Privacy Policy

1. Introduction

GridClash ("we", "us", "our") operates a classroom quiz game for teachers. This Privacy Policy explains how we collect, use, store, and share personal information when you use our website and application (the "Service").

This document is a draft for legal review. It describes our current product behaviour as implemented in our application. Please read it carefully before creating an account or using paid features.

2. Who we are

The Service is provided by GridClash Pty Ltd (ABN [ABN to be inserted]), based in Australia.

Privacy enquiries: privacy@gridclash.com. General support: jamesbolanddev@gmail.com.

3. Who the Service is for

The Service is designed for teachers and other adults who run classroom activities. It is not directed at children, and we do not knowingly create accounts for students.

Students may participate in games run by a teacher on a shared screen. Students do not need accounts to play. Teachers should not upload documents containing student personal information (for example, class lists with student names) to our AI question generator.

4. Information we collect

We collect the following categories of information:

• Account information — email address, password (stored as a secure hash), and optional profile details you provide at sign-up (such as title, first name, and last name). If you sign in with Google, we receive profile information from Google via our authentication provider.
• Saved game content — quiz boards you choose to save, including board names, categories, questions, answers, team names, scores, and game configuration. Team names are entered by you and may indirectly relate to students in your class.
• Billing information — subscription tier and Stripe customer/subscription identifiers. Payment card details are collected and processed by Stripe; we do not store full card numbers on our servers.
• AI generation metadata — when you use question generation, we log event metadata (file type, file size, success or error status). We do not store uploaded syllabus files or extracted document text in our database.
• Product analytics — when enabled, we send basic usage events (for example, when you start a demo, save a board, or complete checkout) to help us understand how the Service is used and improve reliability. We do not send syllabus text, generated questions, student names, suggestion post content, or AI prompts to our analytics provider.
• Technical information — session cookies required for authentication, and standard server or hosting logs (which may include IP address and browser type) maintained by our infrastructure providers.
• Local browser storage — we may temporarily store a board snapshot in your browser's local storage (for example, to preserve your work during sign-in). This data stays on your device until cleared.

5. How we use information

We use personal information to:

GridClash uses basic product analytics to understand usage, improve reliability, and decide what to improve. Analytics is limited to manual product events (such as starting a demo or saving a board) and does not include syllabus text, generated questions, student names, suggestion content, or AI prompts. We do not use advertising trackers or session replay.

• Provide, operate, and improve the Service
• Authenticate you and save your quiz boards
• Process subscriptions and manage billing
• Generate quiz questions when you upload materials and request AI assistance
• Enforce usage limits and protect against abuse
• Respond to support requests and comply with legal obligations

6. AI question generation

When you use AI question generation, text extracted from your uploaded file (PDF, spreadsheet, or similar) is sent to OpenAI to produce quiz questions. That content is processed to provide the feature and is not stored in our database after the request completes.

OpenAI processes data under its own terms and privacy policy. We recommend not uploading materials that contain personal information about students or sensitive information you are not authorised to share.

AI-generated questions may contain errors. You are responsible for reviewing all content before use in class.

7. Cookies and local storage

We use strictly necessary cookies to keep you signed in (via our authentication provider). These cookies are essential for account features such as saving boards.

We may use local storage in your browser for temporary convenience (for example, preserving a board during sign-in). You can clear this data through your browser settings.

When product analytics is enabled, our analytics provider may set cookies or use local storage to associate events with a browser session. We do not use advertising cookies or session replay.

8. Sharing and subprocessors

We do not sell your personal information. We share information with service providers who help us operate the Service, only as needed to perform their functions:

We may also disclose information if required by law, to protect our rights, or in connection with a business transaction (such as a merger), subject to applicable law.

• Supabase — authentication, database, and session management
• Stripe — subscription billing and payment processing
• OpenAI — AI question generation from teacher-uploaded materials
• PostHog — basic product analytics (usage events only; no session replay)
• Google — optional sign-in via OAuth (when you choose that option)
• Vercel — application hosting and infrastructure

9. International transfers

We are based in Australia, but our subprocessors may process data in other countries (including the United States). Where personal information is disclosed overseas, we take reasonable steps to ensure recipients handle it in accordance with applicable privacy law.

If you access the Service from outside Australia, you acknowledge that your information may be transferred to and processed in countries with different data protection laws.

10. Retention

We retain account and saved board data while your account is active. If you delete your account, we delete your authentication record and associated saved boards, generation event logs, and profile data from our database (subject to cascade deletion through our authentication provider).

Billing records may be retained by Stripe in accordance with Stripe's policies and legal requirements.

Server and webhook logs may be retained for a limited period for security, debugging, and legal compliance.

11. Security

We implement technical and organisational measures appropriate to the nature of the data we hold, including access controls, encryption in transit, and row-level security so teachers can access only their own saved boards.

No method of transmission or storage is completely secure. If you believe your account has been compromised, contact us promptly.

12. Your rights

Depending on where you live, you may have rights to access, correct, delete, or export personal information we hold about you, or to object to or restrict certain processing.

You can delete your account from the account menu in the application (Setup screen). You may also contact us at the email above to request access, correction, or deletion.

If you are in Australia, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC). If you are in the European Economic Area or United Kingdom, you may contact your local data protection authority.

13. Children and schools

The Service is intended for teacher use. We do not knowingly collect personal information directly from children under 13 (or the applicable age in your jurisdiction).

If you are a school or institution evaluating the Service for classroom use, contact us to discuss data processing arrangements that may be required in your jurisdiction.

14. Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised version on this page and update the effective date. Material changes may also be notified by email or in-app notice where appropriate.

15. Contact

Questions about this Privacy Policy or our handling of personal information: privacy@gridclash.com.