Trust, privacy & AI
Last updated 25 September 2026.
The short version. The eligibility check does its matching on your device. The installed app also sends your answers once to our server, so the server decides which programme names your plan unlocks; they are used for that one reply and not stored. We hold an account email if you sign in, an optional document vault we cannot read, and a small anonymous usage log. We do not sell data. The one AI feature is paid, opt-in, and none of it is used to train any model.
What we hold
An account row — your email, country and locale — if you sign in; there is no password, because sign-in is a six-digit code emailed to you. If you subscribe, our payment processor holds your card details and we keep only a subscription status. If your organisation uses the grants workspace, its companies, pipeline and notes are stored as one document per account so it syncs between a laptop and a team. If you subscribe to deadline alerts, we hold your email, the jurisdictions you asked about, and a confirm/unsubscribe token. If you use the document vault, see below. None of it is shared with advertisers, and none of it is for sale. When you ask for a sign-in code we record the email, the time and the IP address it was requested from, to stop abuse, and we keep a log of sign-ins. If your organisation files an application through us, the filing keeps a consent record of exactly what was affirmed, when, and from which IP address and browser.
The analytics beacon
The site sends one small, anonymous event when you reach a named step — "reached the results screen", "started checkout". Each event carries the step's name, a random id your browser keeps for that tab only (it is gone the moment you close the tab, and a new visit gets a new one), the locale you are reading in, whether you are on the web, the installed app or the phone app, and — only in the flows that ask which country you are checking — the two-letter code for that country. That is the entire payload. There is no cookie behind it, no IP address is kept against it, no page content or free-text field is sent, and there is no third-party analytics or advertising script anywhere on this site.
The eligibility check runs on your device
Whichever check you run — for a household or for a company — the matching itself happens in your browser or in the app, against a dataset already downloaded to your device; the code is public at src/engine/matcher.js and src/engine/startup.js. The website's checks send none of your answers anywhere while you answer. Answers reach our server in three cases only, each used for that one reply and never stored: the installed app sends your household answers to /api/check when it shows your results, so the server — not your device — decides which programme names your plan unlocks; a subscriber who asks us to prepare company application packs sends that company's answers; and an AI assistant using our MCP server sends whatever answers you give it.
The document vault
A file you keep in the vault is encrypted on your own device before anything is uploaded, under a key derived from your own passphrase. What reaches our server is ciphertext, a document type, a size and two dates — never a filename, a note, or a readable file. We cannot decrypt it, and nor can anyone with full access to the database.
Who else touches this
Stripe processes payments; we never see or store your card number. Resend sends transactional and alert email on our behalf — where it is not configured on a deployment, email-dependent features such as deadline alerts turn themselves off rather than pretend to work. Cloudflare hosts the site, the Worker and the database, so the requests described above pass through it. Stripe and Resend never receive your eligibility answers. We do not sell personal data to anyone, and there is no category of data we would sell.
Artificial intelligence
One feature calls a language model: drafting a grant application document, on the paid Enterprise plan only, only when someone in your workspace explicitly asks for a specific programme's document, and only after that programme's eligibility check has already passed. The request sends that programme's published rules and the fields from your own profile the document needs — never your whole dataset — to Anthropic's Claude API, with instructions never to state an amount or fact it was not given. We do not train any model on your data: there is no training pipeline, logging pipeline or fine-tuning job anywhere in this codebase, and each call is a single stateless request. The MCP server at /mcp works the same idea in reverse, so an AI assistant you already use can ask this site questions. Apart from report_issue, which only records a data-quality report you ask it to file, every tool it exposes is read-only — it can look up programmes, coverage, and, for a signed-in caller, their own entitlement — and none of them can sign you in, spend money, or submit an application on your behalf.
Your rights
Under the GDPR and equivalent laws you can ask for a copy of your data, correct it, or have it deleted — including your email, subscription record, vault ciphertext and any workspace document tied to your account. Write to privacy@unclaimedgrant.com and we will respond within 30 days.
See also: Privacy · Spot a grant scam · Accessibility · /mcp