Last updated: 7 September 2026
The short version. Grid asks for an email address so you can sign in, and a username so friends can find you. It records how you did on each daily puzzle. That's it. There are no analytics, no advertising, no trackers, and no third-party SDKs of any kind. Nothing about you is sold or shared with advertisers, ever.
This policy explains how Grid ("we", "the app") handles personal data when you use the Grid daily puzzle app and website. It applies to the app on the web, installed to a home screen, and distributed through an app store.
The data controller is [YOUR NAME OR COMPANY]. You can reach us at [YOUR CONTACT EMAIL].
Only what the app needs to work. Nothing is collected for advertising or profiling.
| Data | Why | When |
|---|---|---|
| Email address | To send your sign-in link and identify your account. We do not email you anything else — no newsletters, no marketing. | Only if you choose to create an account |
| Username and display name | So friends can find you and so leaderboards can show who is who. Visible to other players you are connected with. | Chosen by you after sign-in |
| Puzzle results | Your total time, per-game splits, the date, board size, and per-game counters (hints used, mistakes, moves, resets). This is your streak, your stats and your leaderboard entry. | Each time you finish a run |
| Preferences | Theme, light/dark, colourblind mode, sound, avatar emoji and colour, so your settings follow you to another device. | When you change a setting |
| Friend connections and invites | Who you are connected to, and invite links you have created, so friend leaderboards work. | When you add a friend or make an invite |
| Badges and streaks | Derived from your results, to show your progress. | Calculated from the above |
Grid keeps a copy of the above in your browser's local storage so it works offline and so a run is never lost to a dropped connection. If you play without an account, this device copy is the only copy — nothing is sent anywhere. Clearing your browser data deletes it permanently, and if you have no account there is no way to get it back.
We do not use your data to build advertising profiles, and we do not make automated decisions that have legal or similarly significant effects on you.
Friends you are connected with can see your username, avatar, and your daily and best times. They cannot see your email address. Anyone signed in can look up a username to send a friend request — that is how adding a friend works — but they cannot see your results unless you accept.
We use Supabase to host the database and handle sign-in emails. They process data on our instructions as a processor, and store it on cloud infrastructure. See supabase.com/privacy.
We do not sell personal data, we do not share it with advertisers or data brokers, and we do not disclose it to anyone else except where we are legally required to.
Our database is hosted in the United States (US West, Oregon). If you use Grid from another country, your data is transferred there. Where that involves a transfer out of the UK or EEA, it is covered by the safeguards our provider offers, including Standard Contractual Clauses.
Finished daily results cannot be individually deleted while your account is open — that is what makes "one run a day" mean something. You can always delete the whole account, which removes them all.
You can ask us to:
Email [YOUR CONTACT EMAIL] and we will respond within 30 days. If you are in the UK or EEA and are unhappy with our response, you can complain to your national data protection authority.
You can delete your Grid account and all data associated with it at any time, from Profile → Delete account in the app. This is immediate and cannot be undone: your results, streak, badges and friend connections are all removed.
Grid is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child has given us personal data, email us and we will delete it.
Sign-in uses emailed one-time links, so there is no password to leak. All traffic is encrypted in transit over HTTPS. Access to the database is restricted per-user at the database level, so one player's account cannot read another's data. No system is perfectly secure, but we do not hold payment details or passwords, which limits what a breach could expose.
If we change this policy we will update the date at the top. If the change is significant, we will tell you in the app before it takes effect.
[YOUR CONTACT EMAIL]