Privacy

GrantWindow is a directory of Australian government grant programs.Reading it takes nothing from you: every program has a page you can read with no account, no sign in and no personal details, and that is the page a search engine sees too.

Exact closing dates, live countdowns and the funders' full eligibility wording sit behind a free account, and an account means we hold some information about you. This page says exactly what, where it lives and how to get rid of it. It was rewritten on 27 August 2026 when accounts were introduced, because a privacy policy describing a version of the site that no longer exists is worse than no privacy policy at all.

What we collect

Your account, if you create one. An email address and a password. The password is never stored: what we keep is a salted PBKDF2-SHA256 hash of it, which cannot be turned back into your password, so we could not tell you what it is and neither could anybody who obtained the file. Alongside those we store the date you signed up, the date your Pro trial ends, the page you were on when you signed up, and the two-letter country your connection came from. We do not store your IP address.

A session cookie, once you are signed in. One cookie, named gw_s. It is how the site knows it is you on the next page, and it is the only cookie this site sets. It isHttpOnly (no script on the page can read it),Secure (it never travels over plain HTTP) andSameSite=Lax (another website cannot make your browser send it). It holds your address, your tier and when your trial ends, signed so it cannot be altered. It lasts thirty days, and signing out removes it.

The grants you ask to watch. Which programs you want to be reminded about, so we can send the reminder. That is the whole purpose of it and it is used for nothing else.

Your email address, if you give it to us without an account.The deadline alert form and the pricing-page registration both accept an address on its own. We store the address, the page you were on, and the date, and use them to send only what you asked for.

Payment details: we never see them. If you subscribe, the checkout is hosted by Stripe and your card number is entered on Stripe's page, not ours. We never receive it, never store it and could not retrieve it. What comes back to us is that a payment succeeded, the email address on it, the amount, and Stripe's own reference ids so a human can reconcile a query. Stripe's handling of your card is governed by Stripe's privacy policy.

Anonymous, aggregated traffic statistics. Which pages were viewed, roughly which country, and whether the device was a phone or a desktop. We use it to see which parts of the catalogue are worth expanding. No advertising profile is built from it and it is not sold or shared.

What we never do

• We never sell, rent or trade your email address or anything else about you.
• We never pass it to a funder, a grant writer, a consultant or any other third party.
• We never send you anything you did not ask for. No newsletter, no partner offers.
• We run no advertising on this site and set no advertising cookies.
• We never build a profile of you for targeting, here or anywhere else.
• We never see, store or have access to your card details.

Cookies

One cookie, and only if you sign in. Thegw_s session cookie described above. It is strictly necessary for signing in: without it, signing in cannot work at all.

No advertising cookies and no cross-site tracking cookies are set by this site, signed in or not. Reading the catalogue without an account sets no cookie whatsoever, which is why you have never seen a consent banner here. The alert form on its own sets no cookie either.

Where the data is held

Accounts, watched grants and alert signups are stored in Cloudflare Workers KV and are not copied into any other system. Subscription records are held by Stripe, who are the payment processor. The pages themselves are static files served from Cloudflare's network. There is no other database and no other company involved.

Cloudflare and Stripe both operate infrastructure outside Australia, so your address may be stored or processed overseas. Both are bound by their own data protection commitments, linked from their sites.

Getting your data out, and getting rid of it

Unsubscribing. Every alert email carries a one-click unsubscribe, which stops all alerts to that address immediately and removes the watch records behind them.

Deleting an account. There is no self-service delete button yet, and rather than imply one exists: email us from the address on the account and we will delete it, by hand, within one business day, with no questions asked and nothing retained. That includes the address, the password hash and every grant you were watching. A self-service control is being built and this paragraph will change the day it lands.

Asking what we hold. Write to us and we will tell you everything stored against your address, in plain text, at no cost.

Cancelling a subscription is separate from deleting an account: email us and we will cancel it through Stripe. Cancelling stops future payments and leaves your free account intact.

The grant data itself

The program information on this site is public information published by Australian governments, collected from official sources under the licences listed on the sources page. It contains no personal information about you and nothing you do on this site is added to it.

Contact

Privacy questions, corrections, a copy of what we hold, or a request to delete an account or an email address: admin@momentumlab.ai. We answer these ourselves; there is no support queue.

Published by MomentumLab AI Pty Ltd, Australia, and governed by Australian law, including the Privacy Act 1988. Last updated 27 August 2026.