Privacy Policy

Scope — SaaS Web Application

Scope is our only product that stores data on our servers. It collects and stores the following to provide its service:

Account data

Email address, user ID, industry pack selection, and account preferences such as theme, billing mode, and branding settings. Authentication is handled by Clerk using email one-time passcodes (OTP) — we do not store passwords.

Business data you create

Proposals and project scopes (including section and block content across overview, specs, schedule, fees, optional services, and terms), client information, scheduling milestones, library items, tags, optional service selections, and signature records.

Client data you input

Names, email addresses, and company details of clients you create proposals for.

Branding assets

Logo files you upload and display preferences. Logos are stored in Cloudflare R2 and served through our own proxy endpoint — direct storage URLs are never exposed.

Client-facing documents

Scopes you publish to clients are made available through unguessable URL tokens. Anyone with the link can view and optionally sign the scope; we record signature details (signer name, email, IP address, and timestamp) as part of the signed document, both to confirm the signature and to provide evidence of the act of signing.

Operational data

Audit logs (including IP addresses associated with sensitive actions), document state changes, email send records, and signature confirmations.

Sensitive fields are encrypted at the application level using AES-256-GCM. All data is transmitted over HTTPS/TLS. Row-level security ensures users can only access their own data.

GradeShare — Desktop Application

GradeShare is local-first by design. All of your project data is stored exclusively on your computer in the app's local application support directory and is never transmitted to Graviton.tools, Blackmagic Design, or any third party. This includes:

• Connection settings for your local DaVinci Resolve instance
• Album selections, layouts, contact sheets, social composites, and export presets you create
• Cached thumbnails and exported stills generated during a session (JPEG, PNG, TIFF, AVIF, HDR JPEG / JPEGR)
• Color science settings, peak-nit overrides, platform preferences, and UI state

GradeShare communicates with DaVinci Resolve exclusively through Blackmagic Design's official local scripting API, via a Python helper process bundled inside the app. All of this communication happens on your machine — nothing about your projects, timelines, stills, grades, or PowerGrades is sent over the network.

Image processing and export — including HDR JPEG (JPEGR) and AVIF generation — runs entirely on your computer using FFmpeg and libultrahdr binaries that ship inside the app. Source DPX stills and rendered exports never leave your machine as part of these operations.

GradeShare makes network requests in only three situations:

1. License activation and periodic validation (paid users only) — GradeShare sends your license key and a per-install machine identifier to our license server at license.graviton.tools to confirm validity and to enforce the per-customer machine limit. The machine identifier is a random UUID generated on first launch and stored in the app's settings file — it is not a hardware fingerprint and does not identify your computer to anyone outside our license system. We do not receive your Resolve project data, stills, PowerGrades, or any other content during this process. Trial installations do not trigger license calls.
2. Update checks — GradeShare may periodically check for new versions. This request returns version metadata only and includes no information about your projects or usage.
3. Purchases — if you buy GradeShare, the purchase flow is handled by Paddle as our Merchant of Record (see §4 below). The Paddle checkout opens in your browser, not inside the app. After purchase, your license key is delivered by email via Resend.

Exported images are written to the destination folder you specify and are never uploaded by GradeShare. If you uninstall the app, all local data is removed with it; your license record on our server is retained until you (or we) deactivate the associated machines or revoke the key — contact us if you want it deleted.

Scaffold — Desktop Application

Scaffold is local-first by design. All of your data is stored exclusively on your computer — either in the app's local application support directory or inside the project folders you create on disk. This includes:

• Project templates, folder chunks, and naming patterns
• Project records, lifecycle state, and folder trees Scaffold has created on disk
• Inventory scan results, MediaInfo metadata, and DCP/IMF package detection results
• Branding assets you upload (logos, custom intro text) for PDF reports
• NLE integration settings, including DaVinci Resolve connection profiles
• App preferences, UI state, and settings

Files Scaffold writes for you — project folders, PDF reports, ZIP archives, and NLE projects — are written to the locations you specify and are never uploaded. Project folders and reports you've created remain on disk if you uninstall Scaffold — they belong to you. We have no copy of any of this data on any server.

Scaffold communicates with DaVinci Resolve through Blackmagic Design's official local scripting API, and generates Premiere Pro project files directly on disk. If you configure Scaffold to connect to a Resolve instance on another machine in your facility, that communication occurs over your local network only — not the public internet.

Scaffold makes network requests in only two situations: (1) License validation (paid users only) — a license key and machine identifier sent to our license server to confirm validity. No project data, folder structures, or inventory results are transmitted. Trial installations do not trigger license calls. (2) Update checks — version metadata only, no project or usage information.

Scaffold — Optional AI Descriptions

Scaffold has an opt-in feature that uses the Anthropic API to generate descriptions for folders and files during inventory scans. This feature is off by default and requires explicit confirmation — including a cost confirmation — every time it is used. When enabled:

• Folder and file names and basic metadata (type, codec) are sent to the Anthropic API using your own API key, which you provide in Settings
• Scaffold does not send the contents of your media files
• Requests go directly from your machine to the Anthropic API — Graviton.tools does not proxy, log, or retain these requests
• Anthropic's handling of API requests is governed by their own privacy and data usage policies

If you do not enable this feature, Scaffold makes no calls to the Anthropic API whatsoever.

Flip — Desktop Application

Flip is a local-first video metadata editor for MOV and MP4 files. All of your data is stored exclusively on your computer — either in the app's local settings file (~/Library/Application Support/Flip/settings.json on macOS, the equivalent %APPDATA%\Flip location on Windows) or inside the video files you choose to edit. This includes:

• App preferences, UI state, and recent file history
• Saved audio configuration presets (named track layouts you create for reuse)
• Per-install machine identifier (random UUID, used only for license activation)
• License key and activation state, if you have purchased a license

The video files you edit — and any metadata, chapter markers, or audio track configurations you write to them — remain on your machine in the locations you specify. Flip never uploads, copies, or transmits the contents of your video files to any server.

All video processing — metadata reading and writing, audio peak/average level scanning, chapter marker encoding, and any other file operations — runs entirely on your computer using FFmpeg binaries that ship inside the app. The optional video preview player loads files directly from your local disk through a private in-app protocol (flip-file://) — these requests never leave your machine and are not routed through any network.

Flip makes network requests in only three situations:

1. License activation and periodic validation (paid users only) — Flip sends your license key and a per-install machine identifier to our license server at license.graviton.tools to confirm validity and to enforce the per-customer machine limit. The machine identifier is a random UUID generated on first launch and stored in the app's settings file — it is not a hardware fingerprint and does not identify your computer to anyone outside our license system. We do not receive your video files, metadata, chapter markers, or any other content during this process. Trial installations (the first 10 writes) do not trigger license calls.
2. Update checks — Flip may periodically check for new versions. This request returns version metadata only and includes no information about your files or usage.
3. Purchases — if you buy Flip, the purchase flow is handled by Paddle as our Merchant of Record (see §4 below). The Paddle checkout opens in your browser, not inside the app. After purchase, your license key is delivered by email via Resend.

If you uninstall the app, all local data (settings, presets, machine identifier) is removed with it; the video files you edited remain on your disk untouched. Your license record on our server is retained until you (or we) deactivate the associated machines or revoke the key — contact us if you want it deleted.

Catch — Browser Extension

Catch is local-first by design. All of your data — links, clients, projects, notes, status, retention settings — is stored exclusively in your browser using Chrome's storage.local API. It lives on your device and is never transmitted to Graviton.tools, Google, or any third party. This includes:

• The URLs you save
• Client and project names you create
• Descriptions, notes, or labels you add
• Visited / downloaded status, expiry dates, and retention preferences
• CSV exports you generate (written to your local Downloads folder, never uploaded)

Catch makes network requests in only one situation: Link status checks — when verifying a link is still active, your browser fetches that URL directly from the file-hosting service. This request goes from your computer to that third party and does not pass through any Graviton.tools server.

Permissions Catch requests and why:

storage

To save your data locally in your browser.

activeTab

So you can save the URL of the current tab when you click the icon.

contextMenus

To let you right-click a link on any page and save it.

alarms

To schedule periodic background checks for expiring links.

host_permissions (<all_urls>)

Required to ping URLs you've saved to verify they're still active. Catch does not read page content, monitor your browsing, or track which sites you visit.