1. Information we collect
Information you give us
- Account information. When you create an account with an email address we collect your email, a username, and a password (stored only as a one-way hash). You may also set a display name.
- Sign in with Google. If you sign in with Google we receive your email address, your Google account identifier, and the name on your Google account.
- Sign in with Apple. If you sign in with Apple we receive your Apple account identifier and an email address. If you choose Apple's "Hide My Email" option, the address we receive is a private relay address that forwards to you; we do not receive your real email.
- Venue guest play. When you join a Gridzy game night at a bar or venue without creating a full account, we collect the display name you enter and, optionally, an email address used to contact you about a prize claim. Guest play is tied to your device (see "Device identifier" below).
- Gameplay. The boards you build, the picks on them, your tiebreaker answers, the contests you enter, your scores and results, and your leaderboard placement. Friends-mode groups also store group names, membership, and invite codes.
- Prize delivery details. Cash prizes are credited to your in-app balance automatically. When you ask us to pay out a balance, we may ask for the information needed to deliver it, such as a payment-app handle or contact details, and — for prizes at or above the IRS reporting threshold — tax information (see the Official Rules).
- Support messages. Anything you send us by email, including venue inquiry forms submitted through our website.
Information collected automatically
- Device identifier. The first time you visit, the app generates a random identifier and stores it in your browser's local storage. That identifier is sent with each request to our servers so we can understand how visitors move from landing page to first pick to sign-up, detect abuse, and (for venue guest play) recognize your device on return visits. It is not derived from your hardware and does not identify you by name until you create an account on that device.
- IP address and approximate location. We record the IP address of each request and, at sign-up and periodically while you use the Service, derive an approximate location (country, state/region, city, and an approximate latitude/ longitude) from it using a geolocation database that runs on our own servers. We use this for eligibility and state-of-residence compliance, fraud and multi-account detection, and security review. We do not use GPS or request your device's precise location.
- Device and browser information. Your browser's user-agent string (used to classify device type, operating system, and browser) and language preference.
- Usage events. Page and module views, picks made, sign-in prompts shown and sign-in attempts, board shuffles and rewinds during board building, and board submissions. Some of these events are recorded even before you sign in, keyed to the device identifier.
- Sign-in history. Sign-ups, sign-ins, failed sign-in attempts, and password resets, with the IP address and device identifier involved, for account security.
- Marketing attribution. The referring page, campaign parameters in the link you arrived from (for example a venue QR code), and the first page you landed on.
- Error reports. If something breaks in the app, the error message, the page you were on, and technical details are sent to us so we can fix it.
- Balances and transactions. An in-app ledger of credits, prizes, and any other balance changes on your account.
We do not collect payment card numbers or bank account numbers. Entry fees and prizes are tracked as balances and transactions inside the Service; when a payment processor is introduced for deposits or withdrawals, this policy will be updated before that processor collects any payment information.
2. How we use information
- To create and secure your account and let you sign in.
- To run contests: build and score boards, rank leaderboards, determine winners, and deliver prizes.
- To verify eligibility and comply with the law, including confirming that you are playing from a location where the Service is permitted and detecting multiple accounts held by one person.
- To prevent fraud, abuse, automation, and cheating, and to investigate suspected violations of our Terms.
- To understand how the Service is used and improve it, including analyzing the sign-up funnel by device.
- To send you service messages such as password-reset links, and to show prize results and balance changes in the app.
- To respond to your questions and support requests.
- To meet tax, accounting, and record-keeping obligations.
We do not sell your personal information and we do not use it for third-party advertising.
5. How long we keep information
- Account and gameplay data is kept for as long as your account exists, and afterward as needed to resolve disputes, enforce our agreements, and keep accurate contest records.
- Usage events (page and module views, picks, sign-in prompts, board shuffles and rewinds, submissions) are deleted automatically after 90 days, whether tied to a device identifier or a signed-in account.
- Error reports are deleted automatically after 30 days.
- Sign-in history, balance, and transaction records are kept for as long as needed for security review and for tax and accounting purposes.
- Contest results and winner records are retained as required by law, including for any prize-tax reporting.
6. Security
Passwords are stored only as salted one-way hashes. Data moves between your browser and our servers over encrypted connections. Access to production data is limited to staff who need it to operate the Service. Account sign-in is rate-limited and temporarily locked after repeated failures. No system is perfectly secure, and we cannot guarantee that unauthorized access will never occur; if we learn of a breach affecting your information we will notify you as required by law.
7. Age and children
The Service is for adults. You must be at least 18 years old to create an account or enter a contest, and venues may require a higher minimum age. We do not knowingly collect personal information from anyone under 13. If we learn that we have collected personal information from a child under 13, we will delete it. If you believe a child has provided us information, contact us at [email protected].
8. Your choices and rights
- Review and update. You can view and change your username and display name in your profile. For anything else, email us.
- Delete. You can delete your account yourself at any time from Profile → Danger Zone (type DELETE to confirm; accounts with a password must also enter it). Deletion takes effect immediately: your email address, name, sign-in credentials, IP and location history, device identifier, and sign-up attribution are removed, your username is replaced with an anonymous placeholder everywhere it appears (leaderboards, group rosters, prize records), and you can no longer sign in. Records we must keep — contest results, prize and balance records, and sign-in security logs — are retained in that anonymized form only as long as required. If you cannot sign in, email us from the address on your account and we will process the deletion within 30 days.
- Access and portability. You can ask for a copy of the personal information we hold about you.
- Email. We send only service messages (password-reset links and replies to your support requests). We do not currently send marketing email; if we ever do, every marketing message will include a way to unsubscribe.
- Device identifier. Clearing your browser's site data for gridzysports.com removes the device identifier; a new one is generated on your next visit.
State privacy rights. Residents of California and certain other states may have additional rights under state law, including the right to know what personal information we collect and how it is used and shared, the right to request deletion, and the right not to be discriminated against for exercising these rights. California's "Shine the Light" law also lets California residents ask what personal information we shared with third parties for their direct marketing; we do not share personal information for that purpose. To exercise any of these rights, email [email protected] from the address on your account. We will verify your identity before acting on a request, and you may designate an authorized agent to make a request on your behalf.
9. Where data is processed
The Service is operated from the United States and is intended for U.S. residents. Your information is stored and processed in the United States.
10. Changes to this Policy
We may update this Policy from time to time. When we do, we will change the "Last updated" date at the top of this page. If a change materially affects how we use your personal information, we will also notify you in the app or by email to the address on your account before the change takes effect. Your continued use of the Service after a change takes effect means you accept the updated Policy.
11. Contact us
Wrad Games LLC d/b/a Gridzy Sports
[email protected]