Privacy Policy

Last updated October 21, 2026

Version 2.2. Effective October 21, 2026.

The short version

  • We collect what we need to run your boards: your name, email, mobile number, date of birth and your picks.
  • We never sell your personal information, and we never share it for advertising.
  • The app has no ads and no outside scripts. Our website counts visits with Google Analytics, with Google’s advertising features switched off.
  • GridAction never handles game money.
  • You can download your data or delete your account yourself in Settings, any time.
  • Questions or requests go to privacy@gridaction.app.

Who we are

GridAction decides why and how the personal information in this policy is used. In this policy “we” means GridAction. It covers the app at app.gridaction.app, the website at gridaction.app, and the email we send and receive. GridAction is for adults 18 and older.

What we collect, why, and how long we keep it

  • Account details: Name, email, mobile number, date of birth, a hashed password. Why: To create and secure your account, confirm you are an adult, and reach you about your account. We send no marketing texts. Basis if you are in the EU or UK: Contract, and legitimate interests in keeping accounts secure. Kept: Until you delete your account.
  • Group activity: Groups you join, squares you hold, scores entered, the history of changes. Why: To run boards, show results to your group, and keep a record nobody can quietly change. Basis if you are in the EU or UK: Contract. Kept: Until you delete your account. Your squares then stay on other people’s boards as “Former member”, with nothing linking them to you.
  • Guest names: Names a commissioner adds so people without accounts can hold squares. Why: To let a commissioner run a board for people without accounts. Basis if you are in the EU or UK: Legitimate interests of the group in running its board. Kept: Until the board or group is deleted.
  • Sign-in sessions: A cookie, your IP address and browser type. Why: To keep you signed in and protect your account. Basis if you are in the EU or UK: Contract, and legitimate interests in security. Kept: A session ends 30 days after you last use it.
  • Notification settings: The push address your browser gives us. Why: To send the alerts you turn on. Basis if you are in the EU or UK: Your consent, which you give by turning alerts on. Kept: Until you turn them off or delete your account.
  • Announcement list: The email address, and the name if you give one, of people who ask to receive our announcements. We do not add you because you made an account. Why: To email you about GridAction, such as beta invitations and news. Every email has an unsubscribe link. Basis if you are in the EU or UK: Your consent, which you give by asking to join and can withdraw at any time. Kept: Until you unsubscribe.
  • Support messages: Your message, the page you were on, your browser type, an email if you give one, our replies with a reference number. Why: To answer you and keep our promise to reply. Basis if you are in the EU or UK: Legitimate interests, and contract if you are a user. Kept: 24 months after the request is closed. If you were signed in, it is also deleted with your account.
  • Invitations: Your personal invite link, and whose link a new person used. Why: To credit the person who invited them. You see how many joined, never who. Basis if you are in the EU or UK: Legitimate interests. Kept: Until you delete your account.
  • Usage events: Which screens and features are used, a random visit id, an account reference that means nothing outside our systems. No names, emails, phone numbers or board titles. Why: To see which features people use and to fix problems. Basis if you are in the EU or UK: Legitimate interests. Kept: 24 months, and detached from you at once if you delete your account.
  • Website visits: Page address, the page you came from, browser and device type, approximate location, a random visitor id, what you click and play, and Google Analytics cookies (named _ga and _ga_ followed by a code, up to 2 years). Why: To see which pages work. Basis if you are in the EU or UK: Your consent where the law asks for it. For visitors from the EU, the UK and Switzerland, no Google Analytics cookies are set unless they agree. Until then, Google receives only a limited signal without cookies (such as your browser type, screen size and IP address, which Google says it does not store or log), which it uses to estimate overall traffic. Kept: Google keeps this for the period set in our account, no more than 14 months.
  • Photos of paper boards: A photo you choose to import. Why: To read the names and numbers off it. Basis if you are in the EU or UK: Contract. Kept: We do not keep the photo after it is read.
  • Technical logs: Page requested, time, result, sometimes your IP address. Why: To fix faults and defend against attacks. Basis if you are in the EU or UK: Legitimate interests. Kept: No more than 30 days.

What we do not collect or do

  • We do not collect card or bank details for any board. GridAction never accepts, holds or pays out game money. A thank you tip on Ko-fi is handled by Ko-fi.
  • We show no ads, build no advertising profiles, and do not sell or share personal information for advertising, as California and other states use those words.
  • We do not use your information or your photos to train AI models.
  • We do not knowingly collect information from anyone under 18. If we learn an account belongs to someone under 18, we delete it.

Who we share it with

We share information only with the companies that help us run GridAction, and only what each one needs. We also disclose information when the law requires it or to protect someone’s safety. If GridAction is ever sold or merged, we will tell you first and this policy will keep applying.

  • IONOS: Hosts our website and domain. It can see: Website visits.
  • Our own servers, and a rented server (RackNerd) that relays traffic to them: Run the app. It can see: Everything in the app, in transit and at rest.
  • Resend: Sends our email, such as password resets. It can see: Your email address and the message.
  • Sequenzy: Sends our announcement email, such as beta invitations, and keeps the list of people who receive it. It can see: The email address, and the name if you give one, of each person on that list.
  • Proton: Runs our support mailboxes. It can see: Messages you send us.
  • Google: Counts website visits with Google Analytics, and receives anonymous app usage counts. It can see: The visit details listed above, never your name, email, phone or date of birth.
  • An AI text-reading service (Google or Anthropic): Reads a photo you choose to import. It can see: That photo only.
  • Backblaze: Stores encrypted backup copies. It can see: Encrypted files it cannot read.
  • Browser push services (Apple, Google, Mozilla, Microsoft): Deliver alerts you turn on. It can see: Your push address and the alert text.
  • Ko-fi: Takes optional tips. It can see: Whatever you give it, never shared with us beyond the tip.

Where your information is processed

In the United States. If you use GridAction from the EU, the UK or Switzerland, your information is sent there so we can run the service. Write to privacy@gridaction.app if you want details of the safeguards.

Cookies and similar technologies

The app sets only the cookies it needs to keep you signed in. It also keeps small notes in your browser, such as where you put the Help button, whether you played the intro video, an invite code for 30 days, and a saved copy of the page so it opens faster. These never leave your device. The app loads nothing from outside companies. The website sets the Google Analytics cookies described above and no advertising cookies. You can block cookies in your browser, or install Google’s opt-out add-on at https://tools.google.com/dlpage/gaoptout.

Backups

We keep backup copies so we can recover from a disaster. They are kept 30 days on our own servers and 90 days in encrypted off-site storage. When you delete your account, your information leaves our live systems at once and leaves our backups as they expire, which takes up to 90 days. We only restore from a backup to recover from a disaster, and if we do, we delete your information again before the service returns to normal.

Your rights and how to use them

Everyone can download their data and delete their account in Settings, and can write to privacy@gridaction.app to ask us to correct, limit or explain anything.

If you are in the EU, the UK or Switzerland, you also have the right to access, correct, erase, restrict and object to our use of your information, to take it with you, to withdraw consent at any time, and to complain to your local data protection authority.

If you live in California or another US state with a privacy law, you have the right to know what we collect and why, to delete it, to correct it, to opt out of its sale or sharing (we do neither), and to be treated the same whether or not you use these rights. We use your sign-in details only to sign you in, so there is nothing to limit. You can use an authorized agent.

How we handle a request. Use Settings if you are signed in, or write to privacy@gridaction.app from the email on your account so we can check it is you. We answer within 30 days and tell you if the law lets us take longer.

Global Privacy Control. If your browser sends this signal, we treat it as a request to opt out of sale and sharing. We do neither, so nothing changes for you, and we will keep honoring it if that ever changes.

Security

Your connection is encrypted. Passwords are hashed, invite links are stored only as hashes, backups are encrypted, and board history is append-only so it cannot be quietly changed. Only a small number of our own staff can open the admin tools, and each time one looks at your phone number or date of birth, or changes an account, it is written to a log nobody can edit. No system is perfectly secure. If a breach affects you, we will tell you without undue delay and as the law requires.

Automated tools

Photo import uses an AI text-reading service to turn a photo into names and numbers. A commissioner reviews every square before anything is saved, and no decision about you is made by a machine alone.

Changes to this policy

Every version is dated and listed below. For a change that matters, we email account holders and show a notice in the app at least 30 days before it takes effect, unless the law or your security needs it sooner. Earlier versions are available on request.

  • Version 2.2, October 21, 2026. Added the announcement list to what we collect: who is on it, why, and that you can unsubscribe at any time.
  • Version 2.1, October 21, 2026. Added Sequenzy, which sends our announcement email, to the list of providers.
  • Version 2.0, October 20, 2026. Rewritten. New: a plain summary, a table of what we collect with how long we keep it, the list of providers, backups, regional rights, Global Privacy Control, security and change commitments.
  • Version 1.1, October 15, 2026. Added how we count website visits with Google Analytics.
  • Version 1.0, October 1, 2026. First version.

Contact

Privacy questions and requests go to privacy@gridaction.app. General help goes to support@gridaction.app.