Privacy Policy
Last updated: May 10, 2026
Graviton.tools (a DC Color brand) builds workflow tools for post-production professionals. We take your privacy seriously and have written this policy in plain English. Here's exactly what we collect, why we collect it, and what we do — and don't do — with it.
The short version: We collect the minimum data necessary to run our products. We don't sell your data. We don't share it with third parties except the infrastructure providers listed below. Desktop apps and browser extensions store everything locally on your machine — we never see it. Our SaaS product (Scope) stores data server-side, with sensitive fields encrypted at rest.
1. Who We Are
Graviton.tools is a brand operated by DC Color, based in the United States. When this policy says "we," "us," or "our," it means DC Color / Graviton.tools. Questions about this policy can be directed to privacy@graviton.tools.
2. Our Products and Their Data Models
Different Graviton products handle data very differently. Here's what each one does:
Scope — SaaS Web Application
Scope is our only product that stores data on our servers. It collects and stores the following to provide its service:
- Account data: Email address, user ID, organization affiliations, and account preferences such as theme and branding settings
- Business data you create: Proposals, project scopes, client information, scheduling data, library items, tags, and signature records
- Client data you input: Names, email addresses, and company details of clients you create proposals for
- Branding assets: Logo files you upload and display preferences
- Operational data: Audit logs, document state changes, email send records, and signature confirmations
Sensitive fields are encrypted at the application level using AES-256-GCM. All data is transmitted over HTTPS/TLS. Row-level security ensures users can only access their own data.
GradeShare — Desktop Application
GradeShare is local-first by design. All of your data is stored exclusively on your computer in the app's local application support directory and is never transmitted to Graviton.tools, Blackmagic Design, or any third party. This includes:
- Connection settings for your local DaVinci Resolve instance
- Album selections, layouts, contact sheets, and export presets you create
- Cached thumbnails and exported stills generated during a session
- Color science settings, platform preferences, and UI state
GradeShare communicates with DaVinci Resolve exclusively through Blackmagic Design's official local scripting API — entirely on your machine. Nothing about your projects, timelines, stills, or grades is sent over the network.
GradeShare makes network requests in only two situations: (1) License validation (paid users only) — GradeShare sends your license key and a machine identifier to our license server to confirm validity. We do not receive your Resolve project data, stills, PowerGrades, or any other content during this process. Trial installations do not trigger license calls. (2) Update checks — GradeShare may periodically check for new versions. This request returns version metadata only and includes no information about your projects or usage.
Exported images are written to the destination folder you specify and are never uploaded by GradeShare. If you uninstall the app, all local data is removed with it.
Scaffold — Desktop Application
Scaffold is local-first by design. All of your data is stored exclusively on your computer — either in the app's local application support directory or inside the project folders you create on disk. This includes:
- Project templates, folder chunks, and naming patterns
- Project records, lifecycle state, and folder trees Scaffold has created on disk
- Inventory scan results, MediaInfo metadata, and DCP/IMF package detection results
- Branding assets you upload (logos, custom intro text) for PDF reports
- NLE integration settings, including DaVinci Resolve connection profiles
- App preferences, UI state, and settings
Files Scaffold writes for you — project folders, PDF reports, ZIP archives, and NLE projects — are written to the locations you specify and are never uploaded. Project folders and reports you've created remain on disk if you uninstall Scaffold — they belong to you. We have no copy of any of this data on any server.
Scaffold communicates with DaVinci Resolve through Blackmagic Design's official local scripting API, and generates Premiere Pro project files directly on disk. If you configure Scaffold to connect to a Resolve instance on another machine in your facility, that communication occurs over your local network only — not the public internet.
Scaffold makes network requests in only two situations: (1) License validation (paid users only) — a license key and machine identifier sent to our license server to confirm validity. No project data, folder structures, or inventory results are transmitted. Trial installations do not trigger license calls. (2) Update checks — version metadata only, no project or usage information.
Scaffold — Optional AI Descriptions
Scaffold has an opt-in feature that uses the Anthropic API to generate descriptions for folders and files during inventory scans. This feature is off by default and requires explicit confirmation — including a cost confirmation — every time it is used. When enabled:
- Folder and file names and basic metadata (type, codec) are sent to the Anthropic API using your own API key, which you provide in Settings
- Scaffold does not send the contents of your media files
- Requests go directly from your machine to the Anthropic API — Graviton.tools does not proxy, log, or retain these requests
- Anthropic's handling of API requests is governed by their own privacy and data usage policies
If you do not enable this feature, Scaffold makes no calls to the Anthropic API whatsoever.
Catch — Browser Extension
Catch is local-first by design. All of your data — links, clients, projects, notes, status, retention settings — is stored exclusively in your browser using Chrome's storage.local API. It lives on your device and is never transmitted to Graviton.tools, Google, or any third party. This includes:
- The URLs you save
- Client and project names you create
- Descriptions, notes, or labels you add
- Visited / downloaded status, expiry dates, and retention preferences
- CSV exports you generate (written to your local Downloads folder, never uploaded)
Catch makes network requests in only two situations: (1) Link status checks — when verifying a link is still active, your browser fetches that URL directly from the file-hosting service. This request goes from your computer to that third party and does not pass through any Graviton.tools server. (2) License validation (Pro users only) — Catch sends your license key and a randomly generated machine identifier to our license server to confirm validity. We do not receive your saved links, clients, or any other content during this process. Free users do not trigger any license validation calls.
Permissions Catch requests and why:
- storage — to save your data locally in your browser
- activeTab — so you can save the URL of the current tab when you click the icon
- contextMenus — to let you right-click a link on any page and save it
- alarms — to schedule periodic background checks for expiring links
- host_permissions (<all_urls>) — required to ping URLs you've saved to verify they're still active. Catch does not read page content, monitor your browsing, or track which sites you visit
3. Waitlist & Contact Forms
When you sign up for product notifications or contact us, we collect your first name, last name, and email address. This information is used only to send you product updates you've requested, or to respond to your support question. It is never shared with third parties or used for advertising. Waitlist addresses are retained until you unsubscribe or request removal.
4. Payments & Billing
All payments are processed by Paddle, our payment provider and Merchant of Record. This means Paddle — not us — handles your billing information, payment methods, and payment compliance (PCI-DSS). Your credit card number and sensitive financial details are never transmitted to or stored on our servers.
When you complete a purchase, Paddle collects your payment details and billing information according to their own privacy policy. We receive only the information needed to deliver and support your license: your email address, the product purchased, transaction reference, and country. We do not receive your full card number, CVV, or full billing address.
For refunds, billing questions, or invoice changes, contact Paddle directly. For license, support, or product questions, contact Graviton.tools.
5. Website Analytics
Graviton.tools uses Cloudflare's built-in analytics, which collects anonymized traffic data (page views, general geographic region, browser type). No cookies are set for analytics purposes. Individual users are not tracked or identified.
6. Cookies
Graviton.tools does not use advertising or tracking cookies. Cloudflare may set functional cookies for security and performance purposes. Scope may use session cookies for authentication. We do not use third-party advertising networks or tracking pixels.
7. Our Infrastructure & Sub-Processors
For Scope, we use the following services:
| Service | Purpose | Data Involved |
|---|---|---|
| Cloudflare Pages & Workers | Hosting and backend API | Application code, request routing |
| Neon (PostgreSQL) | Database | All structured application data |
| Cloudflare R2 | Object storage | Logo uploads and file assets |
| Clerk | Authentication | Email addresses, session tokens, login metadata |
| Resend | Transactional email & license delivery | Email addresses, license keys delivered on purchase |
| Paddle | Payment processing | Billing details, subscription state (Merchant of Record) |
| Monday.com | Waitlist management | Name and email from waitlist signups |
| Anthropic API | Optional AI descriptions in Scaffold | Folder/file names and basic metadata only — opt-in, your own API key, not proxied by us |
8. What We Don't Do
- We do not sell, share, or rent your data to third parties
- We do not use analytics, telemetry, or tracking inside our desktop apps or browser extensions
- We do not scan your browsing history or active tabs
- We do not read the content of pages you visit
- We do not require an account to use the free version of Catch
- We do not use your contact information for advertising
- We do not transmit anything to the Anthropic API unless you have explicitly enabled and confirmed the AI descriptions feature in Scaffold
9. Data Retention & Your Rights
You can delete your documents, clients, and branding assets at any time from within Scope. To request full account deletion, contact privacy@graviton.tools — we will remove your data from active systems within 30 days, subject to legal retention obligations such as billing records.
For Catch, you can export all data at any time via CSV export, or delete it by clearing the extension's storage in Chrome's settings or uninstalling Catch. To request deletion of your email address and license record from our systems, email privacy@graviton.tools.
For desktop apps, all data is stored locally and can be deleted by uninstalling the application.
For payment-related data (billing history, invoices), contact Paddle directly as they are the data controller for that information.
10. Children's Privacy
Our products are not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us at privacy@graviton.tools and we will delete it promptly.
11. Changes to This Policy
We may update this policy from time to time. When we do, we'll update the "Last updated" date at the top of this page. For significant changes, we'll notify active users and waitlist subscribers by email.
12. Contact
- Product, licensing, support, privacy: privacy@graviton.tools
- Billing, refunds, invoices, tax: via Paddle at paddle.net (the buyer support portal)