Privacy policy

What is recorded

Gridge stores the following on your computer. Secrets — database passwords, values such as a proxy password written after the ? in a MongoDB connection string (see below), SSH passwords and key passphrases, and DynamoDB secret access keys and session tokens — and the SQL text and failure reasons in the audit log are encrypted with Windows Data Protection (DPAPI). Where that encryption is unavailable, none of them is saved (and the audit log is not kept at all). Everything else is stored unencrypted.

• Every connection: its name, the database type and the safety mode. Of the type-specific fields and secrets, only those used by the connection’s current database type and authentication method are saved; if you switch either while editing, values you entered for the previous one are not kept.
• PostgreSQL, MySQL and Oracle: host, port, database name (service name for Oracle), user name and password (encrypted).
• SQLite: the location of the database file.
• MongoDB: the connection string, the database name and the password (encrypted). A password written after the user name in the connection string (the user:password@ part) is taken out of the string when saving and stored, encrypted, as the password. Of the values written after the ? in the connection string, the proxy password, the client certificate key and its passphrase, and the AWS session token are replaced with *** in the string when saving, and their values are stored separately, encrypted (only the option names stay in the string). Any other values after the ? are stored unencrypted as part of the string.
• DynamoDB: region, endpoint, how credentials are obtained, the name of the named profile, the access key ID, and the secret access key and session token (both encrypted). With the default credential chain or a named profile, the AWS SDK reads the credentials from ~/.aws and similar sources when connecting; Gridge does not save them. For temporary credentials such as SSO, however, the AWS SDK may refresh its cached copy inside ~/.aws when it is about to expire.
• BigQuery: the project, location, default dataset and the location of the service account key file. The credentials themselves (a service account key, or Google Cloud Application Default Credentials) are only read when connecting; Gridge never saves them.
• SSH bastion: host, port, user name, authentication method, the location of the private key file, and the SSH password and key passphrase (both encrypted). The private key itself is only read when connecting; Gridge never saves it. If you choose “Connect and save to known_hosts” when asked to confirm a host key, the bastion’s host name, port and host key (a public key) are appended to known_hosts.
• Audit log (with the paid features enabled; the history of the SQL you ran): the SQL text (encrypted), when it ran, the connection name, the database type, the safety mode, the number of statements, whether it succeeded, why it failed (the error message from the database or its driver, or the reason Gridge stopped the statement or could not read it; encrypted), how long it took, and the number of rows affected.
• Saved queries (a paid feature): each query’s name and SQL text, when it was created and last updated, and the parameter values that were filled in when you pressed “Remember values”.
• Licence (with the paid features enabled): your licence key, the verified token issued for this device, when it was last successfully checked, and why the most recent check failed or was refused, if it was.

What is not recorded

Query results, table contents, usage statistics, crash reports, and advertising or analytics identifiers. None of these is ever transmitted to the developer. While you are using the free features, the history of statements is not kept either, and there is no communication with the developer at all.

Where it is kept

All of it stays on your own computer. Apart from lines appended to known_hosts and the cached credentials in ~/.aws that the AWS SDK may refresh, everything is kept in the data folder that Windows sets aside for the app (inside %LOCALAPPDATA%\Packages\tanmen.Gridge_qmmtnwj0zq866\). When you uninstall Gridge, Windows deletes that folder entirely, leaving nothing behind except the lines appended to known_hosts (and, if the .ssh folder or known_hosts did not exist before, the folder and file Gridge created) and the cached credentials in ~/.aws. known_hosts is .ssh\known_hosts in your user folder, a file shared with the ssh command and other tools; Gridge never removes the lines it appended, so delete them yourself when you no longer need them. The cached credentials in ~/.aws are shared with the AWS CLI and other tools.

Network

Gridge talks to the database servers you configure (for BigQuery, that means Google’s BigQuery API and the Google authorisation server that issues access tokens), the services that issue the credentials for connecting to them (described below), the bastion hosts you configure and, only once you enable the paid features, to the licence server (license.tanmen.work, operated by the developer). A licence check sends just two things: your licence key and a device identifier (a 32-character hash of the Windows MachineGuid mixed with a value specific to Gridge; the raw value is never sent and the hash cannot be matched against other services). It is sent when you enter the key, one minute after start-up, and every 24 hours after that. Host names, user names, connection targets and SQL are never sent. The server keeps the key–identifier pair with the times it was first and last seen; devices not seen for 30 days no longer count, and “Release this device” in the app removes the entry immediately. Without a network nothing is sent, and the paid features keep working for 14 days after the last successful check. There is no update check. Purchases open a page in your default browser, so card details never pass through Gridge. Gridge also communicates to obtain the credentials it uses to connect to your database. For DynamoDB with the default credential chain or a named profile, the AWS SDK contacts AWS IAM Identity Center (SSO), AWS STS and AWS sign-in as your ~/.aws configuration and environment variables require, and when running on EC2, ECS or similar it receives credentials from the metadata endpoint that the platform provides (such as 169.254.169.254). For BigQuery without a service account key, Google Cloud Application Default Credentials are used. In both cases, if no credentials are found elsewhere, a connection to that metadata endpoint is attempted to check whether Gridge is running in the cloud.

Third parties

The connection settings, SQL and query results that Gridge handles are never sent to the developer, so the developer never provides them to third parties. Information the developer holds in order to sell and verify licences — the email address your licence key is sent to, your plan and its status, and the Stripe payment identifiers — is handled as set out in the tanmen.work privacy policy below.

Contact

Questions about this policy can go through the form on the Gridge support page. What you enter into that form is handled as set out in the tanmen.work privacy policy below.

https://tanmen.work/en/supports/gridge/

Anything this policy does not cover

What is collected through the contact form, the information the developer holds in order to sell and verify licences, how long each is kept, and requests for disclosure, correction or deletion are handled the same way across tanmen.work, as set out in the privacy policy below. Where the two differ, this policy governs for Gridge.

https://tanmen.work/en/legal/privacy/