Privacy Policy

This Privacy Policy describes how Grift (“we”, “us”, “the app”) collects, uses, and shares information when you use the Grift mobile application.

By using Grift you agree to the practices described below. If you do not agree, do not use the app.

1. Information we collect

1.1 Information you give us

• Sign-in identity. When you create an account via Sign in with Apple or Sign in with Google, we receive a stable provider-issued user identifier and, if you choose to share them, your name and an email address (Apple may generate a private relay address on your behalf; Google provides the email associated with your Google account). We store these to identify your account and contact you about your account.
• Profile information. Display name, handle, bio, and avatar image you set in the app.
• Posts and reactions. Photos and videos you post (including captions), comments you write (text and any picture you attach), reactions (likes, dislikes, comment likes, seasonal votes), reports you file, follow relationships, and block relationships.
• Purchases. If you buy Goin or Greemium in the app, the purchase is handled entirely by Apple (App Store) or Google (Google Play). We never receive your payment card or bank details. We receive and store a record of each purchase: the product, the store’s transaction or order ID, the date, the store region, whether it was a test (sandbox) purchase, and refund status, linked to your account so we can deliver what you bought, handle refunds, and prevent fraud. We also keep a history of your Goin balance changes (earned, bought, spent, refunded).
• Camera, microphone, and photo library. The app asks for camera, microphone, and photo library access only so you can capture or pick photos and videos to post. We only receive the media you choose to post.

1.2 Information collected automatically

• Activity in the app. Information generated as you use Grift and stored with your account, such as which posts you have already viewed (so the feed doesn’t repeat them), your Grift Score, posting streaks, daily post counts, arcade plays and their results, in-app tokens, tickets, and other virtual items, the borders and post effects you own, and duel history.
• Device region. When you open the Goin Shop or a Grifty Bag, the app sends your device’s region setting (a two-letter country code) so we can turn off features that aren’t available in some countries. It is not stored with your account.
• Push notification token. If you allow notifications, we store your device’s push token (whether it is an iOS or Android device, and which app version it runs, so we only notify devices that can show a feature) with your account so we can deliver notifications. The token is removed from your account when you sign out.
• App integrity checks. We use Firebase App Check, which relies on your device platform’s attestation service (such as Apple App Attest or DeviceCheck), to confirm that requests come from a genuine copy of the app.
• Authentication tokens. Firebase Authentication stores a token on your device so you stay signed in between launches. The token is removed when you sign out.
• On-device storage. The app stores some settings and cached images and videos on your device to make it faster. This data stays on your device.
• Server logs. Our backend keeps routine operational logs (which can include your account’s user ID) to run the service and fix problems.

We do not use a crash-reporting, analytics, or performance-monitoring SDK.

1.3 What we do not collect

• We do not use IDFA, fingerprinting, or any other cross-app tracking identifier.
• We do not access your address book, contacts, calendar, location, health data, or precise advertising identifiers.
• We do not sell, rent, or share your personal information with third-party advertisers.

2. How we use your information

We use the information we collect to:

• Run the core features of the app (signing you in, displaying posts, sending notifications you opt into).
• Enforce the post-per-day limit and 3-day post expiration.
• Detect and respond to abuse (spam, harassment, content that violates our Community Guidelines), including automated screening of posts and comments for prohibited content (see Section 3).
• Diagnose and fix bugs.

3. How we share your information

We share information with the following third parties strictly to operate the service:

• Apple, for Sign in with Apple identity verification, and (App Store) to process in-app purchases and tell us about refunds.
• Google Play, to process in-app purchases on Android and tell us about refunds.
• Google, for Sign in with Google identity verification (separate from Firebase, below).
• Google Firebase, which provides our authentication, database (Firestore), file storage, push notifications, and abuse-prevention (App Check) infrastructure. Firebase processes data on our behalf under Google’s data-processing terms. Firebase’s software in the app may also send Google limited technical data (such as SDK and platform versions) that is not linked to your account.
• OpenAI, for automated content moderation. When you create a post, or create or edit a comment, our servers send the post caption or comment text, and a link to each of the post’s photos (up to five; for a video, its thumbnail image) or the comment’s attached picture, to OpenAI’s moderation API, which checks them for prohibited content such as sexual content or graphic violence. We do not send your name or email address; image links can contain internal IDs (such as an account ID in a comment picture’s storage path) but nothing that identifies you directly. The results are used only for safety and moderation (for example, holding a post for human review or removing a picture comment); they are not used for advertising. Under OpenAI’s API policies, data sent through the API is not used to train OpenAI’s models by default. See OpenAI’s Privacy Policy and API data usage information for how OpenAI handles this data.

We may disclose information if required by law (subpoena, court order, or similar legal process), or to protect the rights, property, or safety of Grift, our users, or the public.

4. Your rights and choices

• View and edit your profile. Use the “Edit profile” sheet in the Me tab.
• Block another user. Use the “Block @handle” action in any user’s profile. Blocking is reversible.
• Delete your account. Use the “Delete account” action in the Me tab’s settings menu. This permanently deletes your Firebase Auth account, your profile and avatar, your posts and their photos and videos, your comments, reactions, comment likes, and votes, your follow and block relationships, your viewed-posts history, push tokens, notifications, arcade and game data, and your Goin balance and history. Any unused Goin, Greemium time, and virtual items are lost and are not refunded. This action cannot be undone.
• Sign out. Use the “Sign out” action in the Me tab’s settings menu.

If you are in a jurisdiction with data-protection laws that grant additional rights (e.g. GDPR, CCPA), email us at the address below to exercise them.

5. Children

Grift is not directed to children under 13 (or under 16 in the EEA), and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, contact us so we can delete it.

6. Data retention

We retain your account data for as long as your account is active. Posts expire 3 days after they are published and are then deleted from our servers, along with their photos and videos, by a cleanup that runs daily. When you delete your account, we delete your account data within 30 days, except that:

• Records of reports and moderation actions (for example, reports you filed or that were filed about your content, and our moderation log) may be kept so we can enforce our rules and prevent abuse.
• Records of completed duels and Snowball Fight matches, which involve another user, may be kept.
• Records of in-app purchases (described in section 1.1) are kept so we can handle refunds and chargebacks, prevent fraud, and meet accounting and tax obligations.
• Routine server logs are deleted on a rolling basis.
• We may keep specific records longer where we are legally required to.

7. Security

We use industry-standard measures (TLS in transit, encrypted Firebase storage at rest, App Check on backend requests) to protect your information. No system is perfect, however, and we cannot guarantee absolute security.

8. Changes to this policy

If we materially change this policy we will update the date above and notify users in the app. Continued use after a change constitutes acceptance of the revised policy.

9. Contact

Questions or requests? Email griftsocial@gmail.com.