Privacy Policy

Effective: 16 May 2026

This Privacy Policy explains how Gridzen (“we”, “our”, or “us”) collects, uses, and shares information when you use the Gridzen mobile app and related services (the “Service”). Gridzen is published by Zentech Softech India Pvt Ltd.

If you have any questions about this policy, contact us at play.app.store@zentechsolution.com.

1. Information we collect

We collect only what’s needed to run the Service. We do not sell your data and we do not run advertising or behavioural tracking.

1.1 Account information

When you create an account, we collect:

Email address — used to identify your account, allow you to sign in, and send password-reset codes.
Username — displayed publicly on leaderboards and during multiplayer matches.
Password — stored only as a salted hash (bcrypt). The plain password never reaches our servers’ disk or logs.
Sign-in-with-Apple identifier (if you use Apple sign-in) — the opaque user ID Apple provides, plus the email address you authorise Apple to share with us.
Google sign-in identifier (if you use Google sign-in) — the opaque user ID Google provides, plus your verified email address.

Guests can play without an email; we generate an anonymous guest ID that lives only on your device’s secure storage and on our database.

1.2 Gameplay data

To run the game and show your progress, we store:

Which puzzles you’ve started, completed, or skipped, and how long each one took.
Your daily streaks, win rates, and average completion times per game.
Your ELO rating, win/loss record, and match history for the multiplayer mode.
Hint and coin balances, and which hints you’ve used per puzzle.

1.3 Diagnostic data

When the app or server encounters an error, we send a crash report to Sentry (https://sentry.io). These reports include:

The error message and stack trace.
The screen or API endpoint where the error occurred.
App version, OS version, and device model.
A timestamp.

Crash reports are stripped of authorization headers and IP addresses before they leave the server. We do not send the contents of any puzzle, your password, or any payment information.

1.4 Server logs

Our hosting provider (Render) keeps short-lived web access logs (request URL, response code, timestamp, IP address) for operational and security purposes. These logs are retained for a limited period (typically 7 days) and are not used for marketing.

2. How we use information

We use the data described above only to:

Provide the Service: serve puzzles, sync progress across devices, match you with opponents, show leaderboards.
Authenticate you and protect your account.
Send transactional emails (currently only password-reset codes).
Investigate crashes, bugs, and abuse.
Comply with legal obligations.

We do not use your data for advertising. We do not sell your data.

We share data only with the third-party processors that are necessary to run the Service. Each processor is contractually limited to using the data for the services they provide to us.

Processor	What they receive	Why
Render (USA)	Application data, server logs	Application hosting + database
Resend (USA)	Recipient email + plain-text message body	Sending password-reset emails
Sentry (Germany / EU)	Crash reports as described in §1.3	Error monitoring
Apple (USA)	Sign-in token	Verifying Sign in with Apple
Google (USA)	Sign-in token	Verifying Google sign-in
UptimeRobot (USA)	Public `/health` ping responses only	Uptime monitoring

Aside from these processors, we share information only when:

You explicitly ask us to (e.g. publishing your username on a public leaderboard).
We are required by law (e.g. a valid legal process).
We need to investigate fraud or a security incident.

4. How long we keep your data

We keep your account data for as long as your account exists. When you delete your account from inside the app (Profile → Delete account), we permanently remove:

Your user record (email, username, password hash, OAuth IDs).
Your puzzle progress and stats.
Your multiplayer ELO and match history.

Server logs and Sentry crash reports may persist for their retention window (≤30 days) before they roll off. Aggregated statistics that do not identify you (e.g. global daily-puzzle completion rate) may be retained indefinitely.

5. Your choices and rights

You can, at any time:

See your data: open the Profile tab to view your email, username, hint balance, and coin balance. Email us for a fuller export.
Correct your data: change your username via the in-app flow. To change your email, contact us.
Delete your data: tap Profile → Delete account. Deletion is immediate and irreversible.
Reset your password: tap “Forgot password?” on the sign-in screen.

If you’re in a jurisdiction with additional rights (e.g. the EU’s GDPR or India’s DPDP Act), you may have the right to object to processing, restrict processing, or lodge a complaint with your data-protection authority. To exercise these rights, email us.

6. Children

Gridzen is not directed at children under 13. We do not knowingly collect personal data from anyone under 13. If you believe a child under 13 has created an account, please contact us and we will delete the account.

7. Data security

We protect your data with:

HTTPS (TLS) for all traffic between the app and our servers.
Salted password hashing (bcrypt) — plain passwords never persist.
JWT-based session tokens, with short-lived access tokens and rotatable refresh tokens.
Rate limits on authentication endpoints to deter credential stuffing.
No third-party tracking SDKs.

No system is perfectly secure. If we ever experience a breach that affects your account, we will notify affected users without undue delay.

8. International transfers

Gridzen is operated from India. The third-party processors listed in §3 may process data in the United States or the European Union. By using the Service you consent to these international transfers, which are protected by industry-standard agreements with each processor.

9. Changes to this policy

We may update this policy from time to time. When we do, we will change the “Effective” date at the top and, for material changes, we will notify you in the app or by email at least 7 days before the change takes effect.

10. Contact

Zentech Softech India Pvt Ltd
Email: play.app.store@zentechsolution.com

Postal address available on request.