How the Gridian sites handle your data

The short version

• You sign in with a passkey on your device. The sites never ask for a password.
• Your email address, name, bio, photo and the list of apps you let see them are encrypted in your browser before they are stored. Our servers never see them in the clear.
• Your handle and your mail addresses are public on The Grid, and its chain can’t be edited or erased.
• The sites run no advertising, analytics or tracking scripts. The one outside company involved is Stripe, which takes payments.
• We don’t sell or rent your data, and we use it only to run these sites.

Your Gridian

Your Gridian is your identity on The Grid. Its keys are made in your browser and stay on your devices, each guarded by that device’s passkey.

Public, on The Grid’s chain: your handle, your mail addresses, and which account pays for your mail. Every node that keeps the chain keeps these, and they can’t be deleted.

Private, off the chain: one record holding your email address, display name, bio, photo and the apps you allowed to see them. It is encrypted in your browser under your Gridian’s own key and kept in storage on The Grid set aside for your Gridian; the chain holds only a fingerprint of it and where it is. You change what it holds at id.gridian.io. An app sees only what you allowed it to; removing an app stops it seeing more, but what it already copied can’t be called back.

So that you can get back in after losing your devices, a copy of the key to that record is held for recovery by The Grid’s network, under a key shared among several of its machines. Enough of those machines acting together could open it, unless you set a recovery phrase: that copy then needs the phrase as well.

Recovery

A recovery email, if you give one, is sealed in your browser so that no single machine can read it, and is kept inside your private record. When a reset is asked for, The Grid’s mail nodes open it piece by piece to send the letter. Two members of the group sending that letter, acting together, could read the letter and the address it went to. The relay that hands it to the address’s mail provider learns the address’s domain.

A reset is asked for with a handle, never an email address, and every request gets the same answer, so the form doesn’t reveal who has a Gridian or their address. To limit abuse, our server keeps a keyed fingerprint of the requester’s IP address and of the handle, never the address or handle itself, for about a day.

Gridian Mail

• Your letters are read and written in your browser. Our web server doesn’t receive them, and the mailbox’s search index exists only while its tab is open.
• Each letter is kept encrypted, in three copies, by a small group of The Grid’s nodes. Your devices can read it, and so could two of the three nodes holding it acting together.
• The nodes holding your inbox see when letters arrive and are read, how many there are and their padded size, but not what they say. The Grid’s edge relays, which carry the mailbox’s traffic, see your IP address.
• A letter you send outside The Grid leaves as ordinary email. The relay sending it learns your address, the recipient’s domain, the time and the size, and the recipient’s provider can read it.
• A letter from outside The Grid can be read by the sender’s provider, which keeps its own copy. A sender that doesn’t insist on an encrypted connection may send it across the internet unencrypted.
• A link to a file sent with a letter carries the file’s key in the link itself, so anyone the link reaches, the recipient’s mail provider included, can open the file. Such a link lasts at most 30 days.
• If Gridian pays for your mail, the part of our server that pays for it learns your mail addresses, which of them sends each letter, and a fingerprint of your Gridian.

Payments

Payments are taken by Stripe. Card details and identity checks are entered in Stripe’s own forms, inside the Add credit dialog or on Stripe’s checkout page, and go to Stripe, not to us. The email address you give to sign in to Link, Stripe’s saved-payment service, passes through our server on its way to Stripe; we don’t store it. Stripe’s script loads only when you open the Add credit dialog.

To buy credit, our server sends Stripe your Stripe customer id, the payment, the amount, the address the credit goes to, your IP address and your billing account’s id. It gets back whether your identity check passed and your card’s brand and last four digits. For a plan, Stripe gets only a reference number for you, and we keep your Stripe customer and subscription ids with a fingerprint of your Gridian.

Stripe handles what it receives under its own privacy policy.

Cookies and your browser

The sites set only the cookies they need to keep you signed in and to remember choices you made. None tracks you across sites, the page’s own scripts can’t read them, and each goes only to the site that set it.

• Your sign-in on each site: who you are signed in as and the tokens The Grid’s sign-in issued, sealed so they can’t be altered, until that sign-in ends.
• The Grid’s sign-in session, on id.gridian.io, so the other sites don’t ask you again.
• A sign-in in progress: a few random values and the page to return to, for 10 minutes, or 30 while you join.
• Your billing accounts and a Link sign-in, while you are signed in.
• The Grid Cloud account and environment you last chose, for a year.

Signing out removes that site’s sign-in cookies.

Your browser also keeps, on your device only: your Gridian’s keys, guarded by your passkey; the Gridians signed in on this device, with their names, handles and photos; choices such as your theme and the accounts you used; and, while you join, the details you are typing.

What our servers keep

• Where a new device is signing in from: the city and country our network finds for its address, kept for five minutes so your other device can show it to you when you approve.
• Reset requests, as fingerprints, for about a day.
• For a plan: your Stripe ids and the mail addresses it pays for.
• The alerts your billing account asked for, and the email address for them if you give one.
• If you ask to be told when a product opens: your email address, the product and the time, until you ask us to remove them.

Like every web server, ours sees your IP address and which page you ask for, and knows who is signed in. The sites’ own code writes no IP addresses to its logs, and a few error lines can name a mail address or a Stripe subscription. The server in front of it may keep ordinary access logs.

What this can’t protect

• Machines that share a key can act together. Enough of the machines holding one could open what it guards: your letters, your recovery email and, without a recovery phrase, the key to your private record.
• An unlocked device that is stolen can read your mail until you remove it from your Gridian.
• The Grid doesn’t hide your IP address from its relays, when your devices come online, or which account pays for your mail. Removing a device shows on the chain.
• If our web server were made to send your browser altered code, that code could see what the page sees. The mailbox checks that it runs the published code, but that check, and the way the mailbox cleans incoming mail, have not yet had an independent security review.

Questions and changes

What is on The Grid’s chain can’t be removed by anyone. When this page changes, the date at the top changes.

See also the terms of use and who runs these sites.