Privacy Policy

1. INFORMATION WE COLLECT

A. ACCOUNT INFORMATION (Linked to Your Identity)

• Phone number (used as your primary login/verification credential) and username (used for app functionality)
• Email address — optional. You can connect a verified email address to your phone account for added account security and recovery. Google or Apple sign-in may also be linked to an existing account (used for app functionality and account security)
• Display name and profile pictures (face photo and public photo) (used for app functionality)
• Birthday/date of birth (required to create an account so we can verify you are 18 or older) (used for app functionality)
• Identity information (gender, race, sexual orientation, relationship status) — optional (used for app functionality and product personalization)
• Bio and custom status messages (used for app functionality)
• Tags describing your interests and identity (used for app functionality and product personalization)

B. LOCATION DATA (Linked to Your Identity)

• Grid is currently available in the United States only. Creating an account requires that you are physically located in the United States, which we verify using your device location (and, as a signal, your network/IP location) at the time of registration
• Precise GPS coordinates when using the app (used for app functionality, advertising, and product personalization)
• Current location (place, neighborhood, city, state, country) (used for app functionality)
• Home neighborhood designation (used for app functionality)
• Location history for service functionality (used for app functionality)
• Distance calculations between users (used for app functionality)

C. CONTENT AND INTERACTIONS (Linked to Your Identity)

• Posts, photos, videos, and comments you create (used for app functionality and product personalization)
• Messages sent to other users (encrypted) (used for app functionality)
• Interactions with posts (promotes, shares, views) (used for app functionality, analytics, and product personalization)
• Friend connections and requests (used for app functionality)
• Places you've joined or interacted with (used for app functionality and developer advertising)
• Event participation and check-ins (used for app functionality)

D. USAGE DATA (Linked to Your Identity)

• User ID and account identifiers (used for app functionality, developer advertising, analytics, and product personalization)
• App usage patterns and session duration (used for analytics)
• Feature usage and interaction timing (used for analytics and product personalization)
• "For You" algorithm feedback and preferences (used for product personalization)
• Inferred taste and preferences derived from your activity — such as your stated favorites, interests, "right now" status, and how you interact with posts, people, and places — used to power personalized features like recommended content, "Similar" people, and shared-interest surfaces ("In Common" / "The Room") (used for product personalization)
• Search queries and content preferences (used for analytics and product personalization)
• Device information and technical specifications (used for analytics)

E. TECHNICAL DATA (May Be Linked to Your Identity)

• Device identifiers and push notification tokens (used for app functionality and analytics)
• IP address and network information (used for app functionality)
• App version and operating system details (used for analytics)
• Crash reports and performance metrics (used for analytics)

F. SENSITIVE INFORMATION (Linked to Your Identity)

• Date of birth is required to create an account and is used to verify that you are 18 or older. We do not display your exact birthday to other users
• Identity tags including sexual orientation, gender identity, race/ethnicity, relationship status, or other personal characteristics (used for app functionality and product personalization)
• These identity characteristics are optional but help other users discover you based on shared characteristics
• You control the visibility of this information through privacy settings

G. BLUETOOTH AND MESH NETWORK DATA (Linked to Your Identity)

• Bluetooth device identifiers when Festival Mode is enabled (used for app functionality)
• Nearby device discovery information including device IDs, user IDs, usernames, and display names (used for app functionality)
• Location coordinates transmitted via mesh network for geographic routing (used for app functionality)
• Mesh network routing data including device capabilities and connection status (used for app functionality)
• Note: Messages transmitted via Bluetooth mesh network are encrypted using AES-256-GCM encryption and are not accessible to Grid
• Bluetooth mesh networking operates peer-to-peer between devices and does not transmit data to Grid servers

2. HOW WE USE YOUR INFORMATION

A. CORE FUNCTIONALITY

• Connect you with nearby users based on location proximity
• Display relevant content in your location hierarchy
• Enable messaging and social connections
• Enable offline messaging through Bluetooth mesh networking when internet is unavailable (Festival Mode)
• Discover nearby users via Bluetooth Low Energy when Festival Mode is enabled
• Relay messages through peer-to-peer mesh network between nearby devices
• Personalize your "For You" feed using algorithmic recommendations
• Show you relevant places, events, and activities
• Authenticate your account and prevent fraud
• Ensure server uptime and app performance

B. PRIVACY AND SAFETY

• Apply your privacy settings to control information visibility
• Detect and prevent spam, abuse, and fake accounts
• Investigate violations of our terms of service
• Respond to legal requests and emergency situations

C. ANALYTICS AND PRODUCT PERSONALIZATION

• Analyze usage patterns to improve features and understand user behavior
• Measure feature effectiveness and audience characteristics
• Test and develop new functionality
• Develop better content recommendation algorithms
• Customize what you see based on your location and preferences
• Optimize app performance and fix bugs
• Track engagement metrics to improve the service

D. ADVERTISING AND MARKETING

Grid uses two distinct forms of advertising:

• First-party promotions (within Grid): Enable businesses (Official Places) to show promotions and notifications to users who have joined their Place, allow businesses to promote posts to nearby users within the app, and send you notifications about nearby places, events, and activities. This activity is first-party and stays within Grid.
• Third-party advertising (Google AdMob): Grid uses or may use the Google AdMob advertising software development kit (SDK) to display ads within the app. When ads are served, the Google Mobile Ads SDK may collect and process device and advertising identifiers, coarse location, and usage information in order to select and measure ads. This data is processed by Google as an independent third party under Google's own privacy policy.
• App Tracking Transparency (ATT): On iOS, we ask for your permission before allowing personalized advertising. If you allow tracking, our advertising partner (Google) may use your advertising identifier to personalize and measure ads, which may include linking activity across apps and websites owned by other companies. If you do not allow tracking, we request non-personalized ads only. You can change this at any time in your iOS Settings.
• We do not sell your personal information, and we do not share your data with data brokers.

E. COMMUNICATION

• Send important account and security notifications
• Send a one-time verification code by SMS to your phone number to create or access your account (transactional; message and data rates may apply)
• Provide customer support and respond to inquiries
• Share product updates and feature announcements
• Request feedback for service improvements

3. INFORMATION SHARING AND DISCLOSURE

A. USER-CONTROLLED SHARING

• Profile information visibility is controlled by your privacy settings
• Location sharing granularity can be adjusted (place, neighborhood, city, etc.)
• You choose which users can see specific profile fields
• Post visibility is determined by location levels and privacy settings

C. LEGAL AND SAFETY DISCLOSURES

• We may disclose information when required by law
• Emergency situations may require sharing information with authorities
• Court orders and legal process may compel data disclosure
• We cooperate with law enforcement when legally obligated

D. SERVICE PROVIDERS

• Cloud hosting and data storage providers
• Map and location services (with privacy protections)
• SMS delivery provider (Amazon Web Services / Amazon SNS) to send phone verification codes; your phone number is shared with this provider solely to deliver the message
• Email delivery provider (Amazon Web Services / Amazon SES) to send email verification codes when you connect an email address to your account
• Advertising provider (Google AdMob) to display ads within the app; subject to your App Tracking Transparency choice (see Section 2.D)
• Payment processor (Stripe) for business/owner features, where applicable
• Analytics services (using anonymized data)
• Customer support and communication tools

4. YOUR PRIVACY CONTROLS

A. GRANULAR PROFILE PRIVACY

• Control visibility of display name, bio, photos, and personal information
• Set privacy levels: Everyone, Friends Only, or Private
• Allow or block specific users from seeing particular information
• Default settings favor sharing with friends over public visibility

B. LOCATION PRIVACY

• You appear in The Grid to other users in the same neighborhood or city as you
• You can choose whether to display your home neighborhood in your profile
• Other users cannot see your full location hierarchy, precise coordinates, or location history
• App requires location access for core functionality (cannot be disabled)
• When Festival Mode is enabled, your approximate location may be transmitted via Bluetooth mesh network for message routing
• You can maintain profile anonymity while still appearing in location-based feeds
• Location data is only used to determine proximity for Grid display and content relevance

C. CONTENT PRIVACY

• Posts are visible to all users within the location level where you post
• Messages between users are automatically encrypted with no user control needed. Encryption protects your messages in transit and at rest; it is not end-to-end, and access is restricted and limited to the safety, abuse-prevention, legal, and support purposes described in Section 2.B
• No control over appearing in other users' algorithmic recommendations
• No control over friend request discoverability settings

D. ALGORITHMIC CONTROLS

• Provide feedback to improve "For You" recommendations
• Report inappropriate or unwanted content
• Limited content filtering options available

5. DATA RETENTION AND DELETION

A. ACTIVE ACCOUNT DATA

• Profile information: Retained while account is active
• Posts and content: Stored indefinitely until manually deleted by user or account deactivation
• Messages: Retained for functionality and stored encrypted. Access is restricted and used only for the safety, abuse-prevention, legal, and support purposes described in Section 2.B
• Location history: Stored temporarily for service functionality including location verification, proximity matching, and recommendation improvements

B. ACCOUNT DELETION

• Account deletion removes profile and content within 30 days
• Some data may be retained for legal compliance or safety
• Backup copies may persist for up to 90 days
• Analytics data is anonymized and may be retained longer

C. AUTOMATIC DELETION

• Temporary location data is deleted after service use
• Crash reports and logs are deleted after analysis
• Diagnostic and testing data may have shorter retention periods
• Message delivery data is deleted after successful delivery

6. SECURITY AND PROTECTION

A. DATA ENCRYPTION

• All data transmission uses HTTPS encryption
• Messages between users are encrypted at rest using AES-256 (AES-CBC with HMAC-SHA256 authentication)
• Messages transmitted via Bluetooth mesh network are encrypted using AES-256-GCM encryption
• Bluetooth mesh networking operates peer-to-peer and does not transmit data to Grid servers
• Database storage uses standard MongoDB encryption
• Location data is stored in encrypted database

B. ACCESS CONTROLS

• Administrative staff can access profile data for support and moderation purposes
• Message content is stored encrypted. It is not end-to-end encrypted: because Grid manages the encryption keys, authorized staff can decrypt message content, but do so only for the safety, abuse-prevention, legal, and support purposes described in Section 2.B (for example, investigating spam, fake accounts, or reported abuse). We do not access message content for advertising or sell it to third parties
• Standard password-based authentication for internal systems
• Security measures are continuously reviewed and improved

C. SECURITY CONSIDERATIONS

• No online service can guarantee perfect security
• We actively monitor and patch security issues
• We recommend using strong, unique credentials and keeping your device secure
• Security measures are continuously improved based on ongoing testing

7. THIRD-PARTY INTEGRATIONS

A. MAPPING AND LOCATION SERVICES

• Map data is provided by third-party services
• Location processing may involve third-party services for functionality
• Precise user locations may be shared with mapping providers for service functionality
• Location data handling practices are periodically reviewed and refined

B. ANALYTICS AND PERFORMANCE

• Anonymous usage analytics help improve the service
• Crash reporting aids in bug fixes and stability
• Performance monitoring ensures service quality
• Analytics practices are periodically reviewed and refined

C. CLOUD INFRASTRUCTURE

• Data is stored using secure cloud services
• Cloud providers have strong privacy and security commitments
• Data residency and jurisdiction are carefully managed
• Backup and disaster recovery procedures protect user data

8. INTERNATIONAL DATA TRANSFERS

A. GLOBAL SERVICE PROVISION

• Data may be processed in different countries for service functionality
• We implement appropriate safeguards for international transfers
• EU users have specific rights under GDPR and related regulations
• Data processing agreements ensure consistent privacy protection

B. JURISDICTION AND COMPLIANCE

• We comply with applicable privacy laws in all operating jurisdictions
• Data localization requirements are respected where applicable
• Cross-border transfers use approved mechanisms and safeguards
• Users are informed of any significant changes to data processing locations

9. YOUR PRIVACY RIGHTS

A. ACCESS AND CONTROL

• Request access to all personal information we have about you
• Correct inaccurate or outdated information in your profile
• Download your data in a portable format
• Object to certain types of data processing

B. DELETION AND WITHDRAWAL

• Delete your account and associated data
• Remove specific posts or content items
• Withdraw consent for optional data processing
• Opt out of marketing communications and analytics

C. REGIONAL RIGHTS

• EU users have additional rights under GDPR
• California users have rights under CCPA
• Other jurisdictions may provide additional privacy rights
• We respond to all valid privacy rights requests promptly

10. CHILDREN'S PRIVACY

• Grid is designed for users 18 years and older
• We do not knowingly collect information from minors
• If we discover a minor has created an account, it will be promptly deleted
• Parents concerned about their minor's potential use should contact us

11. CHANGES TO THIS PRIVACY POLICY

A. POLICY EVOLUTION

• This policy may change as the service evolves
• Significant changes will be communicated via email and in-app notification
• Continued use constitutes acceptance of updated privacy practices
• You will have the opportunity to review material changes before they take effect

B. NOTIFICATION PROCESS

• Material changes require prominent notice and user consent
• Technical or administrative changes may be updated with general notice
• Privacy policy version history is available upon request
• Users concerned about changes can delete their account before changes take effect