How we handle your data
The short version
Gridwork ("we", "us") operates thegridwork.space and a suite of open-source MCP servers. We collect the minimum data needed to run the site and improve it. We don't run ads, build user profiles, or sell your data.
What we collect
We use Google Analytics 4 (property G-D1FDEDCKZ5) to understand aggregate usage of the website. When you accept analytics cookies, Google Analytics may collect:
- Page views, session duration, and referring URLs
- Approximate location derived from IP (with IP anonymization enabled)
- Device, browser, and operating system details
- A client-side cookie identifier (
_ga) for session continuity
If you reject analytics or your browser sends a Global Privacy Control signal, no analytics cookies are set and no measurement data is sent.
We do not collect names, email addresses, account data, or payment information through this website. If you email us at [email protected], we retain that correspondence to reply to you.
MCP servers and CLI tools
Our open-source MCP servers (siteaudit-mcp, aiact-mcp, privacy-mcp, license-mcp, wiki-mcp) run locally on your machine. They don't phone home. We have no telemetry, no remote logging, and no way to observe what you scan. Source is on GitHub.
Cookies
We set analytics cookies (_ga, _ga_*) only after you click "Accept" on the consent banner. These expire after 2 years. We also store your consent choice in your browser's localStorage under gw-consent so we don't show the banner again.
We don't use advertising cookies, retargeting pixels, or social-media trackers.
Your choices
GDPR rights (EU/UK visitors)
Under GDPR, you have the right to access, correct, delete, restrict, or port personal data we hold about you, and to object to processing. Our lawful basis for analytics is your consent (Article 6(1)(a)), which you can withdraw at any time via the controls above.
Data controller: Gridwork. Contact: [email protected].
Google Analytics data is processed by Google Ireland Limited and may be transferred to the United States. Google participates in the EU-US Data Privacy Framework, which serves as the transfer mechanism.
You can lodge a complaint with your local supervisory authority if you believe we've mishandled your data.
CCPA/CPRA rights (California residents)
Under CCPA/CPRA, you have the right to know what personal information we collect, to delete it, to correct it, and to opt out of "sale" or "sharing" of personal information.
We do not sell personal information. We do share limited analytics identifiers with Google to operate Google Analytics; depending on interpretation, this may be considered "sharing" under CPRA. You can opt out at any time by clicking Reject analytics above or by enabling Global Privacy Control in your browser — we honor GPC automatically.
To exercise any CCPA right, email [email protected]. We will not discriminate against you for exercising your rights.
Hosting and subprocessors
- Cloudflare Pages — static hosting. Cloudflare may process request metadata (IP, user agent) for security and delivery. See Cloudflare's privacy policy.
- Google Analytics — web analytics. See Google's privacy policy.
- Google Fonts — we self-load JetBrains Mono from fonts.googleapis.com. Google receives your IP when the font loads.
Data retention
Google Analytics data is retained for 14 months (the minimum allowed), after which it is automatically deleted. Email correspondence is retained as long as it is needed to service your inquiry, then deleted.
Children
This site is not directed at children under 16, and we do not knowingly collect data from children. If you believe a child has provided us data, contact us and we'll delete it.
Changes
We'll update this page when our practices change. The "Last updated" date at the top reflects the most recent revision. Material changes will also be noted in our GitHub activity.
Contact
Questions or requests: [email protected].