Collect less. Explain what remains.

This notice applies to the Gritnox web application and its public catalog, sourcing-list, RFQ, contact and documentation surfaces. It also describes the account, seller, cart, checkout, order and support functions in the same application. It does not govern third-party websites or services linked from the application.

Do not submit special-category personal data, confidential drawings, commercial secrets, payment card details or credentials through the public demo forms.

• The sourcing list is stored in local storage so it survives a page refresh in the same browser.
• Authentication uses an HttpOnly session cookie. Browser JavaScript cannot read the session credential and no access or refresh token is written to local storage.
• A separate CSRF token is obtained from the API and sent in the X-CSRFToken header for unsafe requests. It carries no authentication privilege on its own.
• Clearing site data removes the sourcing list and local session cookies, but does not automatically delete records already submitted to the API.
• The public catalog and RFQ pages do not require third-party advertising cookies.

• To render the sourcing list and preserve quantities between visits in the same browser.
• To validate, record and return a reference for a demo RFQ or contact inquiry.
• To authenticate sessions, enforce role permissions and operate seller, cart, checkout, order and support behavior when those flows are used.
• To diagnose failures, prevent abuse and apply API rate limits.
• To understand aggregate usage only when the operator explicitly configures analytics.

The project does not sell personal data, build advertising profiles or use submitted RFQ details to generate a supplier quotation.

A deployed instance may transmit data to the infrastructure selected by its operator, including application hosting, a MongoDB database, email delivery, media storage, payment processing and analytics. Those providers process data under their own terms and security controls.

• Demo RFQ records stay within the configured application database; no supplier outreach occurs.
• Checkout may use Stripe if configured, but the Gritnox catalog and RFQ pages do not request card details.
• Public contact and RFQ endpoints are unauthenticated and rate-limited; they should not be used for sensitive disclosures.
• Data may be disclosed if required by applicable law or to protect the service from abuse.

The repository does not define an automated production retention schedule. Demo RFQ and contact records remain in the configured database until an operator deletes them. Browser sourcing-list data remains until you clear site storage.

• Clear local site data to remove the browser sourcing list.
• Avoid submitting personal or confidential information through public demo forms.
• Use the contact intake to ask for correction or deletion of a demo record; include the generated reference.
• Where local law grants access, correction, deletion, objection or portability rights, a future production operator must provide an enforceable process for them.

Because no staffed support operation is connected to this concept, deletion requests cannot be guaranteed. Open the contact intake for a documented request.

The application uses an HttpOnly session cookie, CSRF checks for unsafe requests, generic recovery responses, password policy, login throttling, role-scoped API querysets and account-wide session revocation. No internet service is completely secure, and this concept has not completed an independent security audit. Use the demo with non-sensitive, illustrative information.

This notice is versioned with the product documentation and may change as the application evolves. Material changes should be reflected on the changelog and in this page's effective date. Continued use after a change does not override rights provided by applicable law.