounts): your account ID, username and profile picture to show which account is connected; permission to publish the posts, carousels, Reels and Stories you schedule; to post your first comment; to read your recent posts so your grid preview matches your profile; and to read their insights (views, likes, comments, saves, shares) for your analytics.
• TikTok: your basic profile (display name and avatar) to show which account is connected, and permission to upload and publish the videos you schedule.
• Pinterest: your profile and boards so you can pick where a Pin goes, and permission to create the Pins you schedule.
• Facebook Pages: the Pages you manage so you can pick one, and permission to publish the posts you schedule to it.

We won't read your messages, post anything you didn't schedule, or use platform data for anything other than these features. Disconnecting an account deletes its token, and the data we imported through it goes when you delete the workspace or your account.

How long we keep it

We keep your data while you have an account. Deleting media, a post or a social account removes it right away. Deleting your account removes your account and the workspaces only you own, with everything in them. Our database provider's point-in-time backups let us recover from mistakes for a short time afterwards; deleted data drops out of them when that window passes. How to delete your data.

Security

Everything travels over HTTPS. Passwords are hashed, never stored as you typed them. Media storage is private: nothing has a public link, and every file request is checked against your workspaces.

Your rights

You can see and change your data in the app, and delete your account from Settings. Depending on where you live you may also have the right to a copy of your data, to object to how we use it, or to complain to a data protection authority. Write to {{CONTACT_EMAIL}} and we'll answer within 30 days.

Gridwork isn't meant for children under 13, or under the minimum age for these services where you live.

Changes

If we change this policy we'll update the date at the top, and tell you in the app or by email before a change that affects how we use your data takes effect. This policy is governed by the laws of {{JURISDICTION}}.