Legal
Privacy
What we collect, why, who else handles it, and how to have it deleted. In short: we collect what we need to run your carry and reply to you, we don't track you, and we don't sell anything.
Last updated: October 28, 2026
Graft ("Graft", "we") runs graftfork.com and the Graft service. Graft is provided by Civqo, Inc., which is responsible for the personal data described here.
What we collect, and why
| Where | What we store | Why |
|---|---|---|
| Free report form | Your email, your fork, its upstream, the release you want, your notes, and the country your request came from as reported by our host (not your IP address) | To run your report and reply to you |
| Personal plan waitlist | Your email, and the project and notes if you give them | To email you once when the plan opens |
| Feedback form | Your rating and note, the carry it's about, and your email if you give it | To improve the service and answer you |
| Your report page | The choices you make on it, and when | To carry your fork the way you chose |
| Sign-in | Your email, a fingerprint (hash) of each one-time sign-in link, and a fingerprint of your session | To show you your carries without a password |
| Payments | From Stripe: your email, the amount, the event (paid, refunded, disputed, failed), and the details the checkout asks for: name, business, fork URL and target release | To start your delivery and keep billing records |
| Email to support@graftfork.com | Your message, in our email inbox | To answer you |
| Your code | A read-only clone of your fork while we work on it | To run the carry. See security |
We use this information only for the purposes above. We don't sell it, rent it or use it for advertising, and we don't send marketing email.
Cookies and tracking
The public pages set no cookies and run no analytics, advertising or tracking scripts. Fonts are served from graftfork.com itself, so loading a page doesn't contact any other company.
If you sign in to see your carries, we set one cookie, graft_session, which keeps you signed in for up to 30 days. It is required for sign-in and is used for nothing else. Signing out deletes it.
Who else handles your data
- Cloudflare hosts the website and its database (Cloudflare Workers and D1), and routes email sent to support@graftfork.com. Like any host, it processes request details such as IP addresses to serve and protect the site, and keeps short-lived request logs.
- Google provides the email inbox that support@graftfork.com forwards to (Gmail).
- Stripe processes payments on its own hosted checkout. We never see or store your card number.
- Anthropic runs the AI agents that rewrite conflicting files. For each conflict, the agents receive the versions of that file and the rest of the change. They receive no contact details.
- Your git host, such as GitHub, when we clone your fork.
How long we keep it
- Your code: the clone, working trees and build output are deleted within 30 days of delivery or of a refund, or within 30 days of your free report if you don't go ahead.
- Requests, reports and payment records: kept as long as required for tax and accounting.
- Decisions and feedback: kept with the report they belong to, so we can carry your next release and answer questions. Ask and we'll delete them sooner.
- Waitlist: kept until the personal plan opens and we've emailed you, or until you ask us to remove you.
- Sign-in links expire after 30 minutes and work once. Sessions expire after 30 days.
Your choices
Email support@graftfork.com to see what we hold about you, correct it, or have it deleted. We'll answer within 30 days, usually much sooner. If we have to keep something, such as a payment record required by law, we'll tell you what and why.
Security
The site is served over HTTPS. Report pages use long random links. The operator console requires a secret token. See security for how we handle code.
Children
Graft is a service for software teams and isn't directed at children.
Changes
If we change this policy, we'll update the date at the top. If a change affects how we use data we already hold, we'll email the people it affects first.
Contact
Civqo, Inc.
Carmichael, California
United States
support@graftfork.com