Privacy

GrantWindow is a directory of Australian grant programs, from the Commonwealth, states and local councils to foundations and industry bodies, and reading it takes nothing from you. Grant pages are free to open, with no account, no sign in and no personal details.

Exact closing dates, application links, live countdowns and the funders' full eligibility wording sit behind a trial or a subscription. Keeping those dates right means re-checking every funder's own page night after night, and the subscription is what pays for that work. An account means we hold some information about you. This page says exactly what we hold, where it is stored, and how to ask us to delete your account and everything on it.

01What we collect

Your account, if you create one. An email address and a password. The password itself is never stored: what we keep is a salted PBKDF2-SHA256 hash of it, which cannot be turned back into your password. Alongside it we store the date you signed up, the date your trial ends, the page you were on when you signed up, and the two-letter country your connection came from. We do not store your IP address.

A session cookie, once you are signed in. One cookie, named gw_s, and the only cookie this site sets for its own machinery. The analytics cookies described under Cookies below belong to Google Analytics, not to the sign-in. It is how the site knows it is you on the next page. It holds your address, your tier and when your trial ends, signed so it cannot be altered. It lasts thirty days, and signing out removes it.

HttpOnly

No script on the page can read the cookie.

Secure

The cookie never travels over plain HTTP.

SameSite=Lax

Another website cannot make your browser send the cookie.

The grants you ask to watch. Which programs you want to be reminded about, so we can send the reminder. That list is used for nothing else.

Your email address, if you give it without an account. The deadline alert form and the pricing page both accept an address on its own. We store the address, the page you were on and the date, and use them to send only what you asked for.

Payment details: we never see them. If you subscribe, the checkout is hosted by Stripe and your card number is entered on Stripe's page, not ours. We never receive it, never store it and could not retrieve it. What comes back to us is that a payment succeeded, the email address on it, the amount, and Stripe's own reference ids so a human can reconcile a query. Stripe's handling of your card is governed by Stripe's privacy policy.

Anonymous, aggregated traffic statistics. Measured with Google Analytics 4, measurement id G-6JHG1TZGFW: which pages were viewed, roughly which country, and whether the device was a phone or a desktop. We use these figures to see which parts of the catalogue are worth expanding. No advertising profile is built from them, they are not sold or shared, and you can block the tool entirely with Google's own opt-out while the site works identically.

02What we never do

• We never sell, rent or trade your email address or anything else about you.
• We never pass your address to a funder, a grant writer, a consultant or any other third party.
• We never send you anything you did not ask for. No newsletter, no partner offers.
• We run no advertising on this site and set no advertising cookies.
• We never build a profile of you for targeting, here or anywhere else.
• We never see, store or have access to your card details.

03Cookies

One cookie, and only if you sign in. The gw_s session cookie described above. It is strictly necessary for signing in: without it, signing in cannot work at all.

Analytics cookies, from Google. Google Analytics sets its _ga cookies to tell one visit from the next in aggregate. They identify a browser, not a person, they are described in Google's cookie notice, and blocking them changes nothing about how the site works.

No advertising cookies and no cross-site tracking cookies are set by this site, signed in or not, and the alert form on its own sets none either.

04Where your data is held

Accounts, watched grants and alert signups are stored in Cloudflare Workers KV and are not copied into any other system. Subscription records are held by Stripe, who are the payment processor. The pages themselves are static files served from Cloudflare's network. There is no other database and no other company involved.

Cloudflare and Stripe both operate infrastructure outside Australia, so your address may be stored or processed overseas. Both are bound by their own data protection commitments, linked from their sites.

05Getting your data out, and deleting your account

Unsubscribing. Every alert email carries a one-click unsubscribe, which stops all alerts to that address immediately and removes the watch records behind them.

Deleting an account. Email us from the address on the account. We delete it by hand within one business day, with no questions asked and nothing retained: the address, the password hash and every grant you were watching.

Asking what we hold. Write to us and we will tell you everything stored against your address, in plain text, at no cost.

Cancelling a subscription is a separate thing from deleting an account: email us and we will cancel it through Stripe. Cancelling stops future payments and leaves the account itself intact, with your address and your watched grants still on it.

06The grant data itself

The program information on this site is public information published by the funders themselves, from governments and councils to foundations and industry bodies, collected under the licences listed on the attribution notices on our about page. That information contains no personal information about you, and nothing you do on this site is added to it.

07Contact

Privacy questions, corrections, a copy of what we hold, or a request to delete an account or an email address: admin@momentumlab.ai. A person answers these, and there is no support queue in front of them.

Published by MomentumLab AI Pty Ltd, Australia, and governed by Australian law, including the Privacy Act 1988. Last updated 27 August 2026.