Skip to content
Graze

Privacy Policy

Last updated: 8 September 2026

This describes what Graze actually stores, which is deliberately not much. It is written to match the code rather than to cover every possibility, so if something isn't listed here, Graze doesn't collect it.

Who is responsible for your data

Graze is an independent, non-commercial project operated from Canada by a single person. Under the UK GDPR and EU GDPR, its operator is the data controller for the information described here, and can be reached at the address below.

For anything in this policy — including access, correction, export, or deletion requests — contact grazeoutreach@gmail.com.

What Graze collects

When you create an account

  • Email address. Used to sign you in and to contact you about your account. It is never shown to other users.
  • Display name. Shown publicly next to anything you post that isn't anonymous.
  • Password. Stored only as a bcrypt hash. The password itself is never stored and cannot be recovered from the hash — if you forget it, it can only be reset, not retrieved.
  • Account creation date and a role flag distinguishing ordinary users from administrators.

There is no name-and-address form, no phone number, no date of birth, and no payment information anywhere in Graze, because nothing on the site charges money.

When you post, comment, or vote

  • The content you submit — paper details, comments, notes on your board — together with the account that submitted it and a timestamp.
  • Votes on papers and comments, linked to your account so each person votes once. Individual votes are not shown to other users; only totals are.
  • A four-digit "cow number", assigned the first time you post anonymously and reused for your later anonymous posts. This lets other people follow one anonymous contributor without it linking to your profile. It is pseudonymity, not anonymity: the link between your cow number and your account exists in the database, and an administrator with database access could follow it. Please don't post anything under it that would harm you if it were connected back to you.

When you use "Chew on this" or click through to a paper

Graze records that your account reached a paper's source, and whether you did so after reading the plain-language summary or passed the comprehension check. This is the one measurement the project is judged on — whether it actually gets people to real research. It is tied to your account and covers only papers on Graze.

When you upload a PDF

Uploaded PDFs are stored on Vercel Blob. They are stored with public access, meaning anyone who has the file's URL can open it without signing in. Treat an upload as publishing. Do not upload anything you do not have the right to share, and do not upload documents containing personal information.

What Graze does not collect

Graze does not log IP addresses, does not record your browser or device, does not use analytics or advertising, and sets no tracking cookies. There is no profiling and no automated decision-making with legal or similarly significant effects. Your hosting provider keeps its own server logs, which is outside Graze's control and normal for any website.

Why Graze is allowed to hold it (legal bases)

  • Performance of a contract. Your account details and the content you post — without them there is no account and nothing to show.
  • Legitimate interests. Click-through and comprehension records, and keeping the site secure and working. The interest is understanding whether Graze achieves its stated purpose; the data is minimal and never sold or shared for marketing.
  • Consent. The agreement you give at sign-up to these terms. You can withdraw it by deleting your account.

Who your data is shared with

Graze does not sell your personal data, and never has. It is not shared for advertising or marketing, and there are no third-party trackers on the site. Data reaches other companies only as processors needed to run it:

  • Vercel — hosting and file storage for uploaded PDFs.
  • The database host — stores everything described above.
  • Anthropic — when a plain-language explainer is generated, the paper's title and abstract are sent to Anthropic's API. Your account details are not sent, and results are cached so a given paper is only sent once.
  • Academic sources — searching sends your search terms to OpenAlex, and paper look-ups reach Crossref, DOAJ, PubMed, Semantic Scholar and doi.org. These carry the query and the paper identifier, not your identity.

Vercel, the database host, and Anthropic are all based in the United States; the academic sources above are hosted internationally. Where these providers publish Standard Contractual Clauses or an equivalent safeguard, transfers rely on those. Graze is a non-commercial, one-person project and does not have separate data-transfer agreements of its own with any of them.

How long it is kept

  • Your account — until you ask for it to be deleted.
  • Posts and comments — these are public contributions to a shared library, so they may remain after your account is deleted, with authorship removed. If you need specific content taken down too, say so in your request.
  • Notifications — deleted with your account.
  • Error logs — technical messages held briefly, capped at the 100 most recent, and lost whenever the server restarts. They are not indexed by user.

Your rights

If you are in the UK or EU, the GDPR gives you the right to access your data, correct it, have it deleted, restrict or object to how it is used, and receive a copy in a portable format. If you are in California or another US state with a comparable law, you have similar rights to know, delete, and correct — and Graze does not sell personal information, so there is nothing to opt out of.

There is currently no self-service button for deletion or export — these requests are handled by hand. Email grazeoutreach@gmail.com from the address on your account and you will get a response within 30 days, which is the statutory limit. There is no charge.

If you think your data has been mishandled you can complain to a supervisory authority — in the UK, the Information Commissioner's Office; in the EU, the authority in your country.

Children

Graze is not intended for children. You must be at least 16 to hold an account, as set out in the Terms & Conditions. If you believe a child has created an account, email grazeoutreach@gmail.com and it will be removed.

Cookies

Graze sets two cookies and no tracking cookies at all. The Cookie Policy explains both.

Changes

If this policy changes in a way that affects you, the date at the top changes and the change will be noted on the site. Continuing to use Graze after that means the updated policy applies.