Privacy policy

Updated 21 October 2026. Covers grantgoblin.com, app.grantgoblin.com and the Grant Goblin connector for AI apps such as ChatGPT and Claude.

Who we are

Grant Goblin is run by Komal Amin, an individual based in the UK (not a company). For the personal information described on this page, we are the controller.

Send privacy questions and requests to privacy@grantgoblin.com. For help with the app or the AI connector, see Support.

What we collect

• Your account. Your email address. You sign in with a six-digit code sent to it. There are no passwords.
• Your profile. What you tell Grant: where you are based, countries and citizenships, how you apply, your companies, your background, your links, and a free-text brief about what you are looking for. Some fields are optional, and you choose what to fill in.
• Documents. CVs, decks and bios that you upload. Up to 10 MB a file and 30 files.
• Your pipeline. Applications, to-dos, notes, saved answers, your fact bank, and your swipes on finds.
• Connected AI apps. The connector keys you make, and the connections you allow when you sign in to Grant from an AI app such as ChatGPT or Claude: the app's name, when you connected it and when it was last used. We store only hashes of keys and sign-in tokens, never the keys or tokens themselves. We keep a log of changes made through a connected AI. We never receive your chat history.
• Feedback. Notes you send us: the text, up to three screenshots, an optional email, and details of the screen, browser and device you were using.
• Technical details. Sign-in codes are stored only as hashes. We keep a truncated hash of your IP address, only to limit repeated sign-in and feedback requests.

Sensitive information

Some profile details are sensitive: whether a business is women-led, and your nationality or citizenship. You choose whether to give them. We use them only to check whether a funder's eligibility rules fit you. You can remove them at any time.

What we use it for

• To run your account and sign you in.
• To find funding that fits you, and to show why each find fits.
• To keep your pipeline, to-dos and applications in order.
• To keep the service secure and to stop abuse.
• To act on the feedback you send.

AI and other companies we use

• Funding search. We use AI and Apify only to read public funder web pages. The AI receives the page's address and its text. Your personal information is not sent to these services. Apify also runs search queries that we set, and reads pages that need a real browser.
• Your own AI. If you connect an AI app such as ChatGPT or Claude, that app can read and change your Grant data through Grant's tools, when you ask it to in a chat. Grant sends it only what the request needs: funding results and their rules; your profile and brief; your applications, to-dos, notes and saved answers; your fact bank; and your progress (deadlines, replies, submissions). It can add or change these. It cannot delete your applications, notes or saved answers; the only things it can remove are unfinished jobs Grant made for an application, when it replaces them with the real ones. It never sees your sign-in email code or other people's data. The AI provider's own terms and privacy policy apply to what happens in that chat. We do not control them. You can switch a connection off at any time in the app, under "Connect your AI".
• Sharing a find as a lead. When you add a pick through your AI, its link and title can be shared with our shared funding radar as a lead. Your notes and reasons are not shared. A lead reaches the shared catalogue only after it has been checked and reviewed.

The companies that run the service for us are:

• Cloudflare for our servers, database and file storage.
• Resend for sign-in codes and other email.
• Vercel for hosting the website and the app.
• OpenRouter, which routes requests to the AI models that read public funder pages (Anthropic's Claude Haiku, with DeepSeek as a fallback), and Apify for the radar described above.
• Google Fonts, which serves the fonts on the website. Your browser contacts Google when you visit.

Some AI providers may process data outside the UK and EU. Check their terms before you connect one.

Where your data is stored

Our database and file storage run on Cloudflare in the EU, set up so that the data stays in the EU. Email is sent through Resend's EU (Ireland) region.

How long we keep it

• Sign-in codes expire after 10 minutes.
• Your sign-in session lasts 90 days, after which you sign in again.
• When you connect an AI app by signing in: its access token lasts 1 hour and its refresh token 90 days. Unfinished sign-in requests are deleted after a day. A connection lasts until you switch it off, connect that app again, or close your account.
• Everything else is kept while your account is open.
• When you ask us to delete your account, we delete it within 30 days, including from backups. Feedback notes are kept for up to 2 years, then deleted.

How we protect it

We store sign-in codes, connector keys and AI app sign-in tokens only as hashes. Every request for your data is limited to your own account, and changes made through a connected AI are logged. No service is perfectly secure, so keep your sign-in email and your connector keys private, and revoke any key you no longer use.

Your rights

Under the UK GDPR and the EU GDPR you can ask us to:

• give you a copy of your data (access);
• correct anything that is wrong;
• delete your data;
• give you your data in a portable form (export).

The export and delete buttons are not in the app yet. Until they are, email privacy@grantgoblin.com and we will handle your request by hand. We normally reply within one month. You can also complain to the Information Commissioner's Office (ico.org.uk) in the UK, or to your local data protection authority in the EU.

Cookies and the website

The website does not use tracking cookies, analytics or advertising scripts. It keeps one small setting in your browser so that it does not replay its intro animation. The app keeps your sign-in session in your browser until it expires or you sign out.

Changes to this policy

We will update the date at the top when we change this policy. For big changes, we will also tell you by email.