Last updated: 7 September 2026
The short version. Grid asks for an email address so you can sign in, and a username so friends can find you. It records how you did on each daily puzzle. That's it. There are no analytics, no advertising, no trackers, and no third-party SDKs of any kind. One company other than us touches your data — Supabase, who host the database and send the sign-in emails. Nothing about you is sold or shared with advertisers, ever.
This policy explains how Grid ("we", "the app") handles personal data when you use the Grid daily puzzle app and website. It applies to the app on the web, installed to a home screen, and distributed through an app store.
The data controller is Nicolas Toledo. You can reach us at yourfivefeedback@gmail.com.
Only what the app needs to work. Nothing is collected for advertising or profiling.
| Data | Why | When |
|---|---|---|
| Email address | To send your sign-in link and identify your account. We do not email you anything else — no newsletters, no marketing. | Only if you choose to create an account |
| Username and display name | So friends can find you and so leaderboards can show who is who. Visible to other players you are connected with. | Chosen by you after sign-in |
| Puzzle results | Your total time, per-game splits, the date, board size, and per-game counters (hints used, mistakes, moves, resets). This is your streak, your stats and your leaderboard entry. | Each time you finish a run |
| Preferences | Theme, light/dark, colourblind mode, sound, avatar emoji and colour, so your settings follow you to another device. | When you change a setting |
| Friend connections and invites | Who you are connected to, and invite links you have created, so friend leaderboards work. | When you add a friend or make an invite |
| Badges and streaks | Derived from your results, to show your progress. | Calculated from the above |
| Technical log data | Our hosting provider records the IP address, timestamp and request details of calls to the server, as any web server does. Used to keep the service running and to detect abuse, never to profile you. | Whenever the app talks to the server |
Grid keeps a copy of the above in your browser's local storage so it works offline and so a run is never lost to a dropped connection. If you play without an account, this device copy is the only copy — nothing is sent anywhere. Clearing your browser data deletes it permanently, and if you have no account there is no way to get it back.
We do not use your data to build advertising profiles, and we do not make automated decisions that have legal or similarly significant effects on you.
Friends you are connected with can see your username, avatar, and your daily and best times. They cannot see your email address. Anyone signed in can look up a username to send a friend request — that is how adding a friend works — but they cannot see your results unless you accept.
We use Supabase to host the database and handle sign-in emails. They process data on our instructions as a processor, and store it on cloud infrastructure. See supabase.com/privacy.
Choosing Sign in with Apple means Apple confirms your identity to us and passes on an identifier and an email address — which is a relay address that forwards to you, if you chose to hide your real one. We receive nothing else, and Apple is not told anything about how you play. See apple.com/legal/privacy.
We do not sell personal data, we do not share it with advertisers or data brokers, and we do not disclose it to anyone else except where we are legally required to.
Our database is hosted in the United States (US West, Oregon). If you use Grid from another country, your data is transferred there. Where that involves a transfer out of the UK or EEA, it is covered by the safeguards our provider offers, including Standard Contractual Clauses.
Finished daily results cannot be individually deleted while your account is open — that is what makes "one run a day" mean something. You can always delete the whole account, which removes them all.
You can ask us to:
Email yourfivefeedback@gmail.com and we will respond within 30 days. If you are in the UK or EEA and are unhappy with our response, you can complain to your national data protection authority.
You can delete your Grid account and all data associated with it at any time, from Profile → Delete account in the app. This is immediate and cannot be undone: your results, streak, badges and friend connections are all removed.
Grid is not directed at children under 13, and we do not knowingly collect data from them. Some countries set a higher age for consenting to online services without a parent — in parts of the EU it is 16 — and where that applies, that age governs. If you believe a child has given us personal data, email us and we will delete it.
You have the right to know what personal information we collect, to have it deleted, to correct it, and not to be discriminated against for exercising those rights. The list in section 2 is the complete set of what we collect. We do not sell personal information and we do not share it for cross-context behavioural advertising, and we have not done so in the past twelve months. Use the same contact address above to make a request.
You sign in with an email address and a password, or with Apple. Passwords are stored only as a one-way hash computed by our authentication provider, so a copy of the database does not reveal anyone's password. Signing in with Apple means we never receive a password at all. All traffic is encrypted in transit over HTTPS. Access to the database is restricted per-user at the database level, so one player's account cannot read another's data. No system is perfectly secure, but we do not hold payment details, and we do not hold passwords in a form anyone could read, which limits what a breach could expose.
If we change this policy we will update the date at the top. If the change is significant, we will tell you in the app before it takes effect.