Privacy and data
Gravity runs on your own computer. Your code, your AI logins and your full plans stay there. Gravity Cloud keeps only what the control room needs, and only after you pair a device or make an account.
Gravity is offered by Nils Groove. Contact: hello@gravitycontrol.app. Last updated 31 October 2026.
Your account
- Your email address and name, to sign you in to the control room.
- Your passkeys: only the public key, never the private key.
- Your devices: the device records in the table below.
- Gravity Pro payments run on Stripe Checkout. Stripe receives your email address and card details as our payment processor; Gravity never sees the card.
- Sign-in links are sent by email through our mail provider, Resend. It receives your email address and the link, only to deliver it.
- Sign-in with Google or GitHub gives Gravity only your name, email address and profile picture. Gravity gets no other access to those accounts.
We do not sell or rent your data, and we do not use it for ads.
Never collected
- Source code, diffs or files from your projects.
- AI logins, tokens, API keys or credential files (see the login policy).
- Prompts, agent replies, terminal output or full plan files.
- Error messages, file paths or host names (error reports are codes and counts only).
On your device
| File | What |
|---|---|
~/.gravity/config.toml | Your projects, their folders and plan files. |
~/.gravity/cloud.json | Only when paired: the device token (file mode 0600), your choices (item text, adds, error reports). |
~/.gravity/holds.json | Paused projects. |
In Gravity Cloud (only after gravity pair)
| Table | What it holds | How long |
|---|---|---|
devices | Device name, your account, a SHA-256 hash of the device token (never the token), last seen, Gravity version, plan usage percent, OS family and Node version, the GitHub owners you allow for adds, the last add result. | Until you remove the device. |
pair_requests | Hashes of the pairing codes, device name, the IP address that asked, state. | Deleted after the 10 minute expiry. |
status | Per project: name, plan file name and line, the next item (secrets removed, at most 140 characters; off with
gravity pair --no-item-text), blocker count, state, last progress time, open owner decisions (secrets removed, at most 200 characters). | Replaced on each change; removed with the device. |
events | Project name, kind and time of each status change. | The newest 500 per device. |
commands | Your pause, resume, answers and adds, until the device collects them. | Until the device confirms them. |
error_reports | Only with gravity pair --error-reports: error codes and counts per day. | 30 days. |
failures | Failed code entries by account and IP address, for the lock that stops guessing. | 15 minutes. |
user | Only with a control room account: your email address, name, sign-up time and, with Google or GitHub sign-in, your profile picture link. | Until you ask for the account to be removed. |
session | Sign-in sessions: a random session token, the IP address and browser name at sign-in. | 30 days, or until you sign out. |
account | The sign-in method linked to your account (email link or passkey), no password. | Until the account is removed. |
verification | The one-time code of an email sign-in link. | 10 minutes. |
passkey | The public key of each passkey you add (never the private key), its name and device type. | Until you remove the passkey or the account. |
rateLimit | Request counts per IP address and route, to stop abuse. | 1 minute windows. |
billing | Only with Gravity Pro: the Stripe customer and subscription IDs, the subscription state, plan and renewal date. No card data: Stripe holds the card. | Until the account is removed. |
auth_sends | A hash of the email address and the IP address of each sign-in link sent, for the limit of 5 links per hour. | 1 hour. |
Remove a device on the Devices page: its token stops working at once and its rows in
devices, status, events, commands and error_reports are deleted.
gravity unpair deletes the token on the device.
Where it runs
Gravity Cloud is a Cloudflare Worker with a Cloudflare D1 database. Cloudflare processes requests as our hosting provider. Worker request logging is off. The control room signs you in with your account; the owner pages use Cloudflare Access.
Delete your data
Write to hello@gravitycontrol.app from your account email. We delete your account, sessions, passkeys and devices within 30 days and confirm by email. You can remove a device yourself at any time, as above.
See also the terms.