Privacy Policy

Last updated: October 16, 2026

Grabient is a website at grabient.com for making, finding and exporting color palettes. It is a personal project, and the person who runs it is responsible for the personal information described here. In this policy, "Grabient," "we" and "us" mean that person.

This policy covers the website, its API and MCP server, and the emails it sends.

You can use Grabient without an account. If you make one, we keep:

• Your email address: the one you sign in with. If you sign in with Google, also the name and profile picture on your Google account. We never receive your Google password.
• Your profile: a username and avatar, if you add them in Settings.
• Your language: the language you read Grabient in, so we can write to you in it.
• Your newsletter choice: whether you get the newsletter, and when and where you changed that, each time.
• What you save: your saved palettes, your collections, and your votes on palettes and searches.
• Sign-in records: one for each browser you are signed in on, with the browser's name and operating system.
• Apps you connect: the AI apps you allow to use your account through the MCP server, and what you allowed them to do.
• How you found Grabient: if marketing was on when you made your account, the site or campaign link that brought you.

We also receive:

• Messages: what you send through the contact form, and your email address if you give it.
• Request data: like every website, we receive your IP address and browser details with each request. We use them to answer the request, protect the site, limit abuse and choose the right privacy defaults for your region. We don't keep your IP address with your account.
• Searches: the words you search for. Words our search doesn't recognize may be sent to Cloudflare Workers AI to be interpreted, without your IP address or account. We count searches, including words our search doesn't recognize yet, without recording who made them.
• How palettes are used: when you open, copy or download a palette the site shows publicly, we count it with where it was found and how it was drawn, without recording who did it. A change you make in the editor before you take a palette is kept only as numbers describing how its colors moved.
• Error logs: when something fails on our side or in your browser, a record of what went wrong.

Two optional tools run only when they are on (section 6):

• Analytics: the pages you visit, actions such as saving a palette, and your browser, device and approximate location, collected by Google Analytics through Cloudflare. We never send it your name or email address. With Marketing on, while you're signed in, it also gets an identifier made from your account, so your visits on every device count as one person's.
• Session replay: recordings of how pages are used, such as clicks and scrolling, with all text and typing hidden, stored by PostHog. Recordings are not linked to your account.

Preferences such as your theme and key bindings stay in your browser's storage and are not sent to us.

• Saving a palette adds it to the public gallery, where anyone can see it and how many times it has been saved. Your name and account are not shown with it.
• Your profile, collections, votes and list of saved palettes are visible only to you.
• An app you connect can see your name and username, and see and change your saved palettes and collections, until you disconnect it on the MCP page. Its own privacy policy covers what it does with them.

We use personal information to run Grabient: to sign you in, keep what you save, send sign-in and account emails, answer messages, keep the site secure and working, rank the gallery by how often palettes are saved, choose the palettes and collections we make next from what people save, search for and use without looking at who did it, and, when analytics is on, understand how the site is used so we can improve it. We don't sell personal information, share it for targeted advertising, or show ads.

When you have an account, we also send you a newsletter about new palettes and features, about once a month. Since this policy took effect, an account made where the law asks for your consent first, such as in the EEA, the UK and Switzerland, starts without it and gets it once you turn it on in Settings. Accounts made before then keep getting it, wherever they are. You can stop it at any time with the unsubscribe link in every issue or in Settings, and it stops at once.

If you are in the EEA, the UK, Switzerland or another place whose law asks us to name a legal basis, ours are:

• Contract: your account, what you save and the emails that come with them.
• Legitimate interests in running a secure, working website: request data, error logs, messages, search, counting how palettes are used, and ranking. Where analytics, marketing or the newsletter starts on (sections 4 and 6), also in learning how the site is used so we can improve it, and in telling the people who use Grabient what is new. You can turn these off at any time.
• Consent: session replay, and analytics, marketing and the newsletter where they start off. You can withdraw it at any time in Settings.
• Legal obligation: when the law requires us to keep or disclose information.

We share personal information only with the services that run Grabient for us:

• Cloudflare hosts the site and its data, protects it from attacks, interprets searches, loads analytics, sends our sign-in and account emails and delivers contact form messages. Cloudflare's privacy policy
• Google provides sign-in with Google and, when analytics is on, Google Analytics. Google's privacy policy
• PostHog stores session recordings, only when session replay is on. PostHog's privacy policy
• Resend sends the newsletter, so it receives the email address of each account that gets it. Resend's privacy policy

We may also disclose information when the law requires it or to protect someone's safety. If Grabient is transferred to someone else, this information goes with it, and this policy still applies to it.

Grabient uses the cookies and browser storage it needs to work: to keep you signed in, remember your language and privacy choices, and help Cloudflare protect the site from abuse. These are always on. Analytics, marketing and session replay add their own, only while they are on.

Where the law asks us to, we ask or tell you about these choices when you first arrive. You can change them at any time in Settings, under Privacy & consent:

• Where the law asks for your consent first, such as in the EEA and the UK, and when we can't tell where you are, analytics and marketing are off until you turn them on.
• In Switzerland, analytics is on from your first visit, so we can improve the site, and marketing is off until you turn it on.
• Everywhere else, analytics and marketing are on. You can turn them off at any time.
• Session replay is off everywhere until you turn it on.
• Global Privacy Control and Do Not Track: a browser that sends either starts with all three off, wherever it is, and marketing and session replay never run in it.

Your choices apply to the browser you make them in. Your browser can also block or delete cookies, though blocking the ones Grabient needs signs you out.

• Your account and what you save: until you delete them or your account.
• Sign-in records: until you sign out, or they expire after a period without use.
• Connected apps: until you disconnect the app or delete your account, or a year after the app last used it.
• Your newsletter choice: until you delete your account.
• Logs and other records the site keeps to run: 90 days at most.
• Analytics and recordings: deleted automatically by Google and PostHog, within 14 months at most.
• Messages: as long as we need them to answer you and follow up.
• Backups: deleted information can remain in database backups for up to 30 days.

You can delete your account at any time in Settings. That deletes your account and everything saved with it. Palettes you saved stay in the public gallery, with nothing linking them to you.

Wherever you live, you can ask us for a copy of your information in a portable format, or ask us to correct or delete it. If you are in the EEA, the UK, Switzerland or another place whose law gives you these rights, you can also object to or restrict how we use it, withdraw your consent at any time, and complain to your data protection authority.

To make a request or a complaint, contact us (section 13). We may ask you to confirm it from the email address on your account. We answer within a month. If we can't do what you ask, we say why, and you can appeal by replying. Using your rights never changes the service you get.

We protect your information with measures such as encrypted connections and single-use sign-in links and codes. No system is perfectly secure. If a breach affects your information, we will tell you as the law requires.

Our service providers process information in the United States and other countries. Where the law requires it, information from the EEA, the UK and Switzerland is transferred under safeguards such as the EU-US Data Privacy Framework or standard contractual clauses.

Grabient is not meant for children under 13. You must be at least 13 to make an account, or older where your country's law requires. If you believe a child has given us personal information, contact us and we will delete it.

When we change this policy, we post the new version here with a new date. If a change is significant, we also say so on the site.

For anything about this policy or your information, email hello@grabient.com or use the contact form. Both reach the person in charge of protecting personal information at Grabient.