Last updated: July 29, 2026
This Privacy Policy explains what information Grainwork ("we," "us," "our") collects when you use our mobile app and related services, how we use it, and the choices you have. We've tried to keep it plain. If anything is unclear, email [email protected].
Grainwork is a mobile app that turns a short video or photo of home damage into a repair cost estimate, and can compare a contractor's written quote with that Grainwork estimate to show where the scope or numbers differ. Grainwork is a United States service, built for U.S. homeowners and contractors. It is offered through the U.S. App Store and Google Play, and our estimate inputs, labor-rate data, and ZIP-code inputs are U.S.-specific. We don't market the service to, or design it for, users outside the United States.
Grainwork is for adults. You must be at least 18 years old to use the service.
Videos, photos, and audio you upload. When you record or upload a video or photo of home damage, we receive that media file, including any audio on a video. This media is stored on Google Cloud.
Still frames from your videos. Our backend pulls individual frames from your videos to analyze the damage. These frames are stored alongside the source media.
Contractor quotes you submit. If you use the quote-review feature, we receive the quote details you provide (such as line items and prices) so we can assess them.
Home documents you save. If you add a warranty, manual, permit, insurance page, receipt, inspection report, contractor estimate, material specification, or other home document, we receive the photo, PDF, or text file you choose and the title, notes, extracted text, dates, and fields you confirm. These documents can contain addresses, policy or permit numbers, prices, or other personal details, so review a document before you upload it.
Account information. If you sign in with Apple, we receive the email address you choose to share (which may be a private relay address) and a provider-issued user identifier; Grainwork does not retain the name Apple may display during sign-in. On Android, Google sign-in may also provide your Google profile name. If you use the app without signing in, we create an anonymous identifier so your estimates stay together on your device.
Location context. We store the ZIP code you provide so we can calibrate estimates to local labor rates. We do not collect precise GPS location.
Home details you choose to share. You can optionally tell us things about your home (such as its approximate age or type) to sharpen your estimates. This is always optional.
Usage and device data. We use PostHog to understand how Grainwork is used. After a Firebase session begins, Grainwork associates analytics with that session's Firebase identifier (including an anonymous-session identifier) so events from the same session or account stay together. Events may include deliberately named feature and lifecycle interactions, estimate/audit/project/visit identifiers, quote totals and entry shape, purchase product and credit events, app/device information, and a PostHog-generated device identifier. Some distributed app versions may also collect automatic screen/touch metadata, which can include interface labels or visible interface text; the Android launch source disables that automatic collection while preserving Grainwork's deliberately named funnel events. We do not send uploaded photos, videos, or audio to PostHog for product analytics.
Android install attribution. On Android, Google Play's Install Referrer service can provide the Play link or campaign associated with an install, along with click/install times and the app version installed. Grainwork processes the raw referrer only on the device and does not send or retain the raw referrer, URL, advertising token, advertising ID, click/install times, installed-version value, or any unapproved free-text value. The app does not read the click/install times. It reads the installed version transiently only to derive a bounded install-state label. The app keeps only a closed set of source/campaign/content labels and an organic, unknown, unavailable, or error status. Those labels are attached to named install, open, capture, completion, view, and purchase events in PostHog so we can measure how Grainwork's own marketing performs. We do not use them for personalized ads, cross-app tracking, or advertising to you.
IP-derived region. Our infrastructure providers receive your IP address to deliver the service and prevent abuse. Some distributed app versions may also allow PostHog to derive an approximate country or region from the request IP; the Android launch source disables that enrichment. Grainwork does not collect precise GPS location.
Purchase data. When you buy consumable Bid Check credits through the Apple App Store or Google Play, we use RevenueCat to validate the store receipt and apply the credits to your signed-in Grainwork account. We receive the store's product and transaction identifiers and purchase status. Your payment card is handled entirely by Apple or Google and is never shared with us.
Push notifications. If you turn on notifications, we receive a device push token so we can let you know when, for example, an estimate is ready. You can turn notifications off anytime in your device settings.
Error data. If the app crashes or has a performance problem, Sentry may receive device and operating-system information, stack traces, and performance measurements. Some distributed app versions may also include recent console messages or network-request metadata such as URLs or paths, query strings, status codes, and transfer sizes; the Android launch source disables network and console breadcrumbs while preserving crash and performance reporting. We treat diagnostics as potentially account-linked and do not intentionally send uploaded media contents to Sentry.
We do not sell your personal information, and we do not share it for advertising. We don't sell leads, we don't refer you to contractors, and we don't use your data to target ads. We share information only with the service providers that help us run Grainwork, and only so they can perform their function for us:
We may also disclose information if required by law, or to protect the rights, safety, or property of our users or Grainwork.
We keep personal information only as long as we need it for the purposes described above, and then delete or de-identify it. Analytics and crash diagnostics are retained on a rolling basis by our providers and are not kept longer than we need to run and debug the service. Grainwork's current in-app deletion cascade removes the active first-party data graph and resets the analytics identity on the device; it does not automatically erase historical events already held by PostHog or diagnostic records already held by Sentry. You can email [email protected] if you want us to coordinate a provider-side privacy request.
You can delete your account and its associated data at any time, directly in the app under Settings → Delete account. Anonymous users will see Delete my data. You can also use our account and data deletion page to request deletion without reinstalling the app. We normally complete verified email requests within 30 days.
What gets deleted. When you delete your account, we remove from Grainwork's active systems your account record, saved estimates and Bid Checks, home details and ZIP code, saved documents, unused Grainwork credits, uploaded photos and videos, extracted frames, and account-linked analysis and contractor-review material. We do not keep an active training copy of your uploaded media under an "anonymized" or "de-identified" label.
Short deletion-safety record. For up to two hours after a deletion request, we keep a minimal technical marker containing the former account identifier. Its only purpose is to prevent an already-issued sign-in token from recreating data after deletion. It cannot be read or changed through the app and is automatically scheduled for deletion after that safety window. Aggregate service statistics that do not identify an account may remain, and Apple, Google, RevenueCat, PostHog, and Sentry may retain transaction, analytics, or diagnostic records under their own retention requirements.
Backups and restore safety. Encrypted disaster-recovery backups and archival exports may contain a prior copy for up to 98 days. They are isolated from the live app and used only for disaster recovery. For the same period, we keep a restore-suppression receipt made from a one-way hash of the former account identifier. It contains no raw account identifier or user content and is used only to keep deleted data out of a restored system. The receipt and oldest backup expire on the same schedule.
California residents. California law gives residents certain rights regarding their personal information, including to know what we collect, to request deletion, and to correct inaccurate information. Grainwork does not sell or share personal information, and does not use it for cross-context behavioral advertising, as those terms are defined under California law. To exercise any right, email [email protected]; we will not discriminate against you for doing so.
We use reasonable measures to protect your information, including encryption in transit (HTTPS/TLS), encryption at rest for stored data, and access controls that limit who can reach production systems. No method of storage or transmission is perfectly secure, so we can't guarantee absolute security.
Grainwork is for adults 18 and over. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, email [email protected] and we'll delete it.
This section applies only to contractors who participate as reviewers for Grainwork. If you participate as a reviewer, we collect your name, email address, and the videos, audio, and structured feedback you produce. We use this internally to calibrate estimate accuracy. Individual reviewer contributions are not disclosed to homeowners.
We may update this policy from time to time. When we do, we'll update the "Last updated" date above, and if the changes are material we'll let you know through the app or by email.
Questions about this policy or your data? Email [email protected].