Gantt Forge is operated by Kannan Subramanian ("we"). Contact: codingkansvce@gmail.com.
The app runs entirely in your browser. Your projects, settings and backups are stored in your browser's local storage on your own device. Backups, exports and sync files can be encrypted with a password you choose (AES-256-GCM, key derived with PBKDF2-SHA-256 at 600,000 iterations); the password never leaves your device and we cannot recover it. (Version 1.16 also encrypted the storage itself; from 1.17 it does not, and a 1.16 workspace is decrypted into normal storage the first time it is opened.) The app makes no network requests to us or to any third party: no accounts, no analytics, no crash reporting, no fonts or scripts from content delivery networks. The only network activity is loading the app itself from this website (or your own copy) and, if you choose to configure them yourself, a linked brand-source URL (downloaded, nothing sent) or a Gantt Forge+ server, where project contents and names are encrypted on your device first. Connections must use HTTPS. Backups and sync files written to a linked folder are always encrypted; files you export as PowerPoint, PDF, Excel, Word, CSV, images or share links are not, and the app says so when you create them. Webhooks, the AI assistant and online speech recognition were removed in version 1.18 so that nothing readable is sent to other services.
This is enforced by your browser, not only promised. The app sets a Content-Security-Policy that lets it contact only its own files and servers you have approved on that device. Approving one asks you first; you can see and remove approved servers in the app under Help → "Your data stays here". Images, fonts and media can only come from the app itself, so an imported file cannot load anything from elsewhere. Shared read-only links are opened in a sandbox with no scripts. One exception the app cannot control: voice input (🎤) in Chrome and Edge sends the spoken audio to the browser maker's speech service, so the app asks before using it unless the browser can recognise speech on the device.
Because the data is on your device, you are responsible for backing it up (Quick Export → Full backup) and clearing it (your browser's site-data settings or the app's Settings → Data).
The website is static. It sets no cookies, uses no analytics or tracking pixels, and embeds nothing from third parties. Our hosting provider may keep standard server access logs (IP address, requested page, time, browser type) for security and operations; we do not use them to identify you.
If you sign in to a Gantt Forge+ server — ours or one your organisation hosts — the server processes:
Retention. Sessions expire after 90 days of inactivity and can be ended at any time from the app ("Devices & team"). Sign-in codes expire after 10 minutes. Project data remains until you delete it or your account. On request we delete your account and all associated data.
Sub-processors. Sign-in emails are sent through a transactional email provider (currently Resend or Postmark, depending on the server's configuration), which receives your email address and the code. The hosted service runs on servers we rent from a hosting provider. Self-hosted servers are operated by whoever runs them; this policy describes the software's behaviour, and the operator is responsible for their own notices.
Legal basis (where applicable). Providing the service you asked for (contract); keeping it secure (legitimate interest).
You can export everything you have (the app does this locally without our involvement), end sessions, leave a team, and ask us to delete your account. Depending on where you live you may have further rights (access, correction, portability, objection, complaint to a supervisory authority); email us and we will honour them.
The service is not directed at children under 16 and we do not knowingly collect their data.
We will post changes here with a new effective date. Material changes to Gantt Forge+ will also be announced in the app's version log.
This policy and any dispute about it are governed by the laws of New Zealand. We comply with the New Zealand Privacy Act 2020; you may complain to the Office of the Privacy Commissioner (privacy.org.nz) if you are not satisfied with our response.