Grasroot Privacy Policy

Status: this page accurately describes current product behavior, but has not yet had a full external legal review. It is a real, current policy — not a placeholder — and will be revised as that review completes.

Information we collect

We collect account information (email or sign-in identifier, display name), gameplay data (quiz sessions, scores, answers), leaderboard rankings, Challenge activity (Challenges you create or accept), and analytics necessary to operate and improve the app.

How we use it

To provide gameplay, show rankings and Challenge results, improve product quality, prevent fraud and abuse, and comply with legal obligations. Public result and Challenge pages (like this one's sibling `/challenge/*` and `/result/*` pages) only ever show a narrowed, approved projection — question count, category, country, and score — never raw session data, answer keys, or other players' private gameplay.

Data sharing

We do not sell personal data. We may share information with service providers who help us operate the app (hosting, analytics, content infrastructure), or when legally required to by law enforcement or regulation.

Where your data lives

Grasroot currently relies on Firebase-backed identity, gameplay, and leaderboard infrastructure, alongside Supabase-backed content and civic-data systems. Operationally necessary service providers may process data on our behalf under the same obligations described here.

Retention

We retain your data while your account is active, or as required by law. You can request deletion at any time — see below.

Your rights

Depending on your jurisdiction, you may have rights to access, correct, or delete your personal data. You can request account deletion at /account-deletion or request deletion of specific data at /data-deletion.

Contact

For privacy questions, or anything not covered by the deletion request pages above, use the in-app support option (Settings → Contact Support) or submit a request through Account Deletion with your question in the details field — it reaches the same team.