Grailboard Privacy Policy

1. Information We Collect

Account information. When you sign in with Apple, Google, or email, we receive your email address and, where you share it, your name. (With Sign in with Apple you may choose "Hide My Email", in which case we receive a relay address.) You choose a username and may add a display name, bio, and avatar.

Content you post. Card photos and the details you enter about them (type, category, grade, grading company, certification number, set, player, year, notes), your Holy Grail selection, Vault Walls, comments, and replies.

Community activity. Likes, bookmarks, follows, votes and nominations, comments, reports you file, and collectors you block.

Device and diagnostic information. Device model, operating system, app version, crash reports, and performance data, collected through Sentry.

Usage information. Events such as screens viewed and features used, collected through PostHog, to understand how the app is used and improve it.

Push notification token. If you allow notifications, a device token issued by Apple or Google via Expo's push service, used only to deliver notifications you have turned on.

Camera and photo library. Accessed only when you tap to add a card, and only to capture or pick the photo you choose. We do not scan your library.

We do not collect payment information, precise location, or contacts, and we do not use advertising SDKs.

2. How We Use Information

We use this information to:

• Provide and operate Grailboard: your profile, Vault, walls, feeds, search, and the Grail of the Week vote.
• Send notifications you have enabled (likes, comments, follows, vote results).
• Provide support and respond to your requests.
• Detect and prevent fraud, abuse, spam, vote manipulation, and violations of our Terms.
• Diagnose crashes and improve performance and usability.
• Comply with legal obligations.

We do not sell your personal information and we do not use it for advertising.

3. Your Content and Licence

You own the Content you post. By posting it you grant Grailboard a licence to store, display, and distribute it as needed to operate and promote the Service, as described in the Terms of Service (grailboard.app/terms).

4. Public Information

Grailboard is a showcase, so most of what you post is public and visible to any collector, including signed-out visitors:

• Username, display name, avatar, and bio
• Your cards and the details you add to them
• Your Holy Grail and Vault Walls
• Follower and following counts
• Likes, comments, votes, and nominations

Links to your profile, cards, and walls can be shared outside the app. Do not post anything you do not want to be public. Your email address and sign-in method are never shown to other users.

5. Who We Share Information With

We share information only with service providers that help us run Grailboard, under contracts that limit how they may use it:

• Supabase — database, authentication, and server functions (hosted in the United States)
• Cloudflare — image storage (R2) and website hosting
• Sentry — crash and error reporting
• PostHog — product analytics
• Expo — push-notification delivery to Apple and Google
• Apple and Google — sign-in and push notifications

We may also disclose information if required by law, to enforce our Terms, or to protect the rights and safety of users and the public.

6. Data Retention and Account Deletion

We keep your information for as long as your account exists.

You can delete your account in Settings → Delete Account. Your account and profile are hidden immediately and permanently deleted, along with your photos and content, after a 30-day grace period. Signing in during that period cancels the deletion. You can also request deletion by emailing support@grailboard.app from your account email. Instructions are also at grailboard.app/delete-account.

After deletion we may keep limited records where required for security, fraud prevention, or legal compliance, and Content that was hidden by moderation may be retained for enforcement purposes.

7. Your Choices and Rights

• Notifications: turn categories on or off in Settings → Notifications, or at the device level.
• Profile: edit or remove your display name, bio, and avatar at any time.
• Content: edit or delete any card, wall, or comment you posted.
• Blocking: block any collector; blocked collectors cannot see or interact with your profile.
• Access, correction, portability, deletion: depending on where you live, you may have legal rights to access, correct, export, or delete your personal information, or to object to certain processing. Email support@grailboard.app and we will respond within the time the law requires.

8. International Transfers

Grailboard is operated from the United States and our providers store data in the United States. By using the Service you understand your information will be processed there, and we rely on our providers' standard contractual safeguards for transfers.

9. Data Security

We use reasonable technical and organisational measures to protect your information, including encrypted connections, access controls, and row-level security on our database. No system is completely secure, so please use a strong, unique sign-in method.

10. Children's Privacy

Grailboard is not intended for children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has an account, email support@grailboard.app and we will delete it.

11. Website

The grailboard.app website does not use cookies, analytics, or tracking. Pages for shared cards, profiles, and walls only offer to open the app.

12. Changes to This Policy

We may update this Policy. Changes are posted at grailboard.app/privacy with an updated effective date, and we will notify you in the app of material changes.

13. Contact

Grailboard Support — support@grailboard.app