Privacy Policy

1. Who we are

GrimTable ("we", "the app") is developed by Andrea Caserini, an independent developer based in the European Union, who is the data controller under the GDPR. Contact: neuralsand@gmail.com.

GrimTable and GreyPile (by the same developer) share one account system: if you use both apps, you sign in with the same account.

2. Data we collect

Account

• Email address and a user identifier from our authentication provider (Supabase).
• If you sign in with Apple or Google, an identity token from that provider. We never receive your social account password.

Profile and play

• Display name, city (chosen from a list, never free text), avatar (an illustration or, with PRO, a photo you upload) and its colour.
• Groups you create or join, matches you organize or join, results, reactions given and received, titles and Rating.
• Messages you write in group and match chats (text only).
• Player preferences you choose to fill in (game systems, match type, availability).
• Settings: theme, language, distance unit, notification preferences.

Optional data

• Home address: only if you add it, to organize matches at your place. It is never public: it is shown only to the members of the group of a match held at your home.
• Location: only when you tap "Use my location", to find the nearest city. The coordinates are used once for that lookup and are not stored; only the city is saved.
• Names of people who play without the app, typed by an organizer into a match.

Technical data

• Push notification token of your device, to send you notifications you enabled.
• Crash reports and diagnostics (device model, OS version, app version, error details, IP address) to find and fix bugs.
• Purchase status of GrimTable PRO, and whether your account has GreyPile Pro.

We do not use advertising trackers, we do not access your contacts or photo library (except the photo you choose to upload), and we do not sell data.

3. Who sees what

• Other signed-in players can see your display name, avatar and city.
• Members of a group see the group's matches, results, reactions, Hall of Fame and chat.
• Players of a match see its chat and line-ups.
• Your home address: only the members of the group of a match at your home.
• Guests (using the app without an account): everything stays on the device and is never sent to our servers, except the name of a city typed in the city search.

4. Why we use it (legal basis)

• To provide the service you asked for: account, groups, matches, chat, results, notifications (contract, art. 6(1)(b) GDPR).
• Optional data such as home address, location lookup and notifications: your choice, which you can withdraw at any time (consent, art. 6(1)(a)).
• Security, abuse prevention and crash diagnostics (legitimate interest, art. 6(1)(f)).
• Purchase records, as required by tax law (legal obligation, art. 6(1)(c)).

5. Where data is stored

Data is stored by Supabase in the European Union (Ireland), in a PostgreSQL database where access rules ensure each row is visible only to the people who should see it. All traffic is encrypted (HTTPS/TLS). Your sign-in token is kept by your device's secure storage.

6. Service providers

• Supabase — database, authentication, file storage (EU).
• RevenueCat — management of in-app purchases (user identifier and purchase events).
• Apple App Store / Google Play — payments and, if you choose them, sign-in.
• Expo (push service) with Apple and Google — delivery of push notifications.
• Sentry — crash reports and diagnostics.
• Cloudflare — hosting of this website (technical access logs).

They process data only to provide their service to us. Some (e.g. RevenueCat, Expo, Sentry, Apple, Google) may process data outside the EU; such transfers are protected by Standard Contractual Clauses or equivalent safeguards.

City data © GeoNames (geonames.org), CC-BY 4.0: it is a public list of places, no personal data is shared with GeoNames.

7. How long we keep data

• As long as your account exists.
• When you delete your account, it is deactivated immediately and erased within 30 days (you can change your mind by signing in again within that time). Messages and results you left in groups are anonymised so that the other players' history stays consistent.
• Purchase records are kept by the stores and RevenueCat as required by law.
• Crash reports are kept for a short rolling period.

8. Your rights

You can access, correct, delete and receive a copy of your data, object to or restrict processing, and withdraw consent at any time. You can edit most data directly in the app and delete your account from Settings → Delete account.

For a copy of your data or any other request, write to neuralsand@gmail.com from the address of your account: we answer within 30 days. You can also lodge a complaint with your data protection authority (in Italy, the Garante per la protezione dei dati personali).

9. Children

GrimTable is for people aged 13 or older (16 where required by local law in the EEA, unless a parent or guardian consents). We do not knowingly collect data from younger children; if you think this happened, contact us and we will delete it.

10. Changes

We may update this policy. The date at the top shows the latest version; important changes are announced in the app.