Privacy Policy

📋 1. Data We Collect

GridChat uses a Privacy Tier model — we collect the absolute minimum data necessary to operate the service. We hold only what is strictly required.

* Under Privacy Tier, these are technically stored but encrypted with your private key — only accessible to you and your intended recipient.

🚫 2. What We Don't Collect

The following data is never collected, stored, or processed by Grid BV:

• Email addresses — we don't need one, and neither should you have to give one up
• Phone numbers — your identity is your username, nothing more
• Real names — usernames are pseudonymous by design
• Message content — all messages are E2E encrypted before leaving your device
• Contact lists — stored only on your device, never synced to our servers
• Location data — real-time location is peer-to-peer encrypted, not stored
• Device identifiers — we don't track devices
• Usage analytics — no behavioral tracking, no telemetry

🔐 3. End-to-End Encryption

GridChat uses the GP Encryption Engine for all private communications:

• AES-256-GCM — military-grade symmetric encryption for message content
• Curve25519 (X3DH) — elliptic curve key agreement for secure key exchange
• Double-Ratchet — forward secrecy: each message uses a new key, old keys are permanently discarded
• GRID_DICT encoding — lossless encoding for encrypted payloads

Encryption and decryption happen exclusively on your device. Our servers route encrypted ciphertext without ever being able to decrypt it. The GP Engine is open in concept — the implementation is proprietary.

🗄️ 4. Data Retention

We retain data only as long as necessary:

• Account data — retained until you delete your account
• Encrypted messages — stored only while awaiting delivery, deleted immediately after receipt
• Activity logs — retained for a maximum of 90 days for abuse prevention
• Encrypted contact data — never stored on our servers
• Location shares — real-time only, not persistently stored

Upon account deletion (GDPR Article 17), all data is permanently and irreversibly erased.

🇪🇺 5. Your GDPR Rights

As an EU data subject, you have the following rights under GDPR:

• Right of Access (Art. 15) — request a copy of all data we hold about you
• Right to Rectification (Art. 16) — correct inaccurate personal data
• Right to Erasure (Art. 17) — delete your account and all associated data permanently
• Right to Restrict Processing (Art. 18) — limit how we use your data
• Right to Data Portability (Art. 20) — receive your data in a machine-readable format
• Right to Object (Art. 21) — object to processing based on legitimate interests
• Right to Lodge a Complaint — file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens)

For account deletion, use the in-app "Delete Account" function (Profile → Delete Account). This executes GDPR Article 17 erasure automatically.

🛡️ 6. Security Measures

We implement industry-standard and proprietary security measures:

• TLS 1.3 for all data in transit
• AES-256-GCM for message encryption at rest (where applicable)
• PBKDF2 with 50,000 iterations for password hashing
• JWT tokens with HMAC-SHA256, 7-day expiry
• Rate limiting on all authentication endpoints
• No SQL databases — file-based JSON storage prevents injection attacks
• Regular security audits (Agent Purple penetration testing completed March 2026)
• Server infrastructure on EU-based providers

🍪 7. Cookies

GridChat uses minimal cookies:

• Authentication cookies — required for staying logged in, HTTP-only where supported
• No advertising cookies — we don't run ads
• No tracking cookies — no third-party analytics
• No social media cookies — we have no social media integrations

You can disable cookies in your browser, but this will log you out of GridChat on next visit.

🔗 8. Third-Party Services

We use the following third-party services:

• Firebase (Google Cloud) — Cloud Messaging for push notifications. Your FCM token is stored encrypted. You can revoke this at any time via the app.
• Render — Cloud hosting for our API servers. Servers are EU-located.
• Stripe — Payment processing for subscriptions. We do not store payment card details.

We do not sell, share, or transfer your data to any third parties beyond the above service providers, each of which is GDPR-compliant.

👶 9. Children's Privacy

GridChat is not intended for use by children under 16. We do not knowingly collect personal data from children under 16. If you believe a child's data has been collected, contact us immediately at privacy@gridchat.app.

🚨 10. Data Breach Notification

In the event of a data breach that poses a risk to your rights, we will:

• Notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours of becoming aware
• Notify affected users directly without undue delay
• Document all breaches in our internal incident register

Given our Privacy Tier architecture — where we store only encrypted ciphertext and usernames — a breach of our servers would not expose message content or contacts.

🌍 11. International Data Transfers

GridChat is hosted exclusively within the European Union. No data is transferred outside the EU. Our use of Firebase and Stripe involves EU-based data centers only.

If we ever need to transfer data outside the EU, we will ensure appropriate safeguards (Standard Contractual Clauses, adequacy decisions) are in place in accordance with GDPR Chapter V.

🔄 12. Policy Changes

We may update this Privacy Policy from time to time. Material changes will be communicated:

• Via the GridChat app login screen
• Via email to registered users
• With an updated "Last updated" date on this page

Continued use of GridChat after changes constitutes acceptance. If you do not agree with changes, you may delete your account.

Contact: Grid BV · Amsterdam · privacy@gridchat.app