Grainwork Privacy Policy

This Privacy Policy describes how Grainwork ("we," "us," "our") handles information when you use our mobile app and related services. If you have questions, email [email protected].

Who we are

Grainwork is a mobile app that generates home repair cost estimates from short videos or photos of damage, and can review a contractor's written quote to assess whether it is fair.

Eligibility

Grainwork is intended for adults 18 and over. You must be at least 18 years old to create an account or use the service.

Information we collect

Videos, photos, and audio you upload. When you record or upload a video or photo of home damage, we receive that media file, including any audio track on a video. This media is stored on Google Cloud Storage.

Still images extracted from your videos. Our backend extracts individual frames from your videos to analyze the damage. These frames are stored on Google Cloud Storage alongside the source video.

Contractor quotes you submit. If you use the quote-audit feature, we receive the quote details you provide (such as line items and prices) so we can assess them. This information is stored alongside your account data.

Account information. If you sign in with Apple or Google, we receive the email address you choose to share (which may be a private relay address generated by Apple) and a provider-issued user identifier. If you use the app without signing in, we create an anonymous identifier that associates your estimates with your session.

Location context. We store the zip code you provide so we can calibrate repair estimates to local labor rates. We do not collect precise GPS location.

Usage data. We use PostHog to collect pseudonymous product analytics — which screens you visit, whether recordings complete, general performance metrics. PostHog may receive your device model, operating system version, and a randomly generated device identifier. This data is not tied to your name or email address.

Technical data. Our backend infrastructure (Google Cloud) and analytics provider (PostHog) automatically receive your IP address, which is used for service delivery, abuse prevention, and approximate (country- or region-level) geolocation.

Purchase data. When you buy a quote audit or audit credits, we use RevenueCat to validate App Store receipts and manage entitlements. RevenueCat receives Apple's transaction identifiers. Your payment card information is handled entirely by Apple and is never shared with us or RevenueCat.

Push notifications. If you enable notifications, we receive a device push token so we can send you updates (such as when an estimate is ready). You can turn notifications off at any time in your device settings.

Error data. If the app crashes or encounters an error, we collect diagnostic information through Sentry to help us diagnose and fix the issue. This may include device model, operating system version, and a stack trace of the error.

How we use your information

• Generate repair estimates. Your videos, photos, and extracted frames are sent to Google's Gemini models (via Google Vertex AI) for content analysis. Google does not use your content to train its own AI models; Vertex AI processes it solely to generate your result. Grainwork retains your uploaded content and the estimates derived from it, in anonymized and aggregated form, to calibrate and improve the accuracy of our estimates over time.
• Improve the service. Pseudonymous usage data helps us identify bugs, understand user experience, and guide product decisions.
• Process purchases. Apple App Store receipt validation ensures the credits you purchase work correctly across devices.
• Contractor calibration. Aggregate, non-identifying patterns in estimates inform how we calibrate pricing over time.
• Respond to you. If you contact us, we use your email address to reply.

Legal basis for processing (EU and UK users)

If you are located in the European Union or United Kingdom, we process your data on the following legal bases:

• Contract: to provide the estimate service you requested.
• Legitimate interest: for analytics, fraud prevention, security, and service improvement.
• Consent: where required, which you may withdraw at any time.
• Legal obligation: to comply with applicable law.

You have the right to lodge a complaint with your local data protection authority.

Third-party services we use

• Google Cloud (Firebase, Cloud Storage, Firestore, Vertex AI / Gemini) — hosting, storage, backend, AI analysis. policies.google.com/privacy
• Sentry — crash and error reporting. sentry.io/privacy
• PostHog — product analytics. posthog.com/privacy
• RevenueCat — purchase and entitlement management. revenuecat.com/privacy
• Apple — App Store distribution, Apple Sign-In, payment processing. apple.com/legal/privacy

International data transfers

Your data is stored on Google Cloud servers in the United States. If you are located in the European Union, United Kingdom, or another jurisdiction outside the United States, your data will be transferred to and processed in the United States, subject to Google Cloud's standard contractual clauses and data processing terms.

How long we keep your data

• Videos and extracted frames: retained until you request deletion. If you delete your account, associated videos and frames are removed within 30 days.
• Estimate records: retained so you can revisit past estimates, until you request deletion. If you have not used the app for 24 months, we may delete associated data.
• Pseudonymous analytics data: retained up to 24 months.
• Crash and error reports: retained up to 90 days.

We are building in-app deletion controls. Until those ship, you can request deletion of your account and all associated data by emailing [email protected]. We process such requests within 30 days.

Your choices and rights

• You can use Grainwork without creating an account.
• You can request a copy of your data or ask us to delete it by emailing [email protected].
• California residents (CCPA/CPRA): You have the right to know what personal information we collect, the right to deletion, the right to correct inaccurate information, the right to limit use of sensitive personal information, and the right to opt out of sales or sharing. Grainwork does not sell or share personal information as defined by the CCPA.
• EU and UK residents (GDPR/UK GDPR): You have rights of access, rectification, erasure, restriction, data portability, and objection. Contact us at [email protected] to exercise these rights.

Security

We use industry-standard security practices: HTTPS/TLS encryption for data in transit, encryption at rest for stored data, and access controls limiting production system access to authorized individuals. No system is perfectly secure, and we cannot guarantee absolute security.

Children

Grainwork is intended for adults 18 and over. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us data, please contact us at [email protected] and we will delete it.

Contractor reviewers

The following section applies only to contractors who participate as reviewers for Grainwork.

If you participate as a contractor reviewer, we collect your name, email address, and the videos, audio recordings, and structured feedback you produce. This data is used internally to calibrate estimate accuracy. Individual reviewer contributions are not disclosed to homeowners.

Changes to this policy

We may update this policy over time. When we do, we will update the "Last updated" date at the top. If changes are material, we will notify you through the app or by email to the address associated with your account.

Contact

Questions about this policy or your data? Email [email protected].