Privacy Policy
Last updated: March 18, 2026
1. Introduction
Welcome to Grafold ("we," "us," or "our"). Grafold is a node-graph canvas application for generating and vectorizing illustrations, available at grafold.app. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service. Please read this policy carefully. By using Grafold, you agree to the practices described in this policy.
2. Information We Collect
We collect the following types of information:
Account Information
- Email address
- Name
- Account role
User Content
- Images you upload as references
- AI-generated images and SVGs created through the service
- Prompts, node configurations, and project data
Usage Data
- Information about how you interact with the service (e.g., features used, actions taken)
- Browser type, device information, and IP address
- Timestamps of requests for rate-limiting purposes
3. How We Use Your Information
We use the information we collect to:
- Provide, operate, and maintain the Grafold service
- Process your images through third-party AI services (generation, style analysis, and vectorization)
- Authenticate your identity and manage your account
- Enforce rate limits to ensure fair usage
- Improve and develop new features for the service
- Communicate with you about service updates or respond to inquiries
4. Third-Party Services and Data Sharing
To provide our service, we share certain data with the following third-party providers. In particular, your uploaded and generated images are sent to external AI providers for processing:
- OpenAI — Your images and prompts are sent to OpenAI for AI image generation. OpenAI processes this data according to their own privacy policy.
- Google Gemini — Your reference images are sent to Google Gemini for style analysis, which extracts visual attributes such as line style, color palette, and rendering style. Google processes this data according to their own privacy policy.
- Recraft — Your raster images are sent to Recraft for vectorization (conversion to SVG format). Recraft processes this data according to their own privacy policy.
- Supabase — Hosts our PostgreSQL database, which stores your account information, project data, and metadata.
- Cloudflare — Provides hosting for the application and stores your image assets in Cloudflare R2 (S3-compatible storage).
- Upstash — Provides Redis-based rate limiting. Only request timestamps and user identifiers are processed; no personal content is stored.
We do not sell your personal data to third parties. Data is shared with the providers listed above solely for the purpose of delivering the Grafold service.
5. Data Storage and Security
Your data is stored in Supabase PostgreSQL with row-level security policies, ensuring that users can only access their own data. Image assets are stored in Cloudflare R2. We use industry-standard security measures, including encryption in transit (TLS) and secure authentication, to protect your information. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
6. Data Retention
We retain your personal data and content for as long as your account is active. If you request deletion of your account, we will delete your personal data, projects, and associated assets within a reasonable timeframe. Some data may be retained in backups for a limited period before being permanently removed.
7. Your Rights
Depending on your jurisdiction, you may have the following rights regarding your personal data:
- Access — Request a copy of the personal data we hold about you.
- Correction — Request that we correct any inaccurate or incomplete data.
- Deletion — Request that we delete your personal data and associated content.
- Export — Request a portable copy of your data.
To exercise any of these rights, please contact us at hi@grafold.app.
8. Children's Privacy
Grafold is not intended for use by anyone under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected data from a child under 13, we will take steps to delete that information promptly. If you believe a child under 13 has provided us with personal data, please contact us at hi@grafold.app.
9. Cookies
Grafold uses only essential session cookies required for authentication and maintaining your session. We do not use analytics cookies, advertising cookies, or any third-party tracking cookies.
10. Changes to This Policy
We may update this Privacy Policy from time to time. When we make changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of Grafold after changes are posted constitutes your acceptance of the updated policy.
11. Contact Information
If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at hi@grafold.app.