Privacy Policy

This Privacy Policy explains how Zachary Zimmerman ("Daily Grid," "we," "us," or "our") handles information when you use dailygrid.app, its installed Progressive Web App, the Daily Grid iOS app, or another service that links to this policy (together, the "Services").

1. Information we collect

Gameplay and device information

• A random anonymous UUID saved in your browser or app storage.
• Puzzle completion times, puzzle dates, games played, hints used, streak and completion progress, and leaderboard rank.
• Initials you choose to display publicly on leaderboards.
• Installed-app and browser storage used for preferences, cached pages, and local progress.

Optional account and social information

• Your email address, one-time sign-in code records, active sessions, and linked anonymous device UUIDs.
• Synced progress, unlocked and viewed achievements, equipped badges, themes and taglines, display initials, and friend relationships.
• Policy acknowledgements and your optional marketing-email preference.

Notifications, feedback, and service protection

• If you enable web push, we store the push endpoint, encryption keys, timezone, and reminder-delivery information needed to send and manage notifications.
• If you submit feedback, we receive your message, page, anonymous UUID (when available), browser user-agent, installed-app mode, and submission time. Feedback is delivered to a Google Sheet used for support and product review.
• We keep limited sign-in attempt, request-rate, and service event records to maintain reliability and prevent automated misuse.

We do not ask for sensitive personal information through the web game. The separate iOS app may use Apple and RevenueCat for App Store purchases; payment credentials are handled by Apple, not Daily Grid.

2. How we use information

We use information to operate puzzles and leaderboards; create and secure optional accounts; sync progress; award achievements; show profiles and friend comparisons; deliver notifications you enable; answer feedback; improve reliability; detect duplicate or automated submissions; and comply with applicable law.

3. Legal bases and choices

Where a legal basis is required, we process account and gameplay information to provide the Services you request, protect the Services, and meet legal obligations. We rely on consent for optional marketing email and notifications where applicable. You may withdraw those choices at any time without losing access to ordinary account sign-in.

4. Service providers and disclosure

We disclose only the information needed for these providers to perform services for us:

• Cloudflare hosts dailygrid.app, Pages Functions, and the D1 database.
• Resend delivers one-time sign-in codes and, only for users who opt in, promotional email.
• Google Sheets receives feedback submissions.
• Google Fonts and the Tailwind CSS CDN provide fonts or style code on some public pages and may receive ordinary request data such as IP address, browser information, and the requested page. Account and policy pages use self-hosted copies.
• Apple and RevenueCat support purchases in the separate iOS app, where applicable.

Leaderboard initials, scores, ranks, equipped cosmetics, and public-safe profile information may be visible to other players. We do not display your email address to other players. We may disclose information if required by law, to protect rights and safety, or as part of a business transfer subject to appropriate safeguards.

5. Retention

• One-time sign-in codes expire after 10 minutes. Sessions generally last up to 30 days and may refresh while you remain active.
• Account data is kept while your account exists. Self-serve account deletion removes the account and associated server-side scores and profile data.
• Anonymous leaderboard records may be retained for historical leaderboards until deletion is requested with enough information to identify the record.
• Push subscriptions are kept until you unsubscribe, the endpoint expires, or the linked account is deleted.
• Feedback and limited service-protection records are kept only as long as reasonably needed for support, reliability, and legal purposes.

6. Security

We use technical and organizational safeguards such as encrypted HTTPS connections, HttpOnly session cookies, hashed one-time codes, access controls, request limits, and restricted service credentials. No online service can guarantee absolute security.

7. Children

The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact us so we can review and delete it.

8. Email and notifications

One-time sign-in codes and necessary account messages are transactional. They are not controlled by the marketing preference. Promotional game and feature updates are optional: the sign-in checkbox is unchecked by default, and you may opt out immediately from Profile or any promotional email's unsubscribe link. Browser or device settings control push permission, and Profile controls the Daily Grid push subscription.

9. Your rights and controls

Depending on where you live, you may have rights to access, correct, delete, or obtain information about personal data. Signed-in users can change marketing preferences and permanently delete their account from Profile > Account. Account deletion removes server-side account data but does not clear data stored only in your browser or installed PWA; use your browser or operating-system storage controls for that.

Feedback stored in Google Sheets is not automatically linked to an email account. For a feedback-specific request or an anonymous leaderboard request, contact us and provide enough information to locate the record, such as the submission date or anonymous device ID.

10. Browser privacy signals

Dailygrid.app does not currently use cross-site advertising trackers. Because there is no generally accepted standard for browser Do Not Track signals, we do not respond to DNT. We will describe support here if that changes.

11. Policy updates

We may update this policy as the Services change. We will revise the date and machine-readable policy version above and provide additional notice when required.

12. Contact

For privacy questions or requests, email [email protected]. Please do not send passwords, sign-in codes, or other sensitive information by email.

Zachary Zimmerman
United States