Security and privacy
Where your data lives, how it is protected, and what is never collected. The full statement is the privacy notice; the contractual terms are the terms of use.
Where data lives
- Without an account: in your browser's storage and, if you choose a folder, in files on your device. Nothing about the project reaches our servers.
- With a cloud workspace: also on our servers in Toronto, Ontario, Canada, on infrastructure provided by Akamai (Linode), shared only with the members of the workspace.
- Payments (when paid plans begin): card details are held by Stripe, not by us.
How it is protected
- TLS on every connection, with certificates renewed automatically.
- Passwords stored only as salted hashes with a modern key-derivation function (scrypt).
- Session cookies marked HttpOnly and Secure, expiring after 30 days or at sign-out.
- Role-based access to workspaces: owners manage members and billing; members read and change projects.
- Firewalled servers with administrative access limited to named people over SSH keys.
- Regular backups; deleted content falls out of backups within 30 days.
- Rate limits on sign-in, the contact form and the assistant.
What is never collected
- No telemetry about how you use the applications, no tracking pixels, no advertising identifiers, no fingerprinting.
- No analytics or advertising cookies. The only cookie is the session.
- Your content is never sold, never shared with advertisers or data brokers, and never used to train models that serve other customers.
The assistant
When you ask the assistant a question, the conversation and a summary of the open project or estimate go to the model provider through our server. The key stays on the server. Nothing is sent until you ask. The provider processes the request to answer it; the content is not used to train models offered to others.
Your rights
You can see, correct, export and delete your information. Every project and table exports at any time. Write to hello@pgrdelta.com from your account's address; we answer within 30 days. The notice is written to meet Canada's PIPEDA and to be clear to users elsewhere.
Enterprise deployments
For owners with their own requirements we offer a private deployment or dedicated hosting, single sign-on, audit support, and a connector to the finance system with an audit trail. Talk to us.