Privacy Policy

Grounded RAG lets you upload documents and ask questions about them, with every answer grounded in and cited back to your own document. This policy explains what data we collect to make that work, who else touches it, and how you can remove it.

Account data: your email address, and a securely hashed password if you sign up with email — we never store your password itself. If you sign in with GitHub or Google, we store the verified email address that provider gives us.

Document content: the files you upload, split into chunks and embedded as vectors for retrieval, plus extracted text and metadata such as filename and page numbers.

Conversation history: the questions you ask and the answers returned, scoped to the document you asked about, so you can resume a conversation later.

Solely to run the product: authenticating you, retrieving relevant passages from your documents, generating grounded answers, and letting you resume past conversations. We do not sell your data, and we do not use your documents to train any model.

Vectors and document text are stored in Qdrant Cloud, filtered so only your account can retrieve them. Answers are generated by an Azure-hosted OpenAI deployment by default; if you supply your own OpenAI key instead, that request is sent directly with your key and is never stored on our servers. Verification codes are emailed via Azure Communication Services. None of these processors receive more than what is strictly needed to perform their part of the request.

Your documents, their vectors, and their chat history remain until you delete them. Deleting a document from the workbench removes its database record, its retrieval index, and its vectors from storage — not just a hidden flag. Deleting your account removes everything tied to it; contact us to request that.

You can view and delete any document you have uploaded at any time from the workbench. You can request a copy of your account data, or full account deletion, by contacting us.

Every document route is scoped to your authenticated account with a signed token. Passwords are hashed, never stored in plain text. Retrieved document text is treated as untrusted data, never as instructions, when generating answers.

This service is not directed at children under 13, and we do not knowingly collect data from them.

If this policy changes in a way that affects how your data is handled, you will be asked to review and re-accept it the next time you sign in.

Questions about this policy or your data can be sent via the project repository.