Privacy

Draft, under review, not final. Dated 2026-10-08. It is not a finished privacy policy or terms of use.

This draft describes what the GrantBuddy code actually collects today, following the FTC's Protecting Personal Information guide for businesses: take stock of personal information and keep only what the product needs. It is written for GrantBuddy LLC. Contact: grantbuddyteam@gmail.com. Dated 2026-10-08.

What you can use without an account

Searching, browsing open opportunities, browsing sources by state, and looking up awarded grants do not require an account. Those pages send the search terms you type (including any q, program, source, and state query keys) to this app so it can query Grants.gov, SBIR.gov / DoD SBIR, SAM.gov, and the wired state adapters. The search route rate-limits by IP address.

Company profile on Get matched

The matcher asks for company name, what the company does, keywords, sector / NAICS, state, agency preferences, and whether you want SBIR/STTR. That profile is used for one match request. Saving a search is not built yet. If you opt in to "Get an email when new fits show up," the app stores the address and the profile snapshot, and emails the address plus company details (company name and one-liner) to the GrantBuddy ops inbox so someone can follow up.

Cookies and analytics on Get matched

Get matched sets a non-httpOnly cookie named gb_match_sid (180 days, SameSite=Lax) so three events — profile submitted, results viewed, email captured — can be counted for the same browser. Optional first-touch UTM parameters (utm_source, utm_content) are stored on those events. The email address is not written into the analytics event.

Sign-in

Optional sign-in uses a work email (a one-time link and, when accounts mode is on, a password). The session cookie is httpOnly, SameSite=Lax, and lasts 30 days. Signed-in workspaces can hold documents and a company fact ledger used to draft applications.

Phase I first-draft pack

Existing paid orders remain fulfillable. Payment was a Stripe Payment Link. Stripe collects the buyer's email and card details; Stripe handles the card. After payment, the Stripe webhook stores a record with the buyer's email and name from Stripe, plus the amount and Stripe IDs. A paid notification with the amount and the customer email is sent to the GrantBuddy ops inbox (Gmail). The app matches that email at intake to the paid record. Intake stores legal name, UEI, CAGE, budget, and company facts.

Where data is sent

The app is hosted on Railway. grantbuddy.org also sits behind a Vercel edge proxy. The code sends data to these third parties when the related feature is in use.

• Anthropic (Claude), for drafting from workspace documents and the fact ledger.
• xAI (Grok), as an availability failover when Anthropic is down, used for solicitation parsing. That parsing can include topic text and company facts entered at Phase I intake, or an uploaded solicitation file. Drafting from workspace documents and the fact ledger stays on Anthropic.
• SMTP via nodemailer, for magic-link login mail and other product email the mailer already sends.
• The GrantBuddy ops inbox, a Gmail address, for each Get matched email capture (address, company name, and one-liner) and for other ops notifications. Those messages are delivered to Google.
• S3-compatible object storage (STORAGE_* config, AWS S3 client) for uploaded files.
• Stripe, for payments when billing is configured.
• Google AdSense may set advertising cookies when a publisher id is configured. No publisher id is hardcoded, so the AdSense script is not loaded unless that id is set.

What this draft does not claim

Retention periods other than the cookie lifetimes above, a mailing address, and a phone number are not stated here. They belong in an approved policy from GrantBuddy LLC. Public contact on this page is grantbuddyteam@gmail.com.