Privacy Policy

Last updated: March 4, 2026 · Effective: March 4, 2026

RPMR Creations ("we," "us," or "our") operates the GridPics mobile application and website at gridpics.rpmrcreations.com (collectively, the "Service"). This Privacy Policy explains what information we collect, how we use it, and your choices regarding that information.

By using the Service you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the Service.

1. Information We Collect

1.1 Information You Provide

Data	Purpose
Email address	Account creation, login, and essential account communications
Username	Public display name so friends can find and interact with you
Date of birth	Age verification (we require users to be 13 or older)
Profile avatar	Optional — uploaded image or selected icon for your profile
Puzzle images	Photos you upload to create puzzles for friends

1.2 Information Collected Automatically

Data	Purpose
Push notification token	Delivering puzzle and friend notifications to your device (opt-in only)
Device type & OS version	Ensuring app compatibility and diagnosing crashes
App usage data	Puzzle completion stats, points earned — used to display your in-app profile

1.3 Information We Do NOT Collect

We do not collect precise location data.
We do not collect contacts or address book information.
We do not use third-party analytics or advertising SDKs.
We do not sell, rent, or share your personal information with advertisers.

2. How We Use Your Information

Provide the Service — create and manage your account, deliver puzzles, manage friendships, display leaderboards and stats.
Communicate with you — send push notifications about new puzzles, friend requests, and puzzle progress (only if you opt in).
Safety & moderation — enforce our Terms of Service, review reports of abusive content, and maintain a safe community.
Improve the Service — understand how features are used so we can fix bugs and improve the experience.

3. How We Store & Protect Your Data

Your data is stored on Supabase infrastructure (hosted on AWS) with the following safeguards:

All data is transmitted over HTTPS/TLS encryption.
Authentication tokens are stored in your device's secure keychain (iOS Keychain / Android Keystore) using Expo SecureStore — not in plain-text storage.
Database access is protected by Row Level Security (RLS) policies ensuring users can only access their own data.
Uploaded images are stored in private Supabase Storage buckets with access controls.
Passwords are hashed and never stored in plain text.

4. Data Sharing & Third Parties

We do not sell your data. We share information only in the following limited circumstances:

With other users — your username, avatar, points, and puzzle stats are visible to friends and puzzle recipients. Your email address and date of birth are never shared with other users.
Service providers — we use Supabase for hosting and data storage, and Apple Push Notification Service / Expo Push for delivering notifications. These providers process data solely on our behalf.
Legal requirements — we may disclose information if required by law, regulation, or valid legal process.

5. Your Rights & Choices

5.1 Access & Update

You can view and update your username, email, avatar, and date of birth at any time in the app's Settings screen.

5.2 Push Notifications

Push notifications are opt-in. You can enable or disable them at any time through your device's system settings.

5.3 Block & Report

You can block any user from your Friends screen. Blocking a user removes all traces of your account from their view, including puzzles, friend connections, and notifications. You can unblock users at any time.

5.4 Account Deletion

You can permanently delete your account at any time from Settings → Delete Account. When you delete your account:

Your profile, puzzles, stats, badges, and friendships are permanently removed.
All uploaded images (avatars and puzzle images) are deleted from our storage.
Your authentication credentials are destroyed.
This action is irreversible.

5.5 Data Portability

If you would like a copy of your personal data, please contact us at the email below and we will provide it within 30 days.

6. Children's Privacy

GridPics is not intended for children under 13 years of age. We enforce a minimum age of 13 at registration through date-of-birth verification. If we become aware that we have collected personal information from a child under 13, we will promptly delete the account and associated data. If you believe a child under 13 has created an account, please contact us immediately.

7. Data Retention

We retain your personal data for as long as your account is active. If you delete your account, all personal data is removed immediately as described in Section 5.4. We may retain anonymized, aggregated data (e.g., total puzzle count) that cannot identify you.

8. International Users

The Service is operated from Canada. If you access the Service from outside Canada, your information may be transferred to and processed in countries where our infrastructure providers operate. By using the Service, you consent to such transfer. We take appropriate measures to ensure your data is treated securely and in accordance with this Privacy Policy.

9. Canadian Residents (PIPEDA)

GridPics complies with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. As a Canadian resident, you have the right to:

Access your personal information held by us.
Challenge the accuracy and completeness of your information and have it amended as appropriate.
Withdraw consent for the collection, use, or disclosure of your information (subject to legal or contractual restrictions).

To exercise any of these rights, use the in-app account features or contact our Privacy Officer at the email below. We will respond within 30 days.

10. California Residents (CCPA)

If you are a California resident, you have the right to:

Know what personal information we collect and how it is used.
Request deletion of your personal information.
Not be discriminated against for exercising your privacy rights.

We do not sell personal information. To exercise your rights, use the in-app account deletion feature or contact us at the email below.

11. European Users (GDPR)

If you are located in the European Economic Area (EEA), UK, or Switzerland:

Legal basis: We process your data based on (a) your consent (e.g., push notifications), (b) performance of a contract (providing the Service), and (c) legitimate interests (safety, security, improvement).
Your rights: You may request access, rectification, deletion, restriction, or portability of your data, or object to processing. Contact us to exercise these rights.
Data controller: RPMR Creations is the data controller for information processed through the Service.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the updated policy with a new "Last updated" date. Your continued use of the Service after changes take effect constitutes acceptance of the revised policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

Email: support@rpmrcreations.com

Website: gridpics.rpmrcreations.com