Privacy Policy

Where this policy applies

This policy covers the GridBeat website and signed-in web dashboard, together with the GridBeat mobile app. The same GridBeat account can be used across these services.

What is stored

The information we store depends on the features you use. Supabase holds the GridBeat account and application data described below.

• Your account: the email address, account id, sign-in provider, and basic profile details Google or Apple supplies, such as a display name or profile image where available.
• Your web session: essential authentication cookies that keep you signed in to the dashboard.
• Your picks: favourite driver and team.
• Your alerts and devices: notification-category choices, quiet hours, push tokens, platform, app version, and when a registered device was last seen.
• Your game activity: predictions, poll votes, scores, XP, collectibles, and the item you equip on your profile.
• Your public-profile choices: username, profile visibility, and leaderboard participation settings.
• Your trades: the users and collectible instances involved in an offer, the offered and requested items, trade status, and relevant timestamps. XP is not part of collectible trades.
• Your subscription status: product, store, environment, entitlement status, renewal and expiry information, and identifiers needed to match a store purchase to your GridBeat account.
• Limited product events: labels recording actions such as viewing the paywall, starting or completing a purchase, cancelling, failing, or restoring. These events contain your account id and may include a feature or product label, but not payment-card details.

What is never stored

• Location. The app never asks for it.
• Contacts, photos, or anything else on your device.
• Your Google or Apple password.
• Payment-card or bank details. Purchases are handled by Apple or Google through their store systems.
• Advertising identifiers. There are no ads and no ad networks.

How the information is used

• To authenticate you and keep the same account available on web and mobile.
• To remember your preferences, calculate scores, manage collectibles and trades, and show leaderboards or public profiles you chose to join.
• To deliver the notification categories you enabled.
• To provide, restore, and verify GridBeat Pro access where subscriptions are enabled.
• To diagnose failures, protect the service, prevent abuse, and respond to support requests.

Cookies and browser storage

The web dashboard uses essential Supabase authentication cookies to create and refresh your signed-in session. It may also cache application data in your browser to make repeat visits faster. GridBeat does not use advertising cookies or marketing trackers.

Notifications

Push notifications are delivered through Firebase Cloud Messaging. A notification carries the information needed for the alert, such as the session, poll, prediction, or trade it concerns and a short line of text. Turning a category off in Settings prevents reminders in that category from being sent.

Profiles, leaderboards, and trades

Your profile is private by default. If you explicitly make it public, other signed-in players can see only your username, XP, collection score, and equipped Driver Card. They cannot see your email, full inventory, predictions, poll votes, or account metadata.

If you list a collectible for trading, other signed-in players can see the item you deliberately made available. People involved in a trade can see the offered and requested items and the trade status. Trading does not expose your complete collection.

Subscriptions and payments

Apple or Google processes the payment for a GridBeat Pro subscription. RevenueCat helps GridBeat verify the resulting purchase and keep access in sync across reinstalls and supported devices. GridBeat does not receive your complete card or bank details.

The store and RevenueCat may process purchase identifiers, receipts or purchase tokens, subscription status, and limited device or app information under their own privacy policies. GridBeat stores a server-side entitlement record so premium access does not rely only on the device.

Service providers

GridBeat does not sell personal information or share it for targeted advertising. The following providers process information only to operate the service:

• Supabase — authentication, web sessions, preferences, game data, profiles, trades, device registration, and entitlement records.
• Google Firebase — push notification delivery.
• Google and Apple — sign-in and, where applicable, app-store subscription billing.
• RevenueCat — subscription purchase verification and entitlement management.

How long information is kept

Account and feature data is generally kept while your GridBeat account remains active. Some trade, subscription, security, or operational records may be kept for a limited period where needed to preserve transaction integrity, investigate abuse, resolve disputes, meet legal obligations, or allow backups to expire safely.

Deleting your account

Signing out removes that device from the push list but does not delete your account. To request permanent deletion, visit the GridBeat account-deletion page or email [email protected] from the address connected to your account. GridBeat will delete or de-identify the personal data attached to the account, except limited records that must be retained for legal, security, fraud-prevention, dispute-resolution, or transaction-integrity purposes.

Security

GridBeat uses access controls, signed-in permissions, and restricted server credentials to protect account data. No internet service can guarantee absolute security, but access is limited to what each user or service needs to operate its feature.

Children

GridBeat is not directed at children under 13 and no account should be created for one.

Changes to this policy

This page will be updated when GridBeat's data practices materially change. The date at the top shows when the current version took effect.

Contact

GridBeat is operated by CodeBySA. For privacy questions or account-deletion requests, contact [email protected].