Privacy policy

Effective 2026-10-01. MicroGraphs is built and operated by Wondefield Works LLC, a California limited liability company ("we"). This policy says what we collect when you use MicroGraphs, why, who else touches it, how long we keep it, and what you can ask of us. It covers the MicroGraphs console at console.micrographs.dev, its documentation, and the applications we run under micrographs.dev (for example AI Help). Questions and requests: privacy@micrographs.dev. The terms of service are the agreement for using the service.

What we collect

Your account. A username or email address and a password, which we store only as a salted hash. If you sign in with Google or GitHub, we receive from the provider your account identifier, the email address the provider has verified, and your display name, and we keep those three things to recognize you next time. We never receive your provider password, and we ask the provider for nothing beyond your identity and verified email (Google: openid, email, profile; GitHub: read:user, user:email). You can unlink a provider from your Settings page at any time. Users of an application also have an email address, a name, a role and the invitation that brought them in.

Sessions and cookies. A session token in your browser keeps you signed in: the console keeps it in browser storage and in a cookie scoped to the documentation, an application keeps it in a cookie of its own host. A sign-in with a provider sets a short-lived cookie that binds your browser to that sign-in. A preference or two (the sidebar's state, canvas sizes) live in your browser too. There are no advertising cookies and no third-party analytics.

What you put in. The graph data in your databases, your ontologies, files you upload or import, documents we load from the websites you name, the questions you ask the assistant and its answers (kept as conversations you can delete), API keys you bring (an Anthropic or Voyage AI key, the credentials of a database you route to), and feedback you send us. Keys and credentials are encrypted at rest and never shown again.

Records of use. Metering of what your databases and organizations use (requests, rows, tokens, storage), an audit log of account actions (who did what, when), and operational logs with IP addresses, request paths and errors.

Why we use it

To run the service you signed up for; to keep it secure (sessions, rate limits, the audit log); to meter usage and bill it; to answer your support requests; and to understand, in aggregate, how the service is used. We do not sell personal data, we do not use it for advertising, and we do not use your content to train models.

The assistant and other AI features

When you use the assistant, the modeling agent, research jobs or "ask the docs", the prompt you write and the data you select are sent to Anthropic's API to produce the answer; with web access on, Anthropic performs the web searches. When semantic search is enabled, text is sent to Voyage AI to compute embeddings. Both act under their commercial API terms. If you bring your own key, that traffic runs on your own account with the provider.

Who else processes your data

We use these providers to deliver the service, each under a data processing agreement or equivalent terms, and each only for the purpose named:

Your account, the console's records and our own processing are in the United States; a database and its backups are stored in the region you pick for it. If you are in the European Economic Area, the United Kingdom or Switzerland, processing in the United States involves a transfer of your data there, which we base on standard contractual clauses with our providers.

How long we keep it

Your account and content stay for as long as your account exists. A database or an account you delete is kept in a recoverable state for up to 30 days and then removed; backups you keep are removed with it. Conversations stay until you delete them. Operational logs are kept for a short period and then rotated. An account blocked for non-payment is removed after 90 days, with notice.

Your rights

You can see and change your account details in Settings, export your data with the export feature, delete conversations, databases and organizations yourself, and ask us at privacy@micrographs.dev to access, correct, export or delete personal data we hold about you, or to object to a use of it. Where the GDPR, the UK GDPR or the California Consumer Privacy Act apply, you have the rights they give you, and you can complain to your supervisory authority; we do not sell or share personal data in the sense of the CCPA, and we do not treat you differently for exercising a right.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Security

Everything travels over TLS. Passwords and session tokens are stored hashed; the keys and credentials you bring are encrypted at rest; every organization's data lives in its own database and every request is checked against your account and its role. If a breach affects your data, we will tell you and any authority we must, without undue delay.

Children

MicroGraphs is not directed to children under 16 and we do not knowingly collect their data.

Changes

We post changes to this page with a new effective date, and tell you by email when a change matters to you.

Contact

Wondefield Works LLC, California, United States. privacy@micrographs.dev.