Privacy Policy — Grain
Last updated: September 13, 2026 · Contact: grain@ripenedgrain.com
Grain (ripenedgrain.com) is a small, US-based, personally run project. We collect as little as the site needs and do not sell your data.
1. What we collect
- Browsing: you can read without an account; hosting/infrastructure keep basic technical logs (IP, browser, pages, timestamps) to run and secure the site.
- Account: your email, and a display name if set. Passwords are handled by Supabase Auth and stored as secure hashes; we never see them. Magic links send a one-time sign-in link to your email.
- Using your account: saved items; journal pieces you write (private entries and public submissions); initiatives you propose. Submitted content — and that you authored it — is visible to Grain's admin for review.
- Public features: for published initiatives you join, we record that you joined; discussion posts show publicly under your display name; reports/flags you file are recorded so we can act.
Please don't put more than you need into free-text fields.
2. How we use it
Operate your account and the save/journal/initiative/discussion features; review submissions and run moderation; send account/service emails (sign-in links, review outcomes, notices) — no marketing; keep the site secure, prevent abuse, enforce the Terms, respond to safeguarding concerns; meet legal obligations. Bases: your consent, performing the service you asked for, and our legitimate interest in a safe, honest directory.
3. Who processes your data
- Supabase — database (Postgres) + authentication; stores account, saved items, submitted content, protected by row-level security.
- Vercel — hosting/CDN; handles requests and technical logs.
- Resend — sends authentication and service emails.
Providers may process data in the US and elsewhere. We do not sell your data or share it for advertising. We may disclose information if required by law, to protect someone's safety (including safeguarding), or to enforce the Terms.
4. Cookies and sessions
Only cookies/local storage needed to keep you signed in and make the site work (e.g., your session token). No advertising or cross-site tracking cookies.
5. Your choices and rights
View/change account details and delete saved items and journal pieces from your account. To request access to your data, or deletion of your account and associated personal data, email grain@ripenedgrain.com; we'll act within a reasonable time. Some content may remain where others saved it, in backups, or where we must keep it for legal/safeguarding reasons. Depending on where you live you may have added rights.
6. Children's data
Grain is not directed to children under 13, and we do not knowingly collect their personal information (per COPPA). If you believe a child under 13 created an account, tell us and we'll delete it. Some real-world initiatives may involve minors as participants; Grain does not collect data about them through the site, and organizers are responsible for handling any minor's information lawfully and safeguarding them. Do not post identifying details about a minor in a public piece, initiative, or discussion.
7. How long we keep it
Account data while your account is open; content while published or saved. On deletion/closure we remove it from active systems within a reasonable period, except where retention is required for law, a dispute, or safeguarding. Residual backup copies persist a limited time before being overwritten.
8. Security
Data lives in Postgres protected by row-level security, so a member reaches only what they're entitled to and private entries stay private. Passwords are hashed by our auth provider. We use reputable providers and reasonable measures, but no online service is perfectly secure.
9. Changes
We may update this policy; the "last updated" date changes, and we'll flag significant changes.