Privacy Policy

1. What we collect and why

When you sign up for and use the console we collect:

• At sign-up: email address. If you sign in with Google or GitHub, the email address, name and user identifier that provider confirms to us. The login codes we email you are stored only as a hash and expire after 10 minutes.
• During use: a record of changes such as creating or deleting apps, issuing or revoking keys and changing limits (time, account, IP address)
• Access logs: request records for operating and securing the service

We use this only to create and authenticate your account, manage your apps and keys, answer your questions and keep the service secure. We do not use it for advertising or marketing.

2. End-user data of customer apps

When you add gravex chat to your product, the end-user data of that product (user IDs, names, avatars, chat messages, attachment URLs, connection records and so on) is stored in the engine.

The controller of this data is you, the operator of the product; we are the processor that stores and delivers it on your behalf. We do not use it for any purpose beyond that or provide it to third parties. Giving notice to your end users and obtaining their consent is your responsibility.

You can erase this data from the engine by deleting the app in the console and running 'Delete permanently'.

3. Cookies and analytics

• Login session cookie: keeps you signed in to the console. Only a hash of the session value is stored on the server.
• Language cookie: remembers the language you chose.
• Google Analytics 4: collects anonymous usage such as page views and sign-ups to improve the service. No names or email addresses are sent.

You can refuse cookies in your browser settings; console login may then not work.

4. Retention and deletion

Account data is kept until you delete your account, and we erase it without delay when you ask. Records of changes are kept for as long as needed to operate and secure the service, then erased. Information that the law requires us to keep is kept for that period.

The users, rooms and messages of an app are erased when you delete the app and run permanent deletion.

5. Sharing and processors

We do not provide your personal data to third parties.

To run the service we use the infrastructure of:

• Amazon Web Services: servers, database, file delivery (CDN)
• Google: analytics (Google Analytics 4)

We may disclose data to the extent a law enforcement agency lawfully requires it.

6. Security measures

• Sign-in uses a one-time code sent by email; the code is stored only as a hash, expires after 10 minutes and is discarded after 5 wrong tries.
• A secret key is shown once when issued and is not stored.
• Only a hash of each session token is stored.
• Communication with the service is encrypted with HTTPS.
• The console checks access so that an account can open only its own apps.

7. Your rights

You can ask at any time to see, correct or delete your data, or to stop its processing. Send the request to the contact below and we will handle it without delay. End users of a customer app should first ask the operator of that service.

8. Controller and contact

Controller: GravEx

Contact: admin@gravex.app

9. Changes

If this policy changes, we publish the new version here with its effective date.