# GRAM Privacy Policy

**Version: 2026-05-13**
**Effective date: May 13, 2026**

## The short version

- **We don't sell your data. We don't share it for marketing or advertising. We don't have it to sell.**
- **There are no GRAM servers, no GRAM accounts, no telemetry, no analytics, no crash reporting, no licensing phone-home.**
- **Diagnostic reports stay on your USB drive.** Nothing about your activity is uploaded to us.
- **AI features send your prompt content to Anthropic** for analysis. We configure our AI access to limit data retention and to exclude submitted content from training, using whichever options Anthropic provides at the time. Specifics may change as Anthropic's offerings evolve.

---

## 1. What this policy covers

This policy explains how GRAM, the portable Windows diagnostic and repair toolkit, handles data. It is published by Blue Line Scannables.

## 2. Information GRAM stores locally

GRAM writes data only to the USB drive on which it ships. Specifically:

| Location on USB | What it contains |
|-----------------|------------------|
| `reports/` | Diagnostic and security report text files for the current session |
| `recovered/` | Files recovered from the Recycle Bin, shadow copies, or raw disk scans |
| `clients/` | ZIP archives of prior client sessions (created when you click "New Client") |
| `.session-host` | A small file recording which machine the current reports belong to (for the stale-data warning) |
| `.integrity-manifest.json` | File hashes used to detect tampering of the toolkit between sessions |
| Browser `localStorage` (per machine) | Your acceptance of these terms, with timestamp and version |

None of this is transmitted to us.

## 3. Information transmitted to Anthropic

When you use any AI feature of GRAM — Claude Chat, the Ask Claude widgets attached to each report tab, the GRAM Agent, or any tool that calls Claude — the **content of your prompt** is sent over the internet to Anthropic. That content can include:

- Hostname, OS version, hardware specifications
- Lists of running processes, services, scheduled tasks, and startup items
- Network configuration: adapter info, IP and MAC addresses, DNS, ARP, traceroute output
- Event log entries and crash dump headers
- File paths flagged by security or recovery scans
- Customer symptom notes entered in the Dashboard
- Your own questions and free-text input

Anthropic processes this content to generate a response, which GRAM then displays to you.

**Training and retention.** We configure our AI access to limit data retention and to exclude submitted content from being used to train AI models, using whichever options Anthropic makes available to its customers. The specific configuration and the available options may change over time as Anthropic's offerings evolve. For Anthropic's current data-handling terms, see <https://www.anthropic.com/legal/privacy>.

**Anthropic is the only third party** that receives any data through GRAM, and only when you use AI features.

## 4. What GRAM does not do

GRAM does not:

- Operate any backend service that receives your data
- Collect telemetry, usage analytics, or crash reports
- Track which features you use, how often you use them, or what results they produce
- Phone home for licensing, updates, or activation checks
- Embed advertising, tracking pixels, cookies, or third-party scripts
- Share data with marketers, data brokers, advertising networks, or any third party beyond Anthropic (for AI processing only)

## 5. Cookies and tracking

GRAM has no public website operated under this policy. The local web GUI runs entirely on `localhost` on the machine where the USB is plugged in. The only `localStorage` data GRAM writes is your terms acceptance flag (see section 2).

## 6. Children

GRAM is a professional IT tool and is not directed at children under 16. We do not knowingly collect data from children.

## 7. Your customers and data subjects

When you, the technician, use GRAM on a customer's machine, **you** are responsible for any obligations to that customer or to any individual whose data may be present on the machine (employees, residents of a household, patients, etc.). This may include providing notice, obtaining consent, executing a data-processing agreement, or complying with sector-specific rules. We do not have a direct relationship with your customers and cannot fulfill data-subject requests on their behalf.

## 8. Security

The diagnostic data on your USB can be sensitive — hostnames, network maps, processes, security findings, recovered files. Treat the USB like a sensitive medium: store it securely, use full-disk encryption on your work laptops, archive or wipe client data after each engagement, and rebuild the USB from a known-good source if you suspect compromise.

## 9. Changes to this policy

We may update this policy. The "Version" line at the top changes when the policy is updated. Material changes will prompt you to re-accept on next launch of GRAM.

## 10. Contact

Privacy questions or concerns: **info@bluelinescannables.com**
