Privacy Policy

1. Who we are and what this covers

Next Grails is run by Never Offline LLC, a limited liability company based in Florida ("we", "us"). Our mailing address is 3906 NE 20th Cir, Homestead, FL 33033. You can reach us about privacy at support@nextgrails.com.

This policy covers our website at nextgrails.com, the Next Grails app at app.nextgrails.com, and the emails and alerts we send. It does not cover the sites we link to, such as eBay, TCGplayer or PSA. Their own privacy policies apply there.

2. What we collect today

Next Grails is in private beta. There are no personal accounts yet. Members sign in with one shared password, so we don't know who any member is. Here is everything we handle that could relate to you.

The earlier sign-up form (closed) Today

Before Next Grails opened to everyone, our website had a form where you could leave your email. That form is closed, and nothing new is added to it. For each email already given to it, we keep on our server:

• your email address;
• the game of the pack you opened on our site, if you opened one, and the plan you chose under Pricing, if you chose one;
• whether you ticked "Email me about Next Grails news and offers", which version of the form's wording you saw, and when you sent it (and when you last sent it, if you sent it again);
• if you ask us to stop only the news and offers, when we stopped them.

We never kept your IP address or browser details with it. Your email address never goes to Google Analytics (section 7).

• Why: to keep a record of what you chose. If you ticked the box, we may send you news and offers about Next Grails; without it, we don't email you from this list.
• How long: until you unsubscribe or ask us to remove you, or 12 months after launch, whichever comes first (section 9).
• How to be removed: every email we send has an unsubscribe link. You can also email support@nextgrails.com from the address you gave us and ask us to delete it, or to stop only the news and offers. We act on it within 10 business days.

What we don't collect

We don't use advertising cookies, advertising or tracking pixels, or session recording. The only analytics are the Google Analytics described in section 7, in our website and the app, and our own activity log in the app, also in section 7. We don't buy information about you from anyone.

3. What we will collect when paid plans open Planned

None of this exists yet. We will update this policy before any of it starts.

• Your account. Your email address, and a name if you give one. An authentication provider will handle sign-in. If you use a password, that provider holds it, not us.
• Billing. Stripe, our payment processor, collects your card details. We never see or store your full card number. Stripe will give us your name, email, billing country and postal code, the card's brand, last four digits and expiry date, your plan and your payment history.
• Proof of your agreement. When you subscribe, we keep a record that you agreed to the automatic-renewal terms: the time, your plan and price, and the version of the terms you were shown. The law requires this.
• Emails we send you. A record of the receipts, renewal reminders, price-change notices and cancellation confirmations we sent you, and your cancellation requests.
• Your own lists and alerts. Your watchlist, notes, price targets and alert rules, linked to your account, and where you want alerts sent (your email address, or a Discord link you give us).
• Plan limits. Counts tied to your account, such as how many Buy checker lookups you have used today.
• How you use the app. Daily counts tied to your account of which features you use, such as how many cards you opened or how many Buy checker runs you made that day, and the campaign or site you came from when you signed up, if the link you followed said so. See section 7.
• Your poll answers. Your pick in each weekly Grail Vote, the reason you gave if you gave one, and when you voted. See section 7.
• Your Quick play answers. Each vote and quiz you answer on the loading screen's Grail Vote · Quick play (the cards, your pick, whether a quiz answer was right, the numbers it showed and the day), and your streak, best streak and today's score. See section 7.
• Error reports. If we add an error-monitoring service, technical details of errors you run into (browser type, the page and the time).

4. Shared features while members share one password Today

Today the watchlist, alert rules, price targets and hidden listings are one shared set for every member. They are not tied to you, but anything you add or change can be seen and changed by every other member.

Alerts from the shared alert rules and price targets are posted to a Discord channel we run. The people we let into that channel can see them.

Please don't put personal information in these features. We plan to make them personal to each account when accounts open.

5. Information about marketplace sellers

To show listings and deals, we store public details from eBay listings: the title, price, photos and item location country, and the seller's eBay username, feedback percentage and feedback count. Members can see seller usernames on the Deals page and in Buy checker results. Our Discord alerts include the seller's feedback figures but not their username.

If you sell on eBay and want your username removed from Next Grails, email support@nextgrails.com with your username. We will delete it from the listings we have stored. Our scans read new eBay listings every few hours, so your username can come back on a new listing until we have a way to block it permanently. If that happens, tell us and we will remove it again.

6. How we use information

• To run the service, keep you signed in, keep it secure and prevent abuse.
• To answer your questions and requests.
• Planned To take payments and send receipts, renewal reminders, price-change notices and cancellation confirmations.
• Today To send news and offers about Next Grails only to people who ticked the box for them (section 2), and product news to members who want it. You can unsubscribe at any time.
• To keep records the law requires, such as proof of your agreement to automatic renewal and tax records.
• To find and fix problems.
• To count visits and see, in aggregate, which parts of our website are used (analytics, section 7). Not to identify you, and not to advertise to you.
• To see which parts of the app members use, so we can improve it (Google Analytics in the app, and our own activity log, section 7), and, only if you have agreed to hear from us, to tell you about new features and plans that fit how you use Next Grails. Every such email has an unsubscribe link.
• To show members each weekly Grail Vote's counts (never who voted for what) and the record of members' picks against our own, and, only if you have agreed to hear from us, to make our emails fit the cards you pick (section 7).
• To show members how they split on Quick play's votes (never who picked what), to keep your Quick play streak and score, and so you aren't shown the same match-up twice (section 7). Never for emails.

We don't use your information for advertising. Our signals are about cards, not people: we don't make automated decisions about you.

7. Cookies, browser storage and analytics

We use no advertising cookies and no tracking pixels. The only cookies that aren't needed to run the site are the two analytics cookies above, explained below.

You can clear cookies and site data in your browser at any time. Clearing them signs you out of the app and resets your settings. The app's Sign out button also deletes the sign-in cookie.

Analytics: Google Analytics, through Google Tag Manager

Our website (nextgrails.com and these policy pages) uses Google Tag Manager, which loads our measurement code, and Google Analytics 4, which counts visits. Both are run by Google. We use them to see how many people visit, which pages and sections they read and which buttons they use, so we can improve the site. They don't tell us who you are.

What Google Analytics collects, while it is on for you:

• the pages you view, their titles and addresses, and the page that sent you here (we strip email addresses and similar details out of addresses before they are sent);
• your device and browser: the kind of device, its operating system, the browser, screen size and language;
• your approximate location (country, region and city), which Google works out from your IP address. Google says Google Analytics doesn't log or store IP addresses;
• how you use the page, such as time on the page and how far you scroll, and these actions on our home page: when the Pricing section comes into view; which plan button you click (the plan, monthly or yearly, and where on the page it was); clicks on "Sign in" and on links into the app (the app page's address, without anything after it); which question you open under Questions; and which game you click on the market tape;
• a random ID, kept in the _ga cookie, so repeat visits can be counted. It isn't your name or email, and we don't link it to them.

We never send Google your email address, your name, a phone number, or any account or payment ID.

Our own count. We also count visits and sign-up clicks on our own server, under the same choice: we keep the page, the button, the site you came from (its domain only) and any campaign tag on the link, with a random code (the ng_vid cookie); we don't keep your IP address. When you open our sign-up page we count it without a cookie using a code made from your connection that changes every day and can't be traced back to you; we skip this if your browser sends Global Privacy Control or Do Not Track or you said No thanks.

When it is on.

• In the European Economic Area, the United Kingdom and Switzerland, analytics stay off until you agree. Google decides where you are from your IP address. Our website also asks, with a banner, anyone whose device is set to a European time zone: until you choose "Allow analytics", our pages don't load Google's code at all. If Google places you there but we didn't ask you (for example, your device uses another time zone), Google Analytics doesn't run: no cookies are set and nothing is measured or sent until you choose "Allow analytics" in "Cookie settings". You can say yes or no at any time in "Cookie settings".
• Everywhere else, analytics are on when you arrive, and you can turn them off at any time.
• If your browser sends Global Privacy Control or Do Not Track, analytics stay off and our pages don't load Google's code. See section 12.

No advertising. We don't use Google's advertising features anywhere: no advertising cookies, no remarketing, no ad personalization, and Google Signals is off. We have turned off Google Analytics' settings that share our data with Google for its own products, so Google processes it only to provide the service to us. We don't sell this information or share it for advertising.

How to turn it off. Use "Cookie settings" at the foot of any page of our website: choose "No thanks" and we stop the analytics straight away and delete its cookies from your browser. You can also install Google's Google Analytics opt-out browser add-on, turn on Global Privacy Control, or block or clear cookies in your browser.

How long it is kept. Google Analytics keeps the data tied to the cookie's ID for 14 months, then deletes it. Reports made from it, which are counts with no one in them, stay. The _ga cookies last 13 months from your last visit. Your choice stays in your browser: an "Allow" for 12 months; a "No thanks" for 12 months in European time zones, where we then ask again, and elsewhere until you clear it.

Google's own privacy policy and its page on how Google uses information from sites that use its services explain more.

Analytics in the app

The app at app.nextgrails.com uses the same Google Tag Manager and Google Analytics as our website, with the same choices: the same banner where we ask (in European time zones), the same "Cookie settings" (at the foot of each page of the app), and Global Privacy Control and Do Not Track respected in the same way. Your choice is shared: if you said "No thanks" on our website, analytics stay off in the app, and the other way round (the ng_consent cookie above). Our sign-in and sign-up pages never load Google's code.

What it records in the app, while it is on for you, besides what the list above says for our website:

• the app pages you open: their address with the page's name after "#" (for example app.nextgrails.com/#pokemon/sealed), never anything you typed, and their title; on the first page of a visit, the campaign the link you followed was tagged with (such as utm_source=newsletter), if any;
• your plan: Holo or Secret Rare (or none yet), and whether you pay for it or we gave it to you, so we can see which features each plan's members use;
• these actions, with short codes only: signing up or signing in (and whether with email or Google); opening a card (which card, by its catalog number, not your name); starring or unstarring a card; setting a price alert (whether it watches the PSA 10 or the raw price, never the price); running the Buy checker (how many lines, as a range, never the lines); using the Low pop finder's filters (which filter, and a search only as "set" or "cleared", never its words); opening Sealed or a deal; clicking an eBay link (which part of the app it was in); exporting a CSV; switching between games; choosing in a card's window how its pages change or how it opens (which of the two, the choice you made and the kind of window, nothing else); voting in a weekly Grail Vote (which card, by its catalog number, never the reason you picked); seeing a Secret Rare lock and pressing "Upgrade"; opening the billing page; on the cancel screen, opening it, the reason you tapped (one of its fixed choices, never words you typed), switching to Holo, pausing (for how many months), seeing, taking or turning down the half-price offer, and cancelling; starting a checkout (and, from Upgrade to Secret Rare, which locked feature led there) and a confirmed purchase or upgrade (the plan, monthly or yearly, the price, and a random-looking code we make for that purchase, never your card details or any payment ID).

We never send Google your email address, your name, what you type into the app (searches, cards you paste, prices), or any account or payment ID. If your browser sends Global Privacy Control or Do Not Track, you said "No thanks", or we are still waiting for your answer where we ask, nothing is sent and nothing for analytics is kept in your browser; a sign-up or purchase on a page where we are still asking is sent only if you then choose "Allow analytics" on that page.

Our own activity log in the app

When personal accounts are open, Next Grails also keeps its own record of how each member's account uses the app. It is not a recording of everything you do: for each day, it keeps how many times your account did each of a fixed list of things (for example: visited, started a session (counted by our server when your account makes a request after 30 minutes without one), opened card windows, opened the Deals page, starred a card, set a price alert, ran the Buy checker, used the Low pop finder's filters, clicked an eBay link, saw a Secret Rare lock and which one, started a checkout or an upgrade, opened the cancel screen, and when your plan started, was upgraded or was set to end), and when the last one was. It also keeps the campaign or site you came from when you signed up, if the link you followed said so. It never keeps which cards you looked at, what you searched for or typed, or the pages' addresses, and it stores nothing in your browser.

• Why: to see which features members use, so we can improve Next Grails and plan new features and plans; to spot problems (an account that can't reach a feature it pays for); and, only if you have agreed to hear from us, to tell you about features and plans that fit how you use it. We don't use it for advertising, and we don't sell or share it.
• Who sees it: only the owner of Next Grails, in the members list of our own admin page (with your email address, plan and the counts above), and in a spreadsheet the owner can download to their own computer, for the reasons above. It is kept on our server (our hosting provider's, section 8). If we email members who agreed to hear from us, their address goes to our email provider (section 8) for that alone. It is never uploaded to an advertising platform.
• Whose: members' own accounts only. The owner's own use is never counted.
• How long: each day's counts are deleted after 13 months, and all of them are deleted with your account (section 9).
• Your choice: it isn't affected by "Cookie settings" (it sets no cookie, stores nothing in your browser and sends nothing to Google). You can object to it at any time: we then stop counting your account and delete what we have (section 11). You can also ask us to see or delete it.

When you cancel, pause or change your plan

When you open the cancel screen in your account, we keep, tied to your account, what you did there: when you opened it, the reason you tapped if you picked one, anything you typed under "Other", and whether you switched to Holo, paused (and for how long), saw, took or turned down the half-price offer, cancelled, or took a cancellation back. We also keep the answer you gave to the half-price offer with your billing details at our payment processor, so it is offered once per customer. We use this to run your plan as you chose, and to see why members leave so we can improve Next Grails. Only the owner of Next Grails sees it, in our own admin page. When your account is deleted, what you typed is deleted and the rest stays only as counts, no longer tied to you (section 9).

Poll answers

The app's weekly Grail Vote asks which card of a world's newest sets will gain the most over the next year. Voting needs a personal account: while members sign in with the shared password, they can see each poll but not vote, and no answer is kept. When you vote, we keep your pick, the reason you chose if you gave one, and when you voted, tied to your account; if you close the poll without voting, in the weekly reminder or on the loading screen, we keep that too, so the reminder doesn't come back for that poll. We use your answers to show members the counts (never who voted for what), to keep the record of members' picks against our own, and, only if you have agreed to hear from us, to make our emails fit the cards you like. Only the owner of Next Grails sees answers with the account they came from (in our own admin page and a spreadsheet the owner can download, as for the activity log above). They are never sold, never uploaded to an advertising platform, and deleted with your account (section 9).

While a page loads, the loading screen's Grail Vote · Quick play offers quick votes and quizzes about cards. As for the weekly Grail Vote, nothing you answer there is kept while members sign in with the shared password. With a personal account, we keep each answer, tied to your account: the cards, your pick, whether a quiz answer was right, the numbers the answer showed and the day; and your current streak, your best streak and today's score. We use them to show members how they split on a vote (never who picked what), to keep your streak and score, and so you aren't shown the same match-up twice. In our own admin page, the owner of Next Grails sees them only as counts (answers per day, how often each kind of quiz is answered right, the cards picked most), never with the account they came from. Each answer is deleted 180 days after you gave it; your streak and best streak are kept while your account is open; all of it is deleted with your account (section 9). They are never sold, never uploaded to an advertising platform, and never used for emails.

Alerts on your devices and in Discord

Your alerts are always listed on your Alerts page in the app. If you choose, we also send them to you:

• As notifications on your phone or computer. When you turn on "This device" on your Alerts page, your browser gives us a push subscription: an address at your browser maker's push service (Google, Apple, Mozilla or Microsoft) and two keys. We keep it with your account, with a short device name read from your browser (such as "Android · Chrome") and when an alert last reached it. Each alert is encrypted so that only your browser can read it: the push service passes it on without seeing what it says, though it does see when a message arrives. Turning this on also installs a small script of ours in your browser (a service worker) that shows the notifications; it stores nothing about you. To stop, turn "This device" off or sign out on that device, remove a device from the list on your Alerts page, or block notifications for our site in your browser. We then delete the subscription, as we do when the push service tells us it has ended. If someone else then signs in on that browser, the notifications are turned off, never passed on to them.
• As Discord direct messages. When you press Connect Discord, Discord asks you to let Next Grails see your Discord user ID and username and add you to the Next Grails Discord server (our bot can only message people who share a server with it). In the server, our bot also gives you a role that matches your membership (Holo or Secret Rare), which opens the members' channels; other people in the server can see your role. We take the role off when your membership ends, when you disconnect, or when you delete your account, and we never remove you from the server. We keep only your Discord user ID and username, with when you connected and whether our last message reached you. We never keep a Discord password or sign-in token: the one Discord gives us is used once to add you to the server and is then revoked. Discord receives the alerts we send you (the card, the price and links). To stop, press Disconnect on your Alerts page; leaving our Discord server or blocking the bot also stops the messages. Disconnecting doesn't take you out of the server: you stay in it until you leave it, and other people in it may be able to see your Discord username there.

On your Alerts page you choose which kinds of alert go where, and you can press Send a test for each. We keep a record of each alert we sent, where, and whether it arrived, so that the same alert is never sent twice, alerts that come together arrive bundled (the most pressing first, the rest in one message), and no more than a few go out in an hour. If your membership ends, we stop sending alerts outside the app; your devices and Discord connection stay with your account until you remove them or delete your account. Your devices, your Discord connection, your choices and this record are deleted with your account (section 9).

In our Discord server

In the Next Grails Discord server, messages may be checked automatically, including by an AI service, to keep spam out. Discord's own filter blocks links to other sites, invite links and sales posts. If the AI check is on, only the text of a message our filter flags is sent for it, with the channel's name and without your name or Discord ID. A message it finds against the server's rules may be removed, and our bot then sends you a note saying which rule. For each flagged message we keep your Discord user ID, the channel and the decision; for a removed or doubtful one also its text, which we delete after 30 days; the rest is deleted after 13 months. When you ask our bot about a card with /ask, we count your questions per day, by Discord account, to keep it fair; we don't keep the question.

The Next Grails browser extension

Our extension for Chrome shows a card's Next Grails file beside listings on eBay. It works only on eBay's pages and talks only to Next Grails.

• What it reads and sends. On an eBay listing or search page, it reads each listing's title and price and sends them to Next Grails to find which card it is. It doesn't read or send anything else on the page, your eBay account, your cookies or the other sites you visit.
• What we keep. Nothing from those lookups: we answer and forget the titles and prices. To stop abuse we count how many lookups and free unlocks come from an internet address in the last minute and the last day; those counts aren't stored.
• Free unlocks. When you install it, the extension makes a random number for your browser. It says nothing about who you are. If you use one of your free unlocks on a card, we keep that number with the card you unlocked and when, to count your free unlocks and keep those cards open for you. Removing the extension removes the number from your browser; the cards it unlocked are then no longer linked to anything of yours.
• If you're a member and connect it. Pressing "I'm a member" while signed in to Next Grails gives the extension a key that says which account it belongs to. It sends that key with each lookup so we can check your plan and show you the full file. The key lasts 30 days, stops working when your membership ends, and is removed when you press Disconnect.
• In your browser. The extension keeps that key, and the last ten minutes' answers so the same listing isn't looked up twice. Removing the extension removes them.
• When you install it. It opens our website once, tagged so we know a visitor came from the extension. Our website's analytics follow your choices (above).

The extension's use of information received from Chrome follows the Chrome Web Store User Data Policy, including its Limited Use requirements. We don't sell it, use it for advertising or use it for anything but showing you card files.

The Next Grails app for ChatGPT and other assistants

Our app lets ChatGPT, and other assistants that use the same open standard (MCP), ask Next Grails what a card sells for and whether a listing's price is a good deal, and show the answer in the chat with a link to the card's page.

• What we receive. Only what the assistant sends to answer the question: the card's name, number or set, or a listing's title and asking price. We don't receive the rest of the conversation, who you are, your account with the assistant or anything else about you.
• What we keep. Nothing from those questions: we answer and forget them. To stop abuse we count how many requests come from an internet address in the last minute; that count isn't stored.
• What we send back. Our own figures and words about the card, and links to the card's page and our website, tagged so we know a visitor came from the app. What the assistant does with your conversation is governed by its own privacy policy, not this one.
• If you follow a link. Our website's analytics follow your choices (above).

Your account: your profile, your choices and your signed-in devices Proposed

• Your profile. When you first sign in we ask a few optional questions: your first name, which games you collect, what kind of buyer you are, how you heard about us and, if you want text alerts later, your phone number. We keep what you give us with your account, to understand what members want and build for it. "Skip for now" keeps nothing.
• Your marketing choices. Two separate boxes, both unticked until you tick them: email news, and text messages (which needs your phone number). We keep each choice you make with the exact words you were shown, their version, when you made it and the browser you used, as the record of your consent. You can change your mind at any time (section 11). Agreeing is never a condition of membership. We don't send text messages today.
• Your signed-in devices. For each device you're signed in on we keep a session id from our sign-in provider, a short device name read from your browser (such as "Windows · Chrome") and when it was first and last used. A membership is for one person: your account can be signed in on up to 3 devices at once, and signing in on another signs out the one you used least recently. We count how often that happens, which can show that a login is being shared. Signing out ends that device's session, and the notifications it gets from us.
• Free access we set up for you. If we gave an email address free access before its account existed, we keep that address, the plan and how long it's free, until you sign up with it (it then shows on your account) or we remove it.

Your profile, your devices and your account's other details are deleted within 90 days after your account is closed. The record of your consent choices is kept as proof of what you agreed to (section 9).

8. Who receives information

We don't sell personal information, and we don't share it for cross-context behavioral advertising (ads aimed at you based on what you do on other sites). These are the only others that receive it.

Our service providers may use information only to provide their service to us, except where their own policies apply to what your browser sends them directly (image servers). Our website's fonts are our own files, served from our own site. Google Analytics processes analytics data for us under Google's terms for that service, with its data-sharing settings off.

Links to marketplaces

When you click a link to eBay, TCGplayer, PSA or another site, you leave Next Grails. Links in the app are set so your browser does not tell those sites which of our pages you came from.

Our marketplace links carry no affiliate tracking today. If we join an affiliate program, we will update this policy before any tracking starts.

Affiliate links Our eBay links may carry an eBay Partner Network tracking code; the ones that do are labeled "Paid link" where they appear. When you click one, eBay may set cookies on its own site and report qualifying purchases to us so that we can be paid a commission. eBay does not give us your name or contact details, and a paid link tells eBay only that the click came from our site, not which page. To avoid this tracking, go to eBay directly instead of using our links, or clear or block cookies for ebay.com. eBay's own privacy notice and cookie settings explain more.

9. How long we keep information

• Failed sign-in records: counted for 10 minutes; held in memory only, until the next server restart.
• Hosting request logs: up to 90 days.
• Shared features: watchlist cards and price targets until a member removes them; hidden listings stay hidden.
• Marketplace listing data, including seller usernames: kept as part of our market history, with no set end date today. See section 5.
• Emails from our website's earlier sign-up form: until you unsubscribe or ask us to remove you, or 12 months after launch, whichever comes first (section 2).
• Planned Account details: while your account is open, then deleted within 90 days after it closes, except for the records below.
• Planned Billing records and proof of your agreement: at least 3 years, or 1 year after your subscription ends, whichever is longer, and as long as tax law requires.
• Support emails: up to 2 years after the conversation ends.
• Analytics: Google Analytics deletes data tied to a cookie's ID after 14 months; its aggregate reports stay. The _ga cookies last up to 13 months from your last visit, and your analytics choice as section 7 describes, in your browser (section 7).
• Our own activity log in the app: each day's counts for 13 months, then deleted; all of them when your account is deleted (section 7).
• What you did on the cancel screen: while your account is open; when it is deleted, the words you typed are deleted and the rest is kept only as counts not tied to anyone (section 7).
• Poll answers: while your account is open (each poll's picks are judged a year after it opened), then deleted with your account (section 7).
• Quick play answers: 180 days from each answer, then deleted; your streak and best streak while your account is open; all of it deleted with your account (section 7).
• Alerts on your devices and in Discord: your devices, your Discord connection, your choices and the record of the alerts we sent stay with your account until you remove them or delete your account. A device is also deleted when its push service tells us it has ended, and a device turned on with the shared password is deleted when that password changes or personal accounts open (section 7).
• Backups: we keep copies of our database, including on our own computers. Something deleted from the live service can stay in an older backup until that backup is replaced.

10. Security

• The website and app use encrypted (HTTPS) connections.
• The shared password and the keys to our services are kept as protected settings with our host and on the owner's own computer, never in our code.
• The session cookie is signed, so it can't be altered without us noticing, and page scripts can't read it.
• Apart from our hosting provider, only the owner of Next Grails can reach the server, the logs and the database.

No system is perfectly secure. If a breach affects your personal information, we will tell you as the law requires.

11. Your choices and rights

Wherever you live, you can ask us to:

• tell you what personal information we hold about you, and give you a copy;
• correct it if it is wrong;
• delete it, except what the law requires us to keep (such as billing records and proof of your agreement to renewal terms);
• stop sending you marketing emails. Every marketing email has an unsubscribe link, and we act on it within 10 business days;
• delete the email you gave our website's earlier sign-up form, or stop only its news and offers (section 2);
• object to our activity log of your account (section 7): we stop counting your account and delete what we have.

We don't sell or share personal information for advertising, so there is nothing to opt out of there. To turn analytics off, use "Cookie settings" at the foot of any page of our website (section 7). The app has the same "Cookie settings" at the foot of each page (the plan picker and the page after paying included), and what you ask us to show you, delete or stop includes our own activity log of your account (section 7).

How to ask

• Email support@nextgrails.com from the address we have for you, and say what you want.
• We may ask you to confirm it is you. Today we hold very little that is linked to a person, so tell us anything that helps us find your information, such as the email you gave us.
• We will reply within 45 days. If we need more time, we will tell you why, and take at most 45 more days.
• If we say no, we will explain why. You can appeal by replying to that email, and we will answer within 45 days.
• Someone you authorize may ask for you, with your written permission.
• We won't charge you or treat you differently for asking.

California

California residents may have rights under the California Consumer Privacy Act. We handle every request as described above, whether or not that law applies to us. We don't share personal information with others for their own direct marketing.

12. Do Not Track and Global Privacy Control

• Do Not Track. If your browser sends a Do Not Track signal, our website keeps analytics off for you and doesn't load Google Tag Manager or Google Analytics. We use no advertising services, and we don't allow any third party to place advertising cookies or pixels on Next Grails.
• Global Privacy Control. We treat a Global Privacy Control signal (a privacy setting some browsers send) as a request to opt out of the sale or sharing of your personal information, which we don't do anyway, and as a "no" to analytics: our website keeps analytics off for you and doesn't load Google Tag Manager or Google Analytics. While your browser sends either signal, "Cookie settings" says so and offers nothing to change.
• In the app. The app treats both signals the same way: no Google Tag Manager or Google Analytics. Our own activity log (section 7) isn't a sale, sharing or third-party tracking, so it doesn't change with them; you can object to it, and we then stop it and delete what we have (section 11).
• The other parties that receive information when you use Next Grails are those listed in section 8, such as marketplace image servers, which receive your IP address and browser details when your browser loads their files. Their own privacy policies apply to that.

13. Children

Next Grails is for adults aged 18 and over. It is not directed at children, and we don't knowingly collect personal information from anyone under 18. If you think a child has given us information, email support@nextgrails.com and we will delete it.

14. Visitors outside the United States

Next Grails is run from the United States for users in the United States. Our servers are in the United States (US East), and your information is stored and processed there, where privacy laws may differ from those where you live.

Analytics. If you allow analytics, Google may process the analytics data (section 7) in the United States and other countries. Google LLC is certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework, and its data processing terms include the Standard Contractual Clauses.

If a law such as the GDPR applies to you, we rely on these legal bases: performing our contract with you (your account and billing); our legitimate interests, meaning things we need to do to run the service safely (keeping the service secure, preventing abuse and fixing problems); your consent (analytics cookies on our website, and marketing emails, all of which you can withdraw at any time); and our legal duties (tax records and proof of your agreement to renewal terms). You can also complain to your local data protection authority.

Analytics cookies in the app rely on your consent, as on our website. Our own activity log in the app relies on our legitimate interest in understanding how Next Grails is used so we can improve it; we use it to email you about features and plans only with your consent. You have the right to object to it at any time (section 11).

Your poll answers (section 7) rely on our legitimate interest in running the weekly Grail Vote and showing members its results; we use them to make our emails fit the cards you pick only with your consent. You can ask us to delete them at any time (section 11).

Your Quick play answers (section 7) rely on our legitimate interest in running Grail Vote · Quick play and showing members how they split; we never use them for emails. You can ask us to delete them at any time (section 11).

15. Changes to this policy

We will post any change on this page with a new "Last updated" date. If a change is material, for example a new kind of information or a new kind of recipient, we will email members, and the people whose emails we keep from our website's earlier sign-up form, before it takes effect. Before any planned item in this policy starts, we will update the policy.

16. Contact