Who holds it
Beyond Overlooked. Write to hello@askgracen.com about anything on this page — that address reaches a person and it is the same address used for deletion requests, complaints and everything else.
What is collected
Your email address, when you sign in. Sign-in is a link sent to that address; there is no password to store and none is stored.
What you write to Gracen. The conversation is kept so it is still there when you come back. It is the most sensitive thing here and it is treated that way throughout.
Your message house and your record entries, if you build them. These are yours; the record can be downloaded as a Word or Markdown file at any time, whether or not you have ever paid for anything.
If you buy something: what you were shown before you paid, and when you ticked it. That record exists because Taiwanese consumer law requires the notice to have been given, and the only way to show it was given is to keep a record of it.
Questions asked without signing in. The first question on the homepage is stored without any account, address, IP or session identifier attached, and Gracen's reply is not stored at all. It exists to find out what people ask and where the material runs out. A stored row cannot be traced back to a person because there is nothing in it to trace.
Where it physically sits
- Supabase — the database and sign-in. Hosted in Tokyo.
- Railway — the service Gracen runs on, and the search index behind it. Hosted in Singapore.
- Vercel — the website itself, served from wherever you are.
▲ The part most products do not tell you
What you write is sent to two companies in the United States in order to answer you. There is no way to run this product without that and it should be said outright rather than buried:
- Anthropic generates Gracen's replies. Your messages are sent there to do it.
- Voyage AI turns your message into numbers so the right material can be found for it. Your text is sent there too.
Both are contracted processors, not partners. Neither is paid for your data and neither receives your email address alongside it.
Two more, smaller: Sentry receives error reports when something breaks (its servers are in Germany), and Resend sends the sign-in emails.
What never leaves
Nothing you type reaches an analytics or advertising vendor. Not a sentence, not a fragment, not a summary. The analytics here counts events — a page opened, a message sent — and carries no content and no free text. That is enforced in the code rather than promised in a document.
Nobody reads your conversations to improve anything. There is no human coach and no review queue.
Cookies and counting
Sign-in stores a token in your browser so you stay signed in. That is the only thing here that has to be stored.
Visits are counted twice over, and the two are not the same:
- Vercel Web Analytics — no cookie, no profile of you.
- Google Analytics — this one does set cookies, and it sends Google the pages you opened and the fact that things happened, so that we can tell whether anyone is finding this site at all. You can block it with any tracker blocker and nothing here stops working.
What Google Analytics never receives is anything you wrote. Not a message, not a fragment, not a summary — only structural events like “a page was opened” or “a message was sent”. That is enforced in the code rather than promised here.
The site loads its typefaces from Google Fonts, which means Google sees the address you connect from.
Paying
Card details never reach us and are never stored here. Payment is handled by Stripe, with Link as the seller of record, which is why your card statement shows Link rather than us. What comes back is the fact that a payment succeeded and how much it was.
▲ How long it is kept
Until you ask for it to be deleted. That is the honest answer today and this page will not claim otherwise.
A scheduled deletion for old conversations is written but is not running. When it is switched on, the number of days will be stated here and on the purchase page before it takes effect — not afterwards.
Deleting it
Write to hello@askgracen.com from the address you signed up with and say you want it gone. It is done by hand, within thirty days and usually much sooner, and you get a reply confirming it.
Take your record with you first. Deletion removes the conversations, the message house and the record entries, and none of it can be recovered afterwards. The download is free and stays free.
The same address works for asking what is held about you, having something corrected, or telling us to stop using it.
These rights exist under Taiwan's Personal Data Protection Act and Singapore's Personal Data Protection Act, and where the European or Swiss rules apply, under those. We do not ask which one you are covered by; the answer is the same either way.
Children
This is built for people in work and is not for under-18s.
If this page changes
The date below moves and the change is described. Anything that would widen what is collected or where it goes is said before it happens, not after.