Privacy Policy
Last updated 2 September 2026
GridWits is operated by Jeet Oza. For privacy requests, contact [email protected].
The GridWits app is not offered anywhere in Europe — including the European Economic Area, the United Kingdom, Switzerland, Türkiye, Russia, Ukraine, and the Western Balkans — or in Armenia, Azerbaijan, Georgia, Kazakhstan, Uzbekistan, Canada, South Korea, New Zealand, China mainland, or Vietnam.
GridWits is designed and operated as an online puzzle game with limited ancillary social features, not as a social-media service. Its primary purpose is puzzle play. Public player profiles, friends, private-game and tournament code sharing, rooms, and rankings support that gameplay and are not a general-purpose social feed or discussion service.
This policy covers two different things, and they collect very different amounts of data. This website has no account, analytics, advertising, or tracking. The GridWits iOS app can be used for offline solo and Daily Puzzle play without an account or server-side gameplay data. It uses an account identifier only after you enable an online feature and then stores the data needed to provide that feature. The website comes first below; everything after it is about the app.
This website
This site sets no cookies, runs no analytics, shows no advertising, and loads no third-party scripts, fonts, or images. Its content security policy forbids browser requests to any other host, so that is enforced rather than promised.
All twelve puzzles are generated and solved inside your own browser. Nothing you do on a board — your moves, your times, or whether you finished — is sent anywhere. The current board state is gone when you close the tab. There is no account, and nothing to sign in to.
The site keeps two kinds of non-personal data in your browser between visits: whether you chose the light or dark theme, and a small shuffle history made only of puzzle identifiers so a fallback puzzle bank does not immediately repeat a board. It does not store your moves, answers, times, or results. You can remove both by clearing site data. Cloudflare, which hosts the site, necessarily processes connection data such as your IP address, browser information, and requested page to deliver the site and protect it from abuse. GridWits does not use that information for advertising or to build a profile of you.
The app, in short
- You can play every solo puzzle without an account and without giving us a name or an email address.
- We do not sell personal data, and we do not run third-party advertising.
- Offline play, including Daily Puzzles, creates no Firebase account or public profile and sends no gameplay data to GridWits.
- Offline play is available at any age. Online login, accounts, and online features are limited to adults aged 18 or older.
- Daily puzzles can be played offline. Daily leaderboards, tournaments, profiles, friends, chat, rooms, rankings, coins, XP, and online progress require an online account.
- You can delete your account and its data from inside the app at any time.
What we collect
If you choose offline play
Starting with account-free offline play does not sign in to Firebase, create an account, create a public player profile, send a presence heartbeat, or upload puzzle play or results. There is no age limit for this account-free mode. You can play all twelve solo puzzle types and each day's Daily Puzzles. Daily leaderboards, tournaments, profiles, friends, chat, rooms, rankings, coins, XP, and online progress remain unavailable until you deliberately enable online access.
Puzzle settings, solo statistics, at most one in-progress solo board per game, and offline Daily Puzzle attempts are stored only on your device so your preferences and unfinished play can continue. For an offline Daily Puzzle, this includes whether you started or finished, your elapsed time, mistakes, hints used, and the saved board. These records are not sent to GridWits and can be removed by deleting the app or clearing its local data. An offline Daily result is not placed on a friends or global leaderboard, does not earn online XP or Coins, and remains ineligible for ranking if you sign in later that day.
If you enable online access
Online login, accounts, and online features are available only to players aged 18 or older. Before enabling an online feature, the app explains that online access creates a Firebase account and public generated player profile. On supported Apple systems, GridWits first asks Apple's Declared Age Range service for a privacy-preserving age range using an 18-year threshold. GridWits uses only whether the lower bound of the shared range establishes age 18 or older. The shared range and its declaration metadata are not stored or sent to GridWits servers. Where that system check is not available and is not required by the applicable region, the app asks for birth month and year as an on-device fallback. Those entries exist only on that screen and are not stored, sent to GridWits, or added to your Firebase account or profile. The device stores only a Boolean 18+ eligibility flag so it does not need to ask again during the same signed-in use. That flag is cleared when you sign out, leave guest mode, or delete the account. You may then continue with an anonymous online account, Sign in with Apple, or an email sign-in link. The account and profile are created only after you make that choice. We then store:
If you leave guest mode, online access and online data activity stop, but the Firebase SDK keeps that anonymous account's credential securely on the same device. Choosing “Resume as guest” reopens the same account, identifier, and profile instead of creating duplicate records. This remembered credential is removed when you delete the account or replace it by linking or signing in to another account. Offline puzzle play is not uploaded while guest mode is inactive.
| Data | Why |
|---|---|
| Firebase account identifier | Authentication, account data, and abuse prevention; anonymous online accounts receive a random identifier |
| Display name and handle | So other players can find and recognise you |
| Email address (email sign-in only) | To send the sign-in link and let you recover the account |
| Apple user identifier (Sign in with Apple only) | To match you to your account on next sign-in |
| XP, streaks, tournament results, daily-puzzle results | Progression, leaderboards, and tournament standings |
| Friend relationships and requests | To operate the friends list |
| Private-game and tournament codes you share | To deliver an active join code to the selected thread or room |
| Online/last-seen presence | So friends can see whether you are available to play |
| Blocks and reports you submit | To enforce blocks and review reported behaviour |
| Support correspondence you choose to send | To answer your request, troubleshoot the problem, or handle a privacy or safety issue |
| Technical request and security data | Device/OS/app version information, IP address and function-invocation metadata, and App Attest material used to operate and protect the service |
Sign in with Apple. If you use Apple's Hide My Email, we receive only the relay address and never see your real one.
What we deliberately do not collect
- No contacts, photos, location, microphone, or camera access.
- No advertising identifier (IDFA), and no cross-app tracking.
- No payment details. The app has no in-app purchases and takes no payments, so there is nothing to bill and no card for anyone to see. Coins are a virtual currency used only for tournament entry and prizes, and cannot be bought.
- No product-usage analytics or crash-reporting product. The app uses Firebase Authentication, Cloud Firestore, Cloud Functions, and Firebase App Check. Firebase's SDKs may collect limited diagnostic metadata to maintain those services; GridWits does not use it to track you across apps or websites.
Why we are allowed to process it
We process online data only for the purposes below, and only after you choose to enable online access. Where local law requires us to identify a legal basis, these are the bases we rely on. In Brazil they correspond to execution of a contract (LGPD Art. 7, V), compliance with a legal obligation (Art. 7, II), and legitimate interests (Art. 7, IX); in India, to the corresponding provisions of the Digital Personal Data Protection Act, 2023. We do not rely on consent for advertising, tracking, or analytics, because GridWits does none of those things.
| Purpose | Why we may process it |
|---|---|
| Create and authenticate your online account, and create the generated public player profile | Necessary to provide the online service you asked for. It starts only when you request online access, and never for account-free offline play. |
| Provide Daily Puzzles, tournaments, rankings, Coins, and online progression | Necessary to provide the features you choose to use, to run a common competition, and to settle virtual Coin prizes and refunds. |
| Provide friends, code-sharing rooms, invitations, blocks, and friend presence | Necessary to provide the features you choose to use. Presence is visible only to you and to friends whose request you accepted. |
| Secure the service and prevent abuse, fraud, and cheating | Our legitimate interest in protecting accounts, service availability, and fair competition. Server-side verification and short security logs address risks that client-only controls cannot. We run no advertising, tracking, or behavioural profiling. |
| Receive and resolve player reports and enforce community rules | Our legitimate interest in protecting players and addressing repeat abuse. The reported context and a stable identifier are needed to investigate; clients cannot read reports. |
| Answer support and troubleshooting requests | Necessary to deliver or repair the service you asked for; otherwise our legitimate interest in reliable support and fault diagnosis. You choose what to send us. |
| Handle privacy-rights and regulator requests, and legal claims | Compliance with a legal obligation where applicable law requires the response, and otherwise our legitimate interest in establishing, exercising, or defending a legal claim. |
| Deliver and secure the public website, and keep a recoverable database export | Our legitimate interest in reliable page delivery, abuse protection, and service recovery. Exports are made only before destructive or backend changes and are never used for analytics or a new purpose. |
Who processes it
GridWits runs on Google Firebase (Authentication, Cloud Firestore, Cloud Functions, and App Check). Google processes data on our behalf as a service provider under Google's security and privacy terms. On supported Apple devices, App Check uses Apple's App Attest service to verify that requests come from a genuine copy of GridWits. If you choose Sign in with Apple, Apple also processes that sign-in under its own terms. We do not sell personal data or share it for advertising.
| Service | Configured location and use |
|---|---|
| Firebase Authentication | Firebase operates Authentication exclusively from United States data centres. It processes account identifiers and, depending on the sign-in method, an email address or Apple provider identifier, plus IP address, user-agent, and security metadata. |
| Cloud Firestore | The production database is in nam5, Google's United States Central multi-region. Full read/write replicas are in Iowa and Oklahoma, with a witness that does not hold a full replica in South Carolina. |
| Cloud Functions | GridWits's generation-2 functions execute in us-central1 (Iowa) to operate accounts, competitive results, moderation, deletion, and retention. |
| Firebase App Check and Apple App Attest | These global security services process app-attestation material and short-lived tokens to reduce automated abuse. Apple's separate Declared Age Range service and the fallback birth month/year check are not part of App Check or App Attest. |
| Cloud Logging and operator-created exports | Function and security logs are kept for 30 days. Firestore exports are stored in a Google Cloud US multi-region bucket for approximately 30 days including soft-delete recovery. |
These configured locations describe where the principal Firebase resources store or execute GridWits customer data. Google and its subprocessors may also process data in other countries to operate, secure, and support the services, subject to Google's service-specific location commitments and contractual safeguards. Online use therefore involves processing outside your country if you live outside the United States.
The principal terms are the Firebase Data Processing and Security Terms, the Firebase subprocessor list, and, where applicable, the Firebase U.S. State Privacy Laws Addendum. They address Google's processing instructions, confidentiality, security, deletion, incident notification, data-subject assistance, subprocessors, and international processing. Contact the privacy email below if you want more information about the safeguards relevant to your location.
How long we keep app data
| Data | Retention period |
|---|---|
| Account, profile, sign-in links, wallet, wallet ledger, and progression | While the account exists; removed during account deletion, except for the short-lived or safety records described below |
| Display name and handle reservations | While the account exists; released during account deletion |
| Friendships, friend requests, and blocks | Until removed by a user or the account is deleted |
| Presence and last-active time | 24 hours after the last heartbeat, or sooner when the account is deleted |
| Private-game and tournament code shares | 12 months after sending; account deletion immediately replaces the sender identity with “Deleted user” |
| Chat-thread membership, names, and previews | 12 months after the thread's last activity |
| Daily-puzzle entries and results | Until 24 hours after that Daily Puzzle closes at 11:55 p.m. US Eastern time; aggregate XP and streak information remains with the account |
| Tournament entries and results | Until 24 hours after the scheduled tournament end; prizes and cancellation refunds are settled first, while the resulting wallet entry and aggregate win count remain with the account |
| Moderation reports | Until reviewed and resolved, then 12 months after resolution |
| Support correspondence | 24 months after the request is closed |
| Google Cloud function and security logs | 30 days |
| Operator-created Firestore exports | Kept for up to approximately 30 days, including a seven-day restricted soft-deletion recovery period, and then permanently deleted |
The hourly cleanup schedule means deletion normally happens within an hour after a period expires. A record may be kept longer if preservation is required for a legal claim, court order, regulator, fraud investigation, or safety investigation; when that need ends, the normal schedule resumes.
What other players can see
Your display name, handle, and public progression stats are visible to any other signed-in player, including on leaderboards and in tournaments. Treat your display name as public — it is the one piece of this you choose yourself.
Not visible to other players: your email address, and your Apple user identifier. Neither is stored on the profile record other players can read.
Your online status is narrower still. It is readable only by you and by players whose friend request you have accepted — not by other players generally, and not by someone who has merely sent you a request.
Code sharing, blocking, and reporting
There is no free-text or emoji chat in GridWits. A message can only share an active private-game or tournament join code validated by GridWits, so a player cannot use chat to send written text, an arbitrary link, or a phone number. The other players who can see a code share are the members of that thread, or — in a public room — anyone signed in.
You can block any player, which stops their messages and hides them from you. You can report a message or a player; reports include the reported content so we can review it. We retain reports for as long as needed to handle repeat behaviour.
Deleting your data
In the app: Profile → Delete Account. It signs you out permanently and cannot be undone.
Deleted outright:
- Your profile, and the display name and handle reservations that went with it — both names become available to other players again.
- Your Apple sign-in link, so nothing connects your Apple ID to GridWits any more.
- Your friendships and pending friend requests, on both sides.
- Your online-status record.
- Your block list.
- Your coin wallet, and your sign-in account itself.
Temporarily retained with your public identity removed:
- Tournament entries and daily-puzzle results may remain until their 24-hour event-retention deadline. The displayed name becomes “Deleted user.” An internal account identifier may remain on the event row until settlement and cleanup; the event record is then deleted automatically.
- Private-game and tournament code shares you already sent remain until the 12-month message deadline so the sharing history remains understandable to its recipients. Your account identifier and name are replaced with a “Deleted user” tombstone.
Reports you submitted or were the subject of remain until they are resolved and for 12 months afterwards so abuse, safety issues, and repeat behaviour can be reviewed. Deletion removes other account data from the live GridWits database; residual encrypted backup copies held by service providers may remain until their normal backup-retention periods expire. Firebase states that deleted Authentication data is removed from live and backup systems within 180 days.
An anonymous online account that was never linked to Apple or email sign-in can normally be identified only from the device that created it. Leaving guest mode does not delete it; the device remembers its credential so the same guest profile can be resumed. Delete the account from inside the app before you uninstall if you want its online data removed. Account-free offline play creates no account to delete.
You can also email [email protected] to request deletion or a copy of your data.
Your rights
Depending on where you live, you may have some or all of the rights below. Use the privacy email at the end of this policy to exercise any of them. Offline solo play creates no account and no records for us to act on.
- Confirmation that we process your personal data, and access to it.
- Correction of data that is incomplete, inaccurate, or out of date, and completion of data that is partial.
- A portable copy of your data.
- Deletion of your account and its data, which you can also do yourself at Profile → Delete Account.
- Anonymisation, blocking, or deletion of data that is unnecessary, excessive, or processed other than as this policy describes.
- Information about the parties with which we have shared your personal data. The “Who processes it” section above is that list.
- Objection to processing we carry out on the basis of a legitimate interest, based on your particular situation.
We reply within 30 days. Where local law sets a shorter deadline, we meet that instead: in Brazil, a request for confirmation or access is answered in simplified form immediately, or in a complete declaration within 15 days (LGPD Art. 19). We do not sell personal data, and we do not share it for cross-context behavioural advertising.
If you are in India. You may nominate another person to exercise these rights on your behalf if you die or become unable to act (Digital Personal Data Protection Act, 2023, section 14). Email us to record a nomination. This policy is published in English; you may ask us to provide it in any language listed in the Eighth Schedule to the Constitution of India.
Children
Account-free offline play, including Daily Puzzles, has no age limit and sends no gameplay data to GridWits. GridWits's online accounts and online features are for adults aged 18 or older and are not directed at children. A player who does not meet the online age requirement can continue using offline play. We do not knowingly collect personal data through an online account from anyone under 18. If you believe a person under 18 has created an online account, contact us and we will remove it.
Because online accounts are restricted to adults, GridWits does not knowingly process the personal data of a child through an online account, and does not carry out tracking, behavioural monitoring, or targeted advertising directed at children anywhere in the app.
Changes
If this policy changes materially, we will update the date above and notify you in the app before the change takes effect.
Contact, grievances, and complaints
Operator: Jeet Oza
Privacy email:
[email protected]
Jeet Oza is the person responsible for answering questions about how GridWits processes personal data, and the address above is the published channel for every privacy request, grievance, and complaint described in this policy. There is no separate postal address for privacy requests.
If you are in Brazil. GridWits operates as a small processing agent within the meaning of ANPD Resolution CD/ANPD nº 2 of 27 January 2022 and on that basis does not appoint a separate encarregado; the address above is the communication channel published in its place. If you are not satisfied with our response, you may complain to the Autoridade Nacional de Proteção de Dados (ANPD).
If you are in India. The address above is also the contact for grievance redressal under section 13 of the Digital Personal Data Protection Act, 2023. Tell us that your message is a grievance and we will answer it within the period set by the DPDP Rules. If you are not satisfied with our response, you may complain to the Data Protection Board of India.
Wherever you live, you may also raise a concern with your local data protection authority.