1. Information we collect
Information you give us
- Account information. When you create an account with an email address we collect your email, a username, and a password (stored only as a one-way hash). You may also set a display name.
- Sign in with Google. If you sign in with Google we receive your email address, your Google account identifier, and the name on your Google account.
- Sign in with Apple. If you sign in with Apple we receive your Apple account identifier and an email address. If you choose Apple's "Hide My Email" option, the address we receive is a private relay address that forwards to you; we do not receive your real email.
- Venue guest play. When you join a Gridzy game night at a bar or venue without creating a full account, we collect the display name you enter and, optionally, an email address used to contact you about a prize claim. Guest play is tied to your device (see "Device identifier" below).
- Gameplay. The boards you build, the picks on them, your tiebreaker answers, the contests you enter, your scores and results, and your leaderboard placement. Friends-mode groups also store group names, membership, and invite codes.
- Prize delivery details. Cash prizes are credited to your in-app balance automatically. When you ask us to pay out a balance, we may ask for the information needed to deliver it, such as a payment-app handle or contact details, and — for prizes at or above the IRS reporting threshold — tax information (see the Official Rules).
- Prize claim verification. When you claim a prize we ask for your legal name and your date of birth, and you confirm three things: that you meet the minimum age, that you are a legal resident of the United States, and that you are the account holder. We keep your answers, and when you gave them, with the prize record.
- Support messages. Anything you send us by email, including venue inquiry forms submitted through our website.
- Email choices. Whether you turned the NFL Gauntlet emails on or off, when, and where (in Account, when a board went in, or from a stop link), and which of those emails we sent you and when.
Information collected automatically
- Device identifier. The first time you visit, the app generates a random identifier and stores it in your browser's local storage. That identifier is sent with each request to our servers so we can understand how visitors move from landing page to first pick to sign-up, detect abuse, and (for venue guest play) recognize your device on return visits. It is not derived from your hardware and does not identify you by name until you create an account on that device.
- IP address and approximate location. We record the IP address of each request and, at sign-up and periodically while you use the Service, derive an approximate location (country, state/region, city, and an approximate latitude/ longitude) from it using a geolocation database that runs on our own servers. We use this for eligibility and state-of-residence compliance, fraud and multi-account detection, and security review. We do not use GPS or request your device's precise location.
- Device and browser information. Your browser's user-agent string (used to classify device type, operating system, and browser) and language preference.
- Usage events. Page and module views, picks made, sign-in prompts shown and sign-in attempts, board shuffles and rewinds during board building, and board submissions. Some of these events are recorded even before you sign in, keyed to the device identifier.
- Sign-in history. Sign-ups, sign-ins, failed sign-in attempts, and password resets, with the IP address and device identifier involved, for account security.
- Marketing attribution. The referring page, campaign parameters in the link you arrived from (for example a venue QR code), and the first page you landed on.
- Error reports. If something breaks in the app, the error message, the page you were on, and technical details are sent to us so we can fix it.
- Balances and transactions. An in-app ledger of credits, prizes, and any other balance changes on your account.
We do not collect payment card numbers or bank account numbers. Prizes are tracked as balances and transactions inside the Service; when a payment processor is introduced for deposits or withdrawals, this policy will be updated before that processor collects any payment information.
2. How we use information
- To create and secure your account and let you sign in.
- To run contests: build and score boards, rank leaderboards, determine winners, and deliver prizes.
- To verify eligibility and comply with the law, including confirming that you are playing from a location where the Service is permitted and detecting multiple accounts held by one person.
- To check a prize claim before we pay or ship it: to confirm that you meet the minimum age to win (18, or 19 in Alabama and Nebraska and 21 in Mississippi), that the account holder is the winner, to compare the claim with claims made on other accounts, and to read the country and state you signed up from.
- To prevent fraud, abuse, automation, and cheating, and to investigate suspected violations of our Terms.
- To understand how the Service is used and improve it, including analyzing the sign-up funnel by device.
- To send you service messages such as password-reset links, and to show prize results and balance changes in the app.
- Only if you turn it on: to send you the NFL Gauntlet emails. Two emails a week at most: Thursday when the week opens, Monday when it settles. Every one has a "Stop these emails" link (section 8).
- To respond to your questions and support requests.
- To meet tax, accounting, and record-keeping obligations.
We do not sell your personal information and we do not use it for third-party advertising.
5. How long we keep information
- Account and gameplay data is kept for as long as your account exists, and afterward as needed to resolve disputes, enforce our agreements, and keep accurate contest records.
- Usage events (page and module views, picks, sign-in prompts, board shuffles and rewinds, submissions) are deleted automatically after 90 days, whether tied to a device identifier or a signed-in account.
- Error reports are deleted automatically after 30 days.
- Sign-in history, balance, and transaction records are kept for as long as needed for security review and for tax and accounting purposes.
- Contest results and winner records are retained as required by law, including for any prize-tax reporting.
- Prize claim details (your legal name, date of birth and the three confirmations) are kept with the prize record for as long as we need to show the prize went to an eligible winner and for tax and accounting purposes.
6. Security
Passwords are stored only as salted one-way hashes. Data moves between your browser and our servers over encrypted connections. Access to production data is limited to staff who need it to operate the Service. Account sign-in is rate-limited and temporarily locked after repeated failures. No system is perfectly secure, and we cannot guarantee that unauthorized access will never occur; if we learn of a breach affecting your information we will notify you as required by law.
7. Age and children
The Service is for adults. You must be at least 18 years old to create an account or enter a contest, and venues may require a higher minimum age. We do not knowingly collect personal information from anyone under 13. If we learn that we have collected personal information from a child under 13, we will delete it. If you believe a child has provided us information, contact us at [email protected].
8. Your choices and rights
- Review and update. You can view and change your username and display name in your profile. For anything else, email us.
- Delete. You can delete your account yourself at any time from Profile → Danger Zone (type DELETE to confirm; accounts with a password must also enter it). Deletion takes effect immediately: your email address, name, sign-in credentials, IP and location history, device identifier, and sign-up attribution are removed, your username is replaced with an anonymous placeholder everywhere it appears (leaderboards, group rosters, prize records), and you can no longer sign in. Records we must keep — contest results, prize and balance records, and sign-in security logs — are retained in that anonymized form only as long as required. The legal name and date of birth on your prize claims, and the name on a prize’s delivery address, are removed too; the prize record itself (what was won, when, and what was paid) stays in that anonymized form. If you cannot sign in, email us from the address on your account and we will process the deletion within 30 days.
- Access and portability. You can ask for a copy of the personal information we hold about you.
- Email. We send service messages (password-reset links and replies to your support requests), and — only if you turn them on — the NFL Gauntlet emails. Two emails a week at most: Thursday when the week opens, Monday when it settles. Turn them on or off any time in Account → Notifications. Each of these emails has a "Stop these emails" link; it opens a page that asks "Stop these emails?" and stops them when you tap its button. Your mail app's own Unsubscribe button, where it shows one, stops them too. Neither needs a sign-in. Each one also carries our postal address. We send no other marketing email.
- Device identifier. Clearing your browser's site data for gridzysports.com removes the device identifier; a new one is generated on your next visit.
State privacy rights. Residents of California and certain other states may have additional rights under state law, including the right to know what personal information we collect and how it is used and shared, the right to request deletion, and the right not to be discriminated against for exercising these rights. California's "Shine the Light" law also lets California residents ask what personal information we shared with third parties for their direct marketing; we do not share personal information for that purpose. To exercise any of these rights, email [email protected] from the address on your account. We will verify your identity before acting on a request, and you may designate an authorized agent to make a request on your behalf.
9. Where data is processed
The Service is operated from the United States and is intended for U.S. residents. Your information is stored and processed in the United States.
10. Changes to this Policy
We may update this Policy from time to time. When we do, we will change the "Last updated" date at the top of this page. If a change materially affects how we use your personal information, we will also notify you in the app or by email to the address on your account before the change takes effect. Your continued use of the Service after a change takes effect means you accept the updated Policy.
October 15, 2026: a prize claim now asks for your legal name and date of birth (sections 1, 2, 3, 5 and 8). Section 1 no longer mentions entry fees: every contest is free to enter.
October 10, 2026: sections 2 and 8 now describe the NFL Gauntlet emails the way the emails do: Thursday when the week opens, Monday when it settles, and a "Stop these emails" link that asks you to confirm.
October 7, 2026: added prize sponsors: with your consent when you claim, a sponsor's prize goes to the sponsor with your delivery details (section 3).
October 5, 2026: added the NFL Gauntlet emails, which are off unless you turn them on (sections 1, 2, 3 and 8).
11. Contact us
Wrad Games LLC d/b/a Gridzy Sports
[email protected]