Privacy and security

Screen state is the most sensitive payload in this product: it is your own form fields, mid-KYC, with a customer's identifiers in them. This page states plainly what happens to them.

Identifiers are masked on the device

Before any screen frame is sent, values are scanned and replaced. This happens in the app, on the phone, before the network.

The agent is told a field is filled, empty or rejected, and what the validation message says. It is not told the number, because it does not need it to help.

The same rules run again on our side, so a value missed on the device is still caught before it reaches the model.

Add your own formats

Policy numbers, customer references, internal ids — anything with a shape we cannot know about:

import { addMaskRule } from "@graineai/inapp-react-native/mask";
 
addMaskRule(/POL-\d{6}/, "[POLICY]");
addMaskRule(/CUST\d{8}/, "[CUSTOMER_ID]");

Register these once when your app boots, not per screen. A masking rule you have to remember to apply on each screen is the rule that will be missing from the screen that matters.

What is stored

• Conversations — transcripts and outcomes, in your call history, exactly as web and phone conversations are.
• Actions — which action ran, on which screen, and whether it succeeded. This is what lets you measure recovered drop-offs.
• Screen state — used to shape the conversation as it happens. It is not kept as a separate record after the conversation ends.
• Who each conversation was with — Graine stores the identifier your app sends so your team can see who each conversation was with; the memory service only ever receives a one-way key derived from it. The identifier is the one value not masked: it is what tells customers apart (What Graine keeps).
• The recent conversation — for an identified customer with memory on, their last 50 messages with each agent, so that a conversation can continue when they come back. Kept as said — the same text as the conversation's transcript in Call History — for 7 days after the latest message, and deleted with the customer's memories when they are forgotten: forgetMemory() from your app, or Forget this person in the dashboard. newConversation() lets go of one agent's conversation and keeps the memories. Nothing is kept for an anonymous customer or one who turned memory off (Conversations continue).

Values masked on the device stay masked everywhere after it. There is no unmasked copy to recover.

The publishable key in a mobile app

Treat a publishable key shipped inside an APK or IPA as public, because anyone can extract it. What bounds it today:

• Rate limits per key and per address
• Single-use, short-lived connection tickets — one per conversation, not replayable
• Your agent's own credit limits

Mobile app attestation — binding a key to your signed app via Play Integrity and App Attest — is in progress. If your risk assessment needs it before launch, raise it with us and we will sequence it with your rollout.

What the SDK never does

• Never reads the screen by itself. It reports only the fields you pass to useGraineScreen. There is no screen recording and no accessibility scraping.
• Never opens the microphone before a call starts — your start(), or the launcher's autoStart once you make it active.
• Never performs an action you did not implement and register.
• Never asks for any permission but the microphone, and asks for that only when a call starts without it. Notifications, which calls need on Android, are yours to ask for.

Data residency and compliance

Where conversations are processed depends on how Graine is deployed for you — see Deployment. For encryption, access control, audit and what Graine does and does not hold for a compliance review, see Enterprise security.

Your app and your users

Which apps may use an agent's key, whether the app must prove it is your genuine build, and whether each user must be proven are per-agent settings, report-only until you enforce them. See Secure your agent and, for the whole workspace, Secure your workspace.

Next steps