Privacy Policy
Last updated 6 August 2026
This policy covers two different things, and they collect very different amounts of data. This website collects nothing at all. The GridWits iOS app can, if you make an account, because friends, chat and tournaments need other players to be able to see you. The website comes first below; everything after it is about the app.
This website
This site collects nothing. It sets no cookies, runs no analytics, shows no advertising, and loads no third-party scripts, fonts or images — its content security policy forbids requests to any other host, so that is enforced rather than promised.
All nine puzzles are generated and solved inside your own browser. Nothing you do on a board — the puzzle, your moves, your times, whether you finished — is sent anywhere or stored anywhere but the page you are on, and it is gone when you close the tab. There is no account, and nothing to sign in to.
The single thing kept between visits is whether you chose the light or dark theme, in your own browser's local storage. You can clear it by clearing site data. Our host records ordinary web-server logs (IP address, browser, which page) to serve the site and defend it from abuse.
The app, in short
- You can play every solo puzzle without an account and without giving us a name or an email address.
- We do not sell personal data, and we do not run third-party advertising.
- Anything social — a profile, friends, chat, tournaments — requires an account, because other players have to be able to see you.
- You can delete your account and its data from inside the app at any time.
What we collect
If you never sign in
The app signs you in anonymously so your progress has somewhere to live. That gives you a random identifier that is not tied to your name, email, or device identity. Puzzles in progress, solve statistics, and settings are stored on your device.
If you create an account
You can sign in with Apple or with an email sign-in link. We then store:
| Data | Why |
|---|---|
| Display name, handle, bio | So other players can find and recognise you |
| Email address (email sign-in only) | To send the sign-in link and let you recover the account |
| Apple user identifier (Sign in with Apple only) | To match you to your account on next sign-in |
| XP, streaks, tournament results, daily-puzzle results | Progression, leaderboards, and tournament standings |
| Friend relationships and requests | To operate the friends list |
| Chat messages you send | To deliver them to the recipient |
| Online/last-seen presence | So friends can see whether you are available to play |
| Blocks and reports you submit | To enforce blocks and review reported behaviour |
Sign in with Apple. If you use Apple's Hide My Email, we receive only the relay address and never see your real one.
What we deliberately do not collect
- No contacts, photos, location, microphone, or camera access.
- No advertising identifier (IDFA), and no cross-app tracking.
- No payment card details — any purchase is handled by Apple, and we never see the card.
Who processes it
GridWits runs on Google Firebase (Authentication, Cloud Firestore). Google processes this data on our behalf as a service provider, under Google's own security and privacy commitments. We do not share your personal data with anyone else, and we never sell it.
Data is stored on Google Cloud infrastructure and may be processed outside your country of residence.
What other players can see
Your display name, handle, bio, and public progression stats are visible to other players, including on leaderboards and in tournaments. Your email address is never shown to other players. Treat your bio as public.
Chat, blocking, and reporting
You can block any player, which stops their messages and hides them from you. You can report a message or a player; reports include the reported content so we can review it. We retain reports for as long as needed to handle repeat behaviour.
Deleting your data
In the app: Settings → Account → Delete Account. This removes your profile, handle, display name, friendships, wallet, and progression, and signs you out permanently.
Messages you already sent may remain visible to the recipient, shown as from a deleted user. Reports you were the subject of are retained for moderation. Backups roll off within 30 days.
You can also email [email protected] to request deletion or a copy of your data.
Your rights
Depending on where you live — including the UK, EU (GDPR), and California (CCPA/CPRA) — you may have the right to access, correct, export, or delete your personal data, and to object to certain processing. Use the contact address above; we will respond within 30 days. We do not sell or share personal information for cross-context behavioural advertising.
Children
GridWits is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child has created an account, contact us and we will remove it.
Changes
If this policy changes materially, we will update the date above and notify you in the app before the change takes effect.
Contact
GridWits — [email protected]