GridCase · Privacy Policy
Your data in GridCase.
Updated October 20, 2026
Single-player progress stays on your device. Playing with friends is optional. Personal photo uploads are disabled. This policy explains the separate data flows for online play, purchases, and ads.
1. Who is responsible
GridCase is operated by Thomas Chodak, Adamgasse 11, 6020 Innsbruck, Austria. For privacy requests, contact thomas@chodak.at. This policy covers the GridCase app and its online service. Other puzzzle.club services are covered by the website privacy notice.
2. Single-player data on your device
Placements, notes, completed cases, play times, XP, badges, streaks, language, and settings are stored locally. GridCase does not send this single-player progress to our server. No player account is required. Local storage is necessary to provide the game features you request (GDPR Article 6(1)(b)).
You can export a progress backup and choose where to keep it. It does not contain Apple purchase entitlements or your online profile access key. Uninstalling the app or deleting its data may remove local progress. Operating-system backups depend on your device settings and Apple’s terms.
3. Optional guest profiles and friend challenges
Online play uses your chosen display name, a built-in GridCase avatar, a technical profile ID, and a hashed access credential. Players do not need an email login. Personal photo uploads are disabled.
Private rooms process room and participant IDs, IDs of previously started cases for case selection, readiness and connection status, submitted solutions for validation, times, hint counts, and results. Other participants see your name, avatar, readiness, result, hint count, and time. They do not see your private notes or live placements. Anyone with an invitation code may join a room that is still open, so share codes carefully.
We process this information to provide the online game you request (GDPR Article 6(1)(b)). Access control and abuse prevention also serve our legitimate interest in a secure service (Article 6(1)(f)).
4. Reporting, blocking, and deletion
“Report & block” sends the relevant profile IDs, room code, report reason, and a snapshot of the reported profile. Blocking hides the profiles from each other and prevents these IDs from joining another room together. The operator reviews reports and may anonymize names or suspend online profiles. This serves our legitimate interest in player safety and addressing abuse (GDPR Article 6(1)(f)), or a legal obligation where applicable (Article 6(1)(c)).
Use Profile → Delete profile to delete your online guest profile. This removes your entries from rooms and results and any photos retained from older versions. Single-player progress and Apple purchases remain. If a request fails, you can retry; the app retains the access credential until the server confirms completion. If you no longer have the device, contact us. We need suitable proof of ownership before deleting a profile.
5. How long data is kept
Local progress stays on your device until deleted. Online profiles remain until profile deletion. Rooms expire after 24 hours; expired database records are cleaned up when new rooms are created, so physical deletion is not guaranteed at exactly 24 hours.
Open reports are kept until reviewed. Resolved reports older than 90 days are cleaned up in batches during later lobby requests. Profile deletion removes the reported profile content; technical IDs may remain until report cleanup. Blocks remain until either profile is deleted. Photos from older test versions are no longer accessible and are removed from active storage when the profile is deleted.
We retain support correspondence as needed to handle the request and, where necessary, meet legal obligations or establish, exercise, or defend legal claims. Infrastructure security logs and backups also follow the hosting provider’s retention and deletion procedures; we do not promise a shorter fixed deletion period for those copies.
6. Hosting and connection data
The online service and these information pages use OpenAI Sites. OpenAI Ireland Ltd. processes hosted data on our behalf under the Sites Data Processing Addendum. The infrastructure includes Cloudflare Workers, D1, and R2. Requests generate connection information such as IP address, time, and requested resource, used for delivery, operation, and security (GDPR Article 6(1)(f)). Only the operator needs an OpenAI login for moderation.
Data may be processed outside the EEA. The Sites addendum provides for adequacy decisions or EU Standard Contractual Clauses for those transfers. See the addendum and its subprocessor list for safeguards and recipients; contact us for further information. We do not embed advertising or analytics tags on these privacy pages.
7. In-app purchases
Apple handles purchases and payments. The app processes verified product and transaction IDs and unlock status on your device to provide and restore purchased extras (GDPR Article 6(1)(b)). The app does not send us payment or bank details or transmit purchase receipts to the GridCase online service. See Apple’s Privacy Policy. Apple may provide accounting and sales reports to us as the developer; legally required business records are kept under applicable retention obligations (Article 6(1)(c)).
8. Advertising and your choices
GridCase uses Google AdMob and Google’s User Messaging Platform (UMP). We request non-personalized ads. This does not mean no data is processed: Google may process your IP address or approximate location, app/device identifiers, ad views and interactions, and diagnostic and performance data for advertising, measurement, and fraud prevention. We do not send Google your GridCase profile name or puzzle solutions.
UMP checks consent status before ad requests. Where required, you can consent, decline, or manage options in the message. Nonessential device access and processing that requires consent rely on your permission (GDPR Article 6(1)(a) and applicable device-access rules). The app requests ads only when UMP allows it. Depending on your choices, limited ads may be available or no ad may be shown. You can still play single-player cases without ad consent.
Open Settings → Extras & information → Ad privacy to revisit available choices and change or withdraw consent for the future. Ad consent is not required to solve cases. Automatic breaks can appear when moving to the next case after at least three completions, with at least ten minutes between breaks. “Ad-free” removes these breaks. Videos for additional hints remain optional.
For EEA users, Google Ireland Limited is a relevant provider; Google LLC and providers listed in the consent message may also be involved. Details about purposes, legal bases, recipients, international transfers, and retention appear in the message, Google’s Privacy Policy, its partner-app information, and its retention information.
9. Reminders, support, and external links
Reminders are optional and scheduled locally on your device. Turn them off in the app or iOS settings. We do not run a push server for them. A local profile name used to personalize reminder text is not sent to a server for that purpose.
If you contact support, we process your contact details and message to respond (GDPR Article 6(1)(b) or (f)). Do not send passwords or bank details. Book links open Amazon; other external links open the relevant provider. Their own privacy policies apply. GridCase does not receive your Amazon account details through these links.
10. Your rights
Where applicable, you can request access, correction, deletion, restriction, or portability, and object to processing based on legitimate interests. You may withdraw consent for future processing without affecting the lawfulness of earlier processing. Contact thomas@chodak.at. You can complain to a data protection authority, including the Austrian Data Protection Authority. We publish changes to this policy here with an updated date.