Privacy Policy

• The free plan needs no account and no card. Nothing identifies you.
• Topics, word lists and clues you type are processed to build your page and are never used to train AI models.
• We do not sell or rent personal data. We never have and will not.
• Card details are handled by a PCI-DSS-compliant payment service provider and never reach our servers.

Gridwyn is operated by an independent sole trader, who is the data controller. Contact for any privacy question or request: support@adeltahar.shop. We reply within 1 business day, and always within 2 business days.

• Puzzle input (topics, word lists, clues, titles). On the free plan this is processed in your browser and is not stored on our servers. Where a topic has to be sent to a language model, only the topic text is sent — never your email address or any account identifier.
• Account data (paid plans): email address, plan, renewal date, page count. We need this to run the subscription.
• Payment data. Handled entirely by our payment service provider. We receive only the outcome (paid or failed), the last four digits of the card and the country, for accounting and fraud checks.
• Support email. If you write to us we keep the thread so we can follow it up.
• Basic technical logs. Our hosting provider records request data such as IP address, timestamp and user agent, for security and reliability.

We do not collect special-category data, and we ask you not to put personal information about identifiable people into word lists or clues.

• To perform our contract with you — running your subscription, generating your pages, answering your emails.
• Legitimate interests — keeping the service secure, preventing abuse, understanding aggregate usage.
• Legal obligation — keeping records of sales for tax purposes.

• Puzzle input: not retained after your session on the free plan. On paid plans, a saved page is kept until you delete it or for 12 months after your subscription ends, whichever is sooner.
• Account records: for as long as the account is open, then 12 months.
• Payment and invoice records: 7 years, because tax law requires it.
• Support email: 24 months.
• Server logs: up to 30 days.

When a topic is not covered by our built-in library and a language model is configured for this deployment, the topic text alone is sent to that provider to obtain a word list. We instruct the provider not to retain it for training. We never use your input to train our own or anyone else's models. See the AI Content Disclosure for what is AI-generated and what is not.

We keep the list as short as we can. Each of these processes data only on our instructions:

• Our website hosting and content delivery provider.
• Our database and authentication provider (paid plans only).
• Our payment service provider, for taking payments and refunds.
• A language model provider, where topic generation is enabled on this deployment.
• Our email provider, for support and account email.

Some of these operate outside your country. Where personal data is transferred out of the EEA or the UK, it is covered by the European Commission's standard contractual clauses or an equivalent safeguard.

Depending on where you live you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to another provider. Email support@adeltahar.shop and we will act within 30 days. You will never be charged for asking, and we will not treat you differently for it. If you are in the EEA or the UK you also have the right to complain to your national data protection authority.

Gridwyn is for adults. Accounts are not offered to anyone under 18, and we do not knowingly collect data from children. Teachers and parents are of course welcome to give the printed pages to children — no child needs to visit the site or give us anything.

The site is served over HTTPS. Access to any stored account data is limited to the operator and protected by multi-factor authentication. We keep the amount of data we hold deliberately small, which is the most effective protection of all. If a breach ever affects you, we will tell you and the relevant authority without undue delay.

See the Cookie Policy. In short: no advertising cookies and no third-party tracking.