Privacy Policy

This policy explains what GrandBower ("we") collects, why, how we protect it, and the choices you have. It reflects how the service actually works today during Early Access.

Who we are

GrandBower is operated by 137 & Co., a Maryland company, which is the controller of your personal data. Contact us about privacy at privacy@grandbower.com.

Who can use GrandBower

GrandBower is intended for adults. You must confirm you are 18 or older to create an account. We do not knowingly collect data from anyone under 18. We do not ask for or store your date of birth — only your one-time confirmation that you meet the age requirement.

What we collect

• Account: a username, your email address, and a password.
• Profile (optional): display name, bio, and an avatar image you choose to upload.
• Gameplay: match records, statistics, ratings, achievements, and in-game chat.
• Technical: limited request metadata (such as IP address) used transiently for security, rate limiting, abuse prevention and service diagnostics. Staff actions are logged with the staff member's IP address. We do not use IP addresses for advertising or profiling.

Why we use it

• To provide the service you signed up for (account, matchmaking, ratings, chat, clubs, replays): necessary to perform our agreement with you.
• To keep the service secure and fair (rate limiting, moderation, cheat detection, audit logging): our legitimate interest in protecting players and the platform.
• To send account emails (verification, password reset): necessary to perform our agreement with you. We do not send marketing email.
• Optional analytics or advertising: only with your consent, which you can withdraw at any time.

An email address, username and password are required to create an account; without them we cannot provide the service. Everything else is optional.

How we protect it

• Your email address is encrypted at rest (AES-256-GCM) and indexed only through a one-way hash, so day-to-day lookups never expose it.
• Passwords are hashed with Argon2id and are never stored or transmitted in plain text.
• Traffic is served over TLS. Administrative access to personal data is role-restricted, and every access to your decrypted data by staff is recorded in an append-only audit log.

Advertising

Early Access is supported by non-intrusive ads. Today these ads are first-party and non-personalized: they set no advertising cookies and send no personal identifier to any third party. We count only anonymous, aggregate impressions and clicks. If we later introduce a third-party ad network or personalized advertising, we will ask for your consent first through our cookie/consent controls.

Cookies & local storage

We use your browser's local storage to keep you signed in and to remember your settings and consent choices. These are strictly necessary for the service to function. See our Cookie Policy for details. We do not use third-party analytics or tracking.

How long we keep data

• Account data: while your account is active.
• In-game chat: about 90 days after the game ends.
• Club chat: about 90 days.
• Reported chat (moderation): 30 days, after which the raw chat expires; the moderation outcome is kept in our security log.
• Security/audit log: kept for as long as needed to protect the service and demonstrate compliance. This log is append-only and, where it references an account, may persist after that account is deleted.
• Backups: daily backups are kept for 14 days, so deleted data can remain in a backup for up to 14 days before it is overwritten.

Your rights

You can access and export your data, and delete your account, directly in the app under Settings → Privacy & Data. Deletion anonymizes your account: your username is released, and your email, password, profile and avatar are erased. Gameplay records are kept in anonymized form. Chat messages you sent stay attached to an anonymous name until they expire on the schedule above. The append-only security/audit log is preserved, as described above.

Depending on where you live, you may also have the right to correct your data, object to or restrict its use, and withdraw consent. If you are in the EU or UK, you can also complain to your local data protection authority. To exercise any right not available in the app, email privacy@grandbower.com.

Service providers

We host GrandBower on infrastructure we operate ourselves, including the storage for avatar images. We use Mailjet to deliver verification and account emails; it receives your email address and the message content and processes them only on our instructions. We do not sell your personal data or share it for cross-context behavioral advertising. We operate from the United States, so if you use GrandBower from outside it, your data is processed in the United States.

Contact

Email privacy@grandbower.com, or use Settings → Privacy & Data in the app. If we change this policy materially, we will tell you in the app and ask you to review it.