Skip to content
Back

Privacy Policy

Last updated August 31, 2026

This describes exactly what Gridpex collects and what happens to it. The short version: we collect what we need to run the site and understand how it is used, we do not sell it, we do not run ad networks, and you can ask for a copy or have it deleted.

What we collect when you make an account

Email address
Signing in, password resets, and service notices.
Password
Stored only as a salted hash. We cannot read it and cannot tell you what it is.
Display name and profile
Shown to other people in pools, standings, chat and the forum.
What you do on the site
Your picks, pools, fantasy lineups, forum posts, chat and direct messages, so the product works.
Push subscription
Only if you turn notifications on. A browser-issued endpoint and keys, used to send the alerts you chose. Turning notifications off deletes it.

What we collect automatically

Every page view and tracked click writes one analytics record. These records are how we learn which pages are worth keeping and where the site is broken.

IP address
Written with each record. It is the only way to recognize a visitor before they have an account, and it is used for abuse prevention and coarse location.
Approximate location
Country, region and city, derived at the edge from the connection. Never GPS or precise location.
Device and browser
Full user-agent string, browser family, operating system, device class and window size, so we can tell whether a layout actually works at the sizes people use.
Pages and behavior
The path you visited, the query string with secret-bearing values stripped out, where you arrived from, what you clicked, how long the page was visible, and how far you scrolled.
Visitor and session identifiers
A random id kept in your browser's local storage, plus a per-tab id. They join your visits together over time. They are random values, not derived from anything about you.

If you are signed in, these records are linked to your account. If you are not, they are linked to the random visitor id.

Cookies and local storage

We use a cookie to keep you signed in, and browser local storage for the visitor id and small conveniences like a remembered tab. We do not use advertising cookies, third-party trackers, ad networks or cross-site advertising pixels, because there are none on this site.

How long we keep it

We keep raw analytics records, including IP addresses, for as long as they stay useful for understanding and improving the site, and we do not currently delete them on a fixed schedule. We would rather tell you that plainly than publish a retention promise we do not keep.

You can have yours deleted at any time by asking — see below. If we do adopt a fixed retention period, this page will say so before it takes effect.

Account data, and the picks and posts attached to it, are kept while your account exists. Delete your account and we delete them, other than anything we must keep to resolve a dispute or meet a legal obligation.

Who else sees it

We do not sell your personal information, and we do not share it for advertising. We have never done either.

The site runs on infrastructure providers who necessarily process data on our behalf to host it — our application host and our database host. They are bound to use it only to provide that service.

We pull sports data from third-party providers such as CFBD, ESPN and market data sources. Data flows one way: we request schedules, scores, statistics and prices. We send them nothing about you — no identifiers, no account details, no browsing history.

We may disclose information if the law requires it, or to investigate abuse or protect the service and its users.

Your choices and your rights

You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it — including your analytics history. Depending on where you live you may also have the right to object to processing or to opt out of any sale or sharing of personal information; we do not sell or share it in the first place. Exercising any of these rights never costs you anything and we will not treat you differently for it.

Email privacy@gridpex.com and say what you want. We will verify you control the account and respond within 45 days.

You can turn off push notifications at any time in settings or in your browser, and you can clear local storage in your browser to reset the visitor id.

Security

Traffic is encrypted in transit. Passwords are stored only as salted hashes. Analytics records are readable only by the server, never by the browser, and are locked at the database level so they cannot be read by an unprivileged client. No system is perfect, and we will tell affected users promptly if something goes wrong.

Children

Gridpex is not for people under 18. We do not knowingly collect anything from them. If you believe a child has created an account, tell us and we will delete it.

Changes and contact

If this policy changes, the date at the top changes, and we will announce anything material on the site. Questions go to privacy@gridpex.com.

See also our Terms of Service.