Privacy Policy
Effective October 9, 2026
Policy version 2026-10-09-downloads
Griddl is a software product developed and provided by Tyler Anderson, a sole proprietor in California, United States. Griddl is the product name; Tyler Anderson is the business owner and the controller responsible for the personal information described here. References to “we”, “us” and “our” mean Tyler Anderson. This policy covers this website, purchase and support correspondence, beta-and-launch signups and previous beta requests, optional website analytics and advertising measurement, and Griddl’s social-media management.
Information collected
When you sign up for beta testing opportunities and launch updates, Tyler Anderson stores your email address, the time you consented, the signup privacy-policy version and operational timestamps. The same limited records are kept for earlier beta-only requests. The beta-signup database does not store your IP address, browser user agent, referral source, cookies, analytics identifiers or information about your Mac, windows or Desktops.
Hosting providers process ordinary request metadata, such as IP addresses and technical logs, to deliver and secure the site. This is separate from Griddl’s beta-signup records. Information you voluntarily send to our contact addresses is also processed to answer you.
Purposes and legal bases
We use contact information to answer your requests and help with Griddl. New beta-and-launch signups are used to email you about potential beta testing opportunities and when Griddl goes live. Earlier beta-only requests are used only for the beta communications you agreed to receive; launch emails require a new opt-in. We rely on your consent for these emails and for optional website analytics and advertising measurement. You can withdraw each consent separately, without affecting processing that was lawful before withdrawal. Analytics and advertising-measurement consent are never required to sign up for these emails.
We rely on legitimate interests to operate and secure the website, prevent abuse, answer requests and maintain a limited record of privacy choices. Those interests are running a secure service and being able to show how we respected your choices. Where a specific law requires us to retain or disclose information, the basis is that legal obligation. Rights and limitations depend on the law that applies to you.
Griddl does not sell beta email addresses or use them for behavioral advertising. Google Signals, Google remarketing and Google ad personalization are disabled. Our Analytics property is linked to Google Ads for advertising measurement; these website engagement events are not purchase conversions. We use Meta Pixel for optional advertising measurement as described below. Meta may associate events with a Meta account and use them for advertising under its terms. We do not use these events to make decisions that produce legal or similarly significant effects about you.
Cookies and optional website analytics
Necessary cookies remember privacy choices and help hosting providers operate and secure the site. The griddl_cookie_consent cookie lasts 180 days. Hosting providers may produce operational traffic statistics independently of Google Analytics.
Google tags load only after you accept Analytics or Advertising measurement and our service records that permission. With Analytics permission, Google Analytics measures visits, intentional demo interactions, successful moves within the website demo, pricing views, and clicks on enabled download and purchase links with _ga and _ga_ cookies lasting up to 180 days. Google receives browser and device information, approximate location derived from the request, the page visited and a visitor identifier. We remove arbitrary query strings and fragments from page addresses and send only the referring site’s origin. Valid campaign labels can describe the visit; Google click identifiers are included only with Advertising measurement permission.
We do not send email addresses, form contents, window titles, screenshots or desktop information to Google Analytics. Website analytics is separate from the Griddl Mac app. Website interaction details are limited to fixed categories such as button placement, purchase option and demo mode. Checkout measurement is described under Purchases and support. A download click does not confirm a download or installation, and a purchase click does not confirm payment. Google processes this analytics data on our behalf; ad personalization and optional account data-sharing settings remain disabled.
Rejecting is as easy as accepting. Use Cookie settings in any footer to withdraw. Turning an optional purpose off reloads open Griddl pages and unloads their measurement runtimes. Google measurement cookies and local attribution are cleared; Meta cookies are cleared when Advertising measurement is withdrawn. The remaining choices take effect after reload. Rejecting both stops future optional Google and Meta measurement on this browser. It does not automatically delete information already received by Google or Meta. If recording permission fails, both optional purposes stay off.
Browser privacy signals
We honor Global Privacy Control (GPC) and enabled Do Not Track (DNT) signals by keeping both optional Analytics and Advertising measurement off, including after prior acceptance. This applies globally. Necessary site security and privacy-choice processing continue. The signal applies to that browser; it does not delete historical records or change email preferences.
The Meta Pixel stays off until you make a new Advertising measurement choice under the Meta notice. You can reject or withdraw that choice, and GPC or DNT blocks the Pixel regardless of earlier acceptance. Necessary service providers still process the information needed to run the site.
Privacy-choice records and retention
We keep a separate consent record containing a random browser consent reference, the choice and receipt times, notice revision, notice language, separate analytics and advertising choices and any GPC or DNT signal. It contains no email, IP address, user agent, page address or Google/Meta identifier, and is not joined to the beta list or sent to Google or Meta. This record documents the choice received from a browser; it does not establish a person’s identity.
Consent records become due for deletion 365 days after receipt. Expired records are removed the next time the consent-record service processes a request; they may remain until that cleanup runs. Reopening a page does not extend an existing record’s retention. Your browser remembers its choice for 180 days. You can ask us about a record using the consent reference shown on this page.
We retain signup requests while the beta communications or launch announcement you opted into are pending or until you ask for deletion or unsubscribe, subject to limited legal or security needs. Contact correspondence is retained as needed to resolve the request and document its outcome. We assess any further retention against that purpose.
Google Analytics user-level and event-level retention is set to two months, without resetting on new activity. Aggregated reports can be retained longer by Google. Provider backups and security logs follow the relevant provider’s retention and deletion processes.
Providers and international processing
ChatGPT Sites hosts this website using Cloudflare infrastructure and D1 storage. Signup requests are also copied to a private Google Sheet, with Google Apps Script notifications sent to Tyler Anderson. New signup notifications also send your email address and signup time to Tyler Anderson’s private Slack channel. Signing up does not automatically send you an email or grant beta access. Optional website analytics and advertising measurement use Google Analytics, Google Ads and Meta Pixel. Access is for operating these services; we may also disclose information if legally required or necessary to protect the service and people’s rights.
Tyler Anderson is in the United States. Providers may process information in the United States and other countries. The applicable provider agreements govern their processing. OpenAI’s published Sites data-processing agreement describes EU standard contractual clauses or adequacy decisions for relevant EEA transfers, and the UK Addendum for UK data. Google’s applicable processing terms describe its transfer safeguards. Meta processes Pixel events under its Business Tools Terms and privacy policy. You can contact us for information about the safeguards applicable to your data or a copy where available.
The appropriate transfer mechanism depends on the provider, account and applicable law. The existence of a cookie choice does not itself authorize an international transfer, and we do not represent that EU or UK contractual clauses alone satisfy Brazilian transfer requirements.
OpenAI Sites data-processing agreement
Your privacy rights and requests
Contact privacy@griddl.app to ask about processing, access or correct your information, request deletion, withdraw email consent, or unsubscribe. Where applicable, you may also request portability, restriction, anonymization or blocking, object to processing based on legitimate interests, and obtain information about recipients. You can withdraw analytics or advertising measurement consent immediately in Cookie settings.
Requests are handled without discrimination and generally without charge. We may ask for the minimum information needed to verify authority and locate the record. Use the email associated with your beta request when possible; do not send passwords or identity documents unless specifically needed through an appropriate channel. If we cannot identify analytics data from your email, we will explain the limitation rather than collect unrelated information to identify you.
We respond within the time required by applicable law. Some rights have exceptions; if we cannot fulfill a request, we explain the reason and any available appeal. You can ask us to reconsider at the same privacy address and complain to your relevant data-protection authority, including the ICO in the UK, your EEA supervisory authority, ANPD in Brazil, or the appropriate US state authority.
Contact Tyler Anderson about your privacy
EEA: find your supervisory authority
Changes to this policy
We publish policy changes here with a new effective date and version. Material changes to optional tracking require a new choice before that tracking starts. For significant changes affecting beta records, we provide additional notice where required. Contact us for a previous version of the notice.
Purchases and support
If you choose to purchase Griddl, checkout takes place on Lemon Squeezy, which acts as the merchant of record and handles payment and applicable sales taxes under its own terms and privacy notice. Payment details are entered on its checkout, not into this website.
Tyler Anderson receives the customer, order and license information needed to provide the software, answer purchase questions and handle support or refund requests. This can include your name, email address, order identifier, selected product and payment or subscription status. This information is used to fulfill your purchase and provide support, and retained as needed for those purposes and applicable recordkeeping requirements.
Lemon Squeezy’s store-wide Google Analytics integration remains disabled. When checkout is available, our embedded checkout can report checkout views when Analytics is on and completed purchases when Analytics or Advertising measurement is on. Purchase event details are limited to currency, amount and a numeric order identifier to prevent duplicate counting; email, customer details and payment fields are excluded. Advertising click identifiers are handled only with Advertising measurement permission, as described below. Events before the relevant consent or after its withdrawal are discarded, not replayed. These choices are optional and do not control access to downloads or purchases. Griddl’s app licensing and update services are separate from website measurement.
Optional advertising measurement
Advertising measurement is a separate choice in Cookie settings, off by default. With your permission, we use Google Analytics and Google Ads to connect ad clicks with Griddl purchases. Google may use advertising cookies such as _gcl_* and browser local storage (_gcl_ls), and receive validated Google click identifiers (gclid, gbraid or wbraid), a sanitized page address, technical browser/request information, purchase currency, value and transaction number. Google conversion cookies commonly last 90 days; our first-party Google Analytics cookies last up to 180 days when Analytics is also allowed.
If Advertising measurement is on and Analytics is off, we deny Analytics cookie storage and do not send our page-view, demo, pricing-view, download-click, purchase-click or checkout-view events to Google. We may send a completed purchase for advertising measurement, and Google may send technical consent and measurement pings without Analytics cookies. This does not enable Google personalized advertising, Google remarketing, Google Signals or enhanced conversions using customer contact details.
Meta Pixel loads only on the home page after Advertising measurement permission is recorded. Private staging uses a separate Meta dataset for download-click and purchase testing. We explicitly send PageView for home-page views, DownloadClick when an available Download button is clicked, and Purchase after a paid order confirmed by the active embedded checkout. DownloadClick includes only a fixed button placement (navigation, hero or pricing); it does not confirm file delivery or installation. Beta and launch-update signups do not send Meta conversion events. Purchase includes currency, amount and an order-based event identifier to avoid duplicates. Meta receives IP address and technical request/browser data, the eligible page address and referrer, and may use _fbp and _fbc cookies for up to 90 days. Eligible home-page addresses may include a validated fbclid click identifier, language setting, fixed navigation anchors and fixed public campaign labels such as griddl_launch; unexpected query strings or referrers with paths, queries or fragments block the Pixel. Changing to an unexpected address while it is running reloads the page to stop it, so keep personal information out of page addresses. Automatic advanced matching, automatic events and customer-contact matching are disabled. We do not send signup emails, form contents, payment details or Mac app data to Meta. Meta may associate events with your account and use them for measurement and advertising under its Business Tools Terms. Server-side Conversions API is not enabled.
Rejecting both choices blocks Google tags and Meta Pixel entirely, including cookieless measurement pings. New advertising purposes require a fresh choice: earlier Analytics permission is not treated as advertising permission. Google and Meta click identifiers are not included in our consent records, beta records or Lemon Squeezy checkout metadata. Checkout payment and licensing do not depend on either optional permission.
Social-media data deletion
Anyone whose information is processed through Griddl Postiz can request access, correction or deletion by emailing privacy@griddl.app with the subject “Social-media data request”. Include the platform, account or Page name, and the profile or post link needed to locate the information. You do not need a Postiz account to make a request. Do not send passwords or access tokens. We may ask for the minimum additional information needed to verify the request.
An account administrator can also remove Griddl Postiz from the connected platform’s app or business-integration settings to revoke future access. To remove stored copies as well, contact us at the address above. We will remove the relevant information from the systems we control and confirm the outcome, subject to applicable legal obligations. If any information must be retained, we explain the reason and limits. We handle requests within the time required by applicable law.
Removing records from Postiz does not automatically remove a post or comment already published on a social platform, or copies held by other people. Tell us if your request also concerns content on Griddl’s social accounts. For information controlled independently by a platform, use that platform’s privacy and deletion controls; we will explain any relevant limits on what we can remove.
Your consent reference
No current choice is saved in this browser. You can choose in Cookie settings.
Griddl social-media management
Tyler Anderson operates Griddl Postiz, a self-hosted social-media management tool at postiz.griddl.app, to manage Griddl’s own social accounts. It is an internal service with restricted sign-in, not a service for customers to connect their social accounts. It currently connects Griddl’s Facebook Page, Instagram professional account and LinkedIn Page.
Depending on the platform and permissions granted by an authorized account administrator, we process account and Page identifiers, names, usernames, profile images, administrator profile details supplied during connection, access and refresh tokens, and connection settings. We also process draft and published text, images and videos, schedules, publication identifiers, links and status, and available performance and engagement metrics. If an enabled platform feature supplies comments or related engagement information, this can include the comment text, author’s name or username and platform identifier.
We use this information to connect the authorized accounts, prepare and publish Griddl content, manage supported comments and review performance. Our legitimate interests are operating Griddl’s social channels and communicating about the product, subject to applicable law and your rights. Administrators choose which accounts and permissions to authorize and can revoke access through the relevant platform. We do not sell this social-account information, send it to the website’s Google Analytics or Google Ads measurement, or use it for advertising profiles about individual social-media users.
Postiz records and uploaded media are stored on a computer operated by Tyler Anderson in the United States. Cloudflare provides the secure tunnel used to reach the service and processes traffic and technical request information. The connected social platforms receive the authentication requests, content and actions needed to perform the authorized functions and process information under their own policies. Published content and media shared for publication may be publicly accessible; the management dashboard requires sign-in.
We retain social-management records only while needed to operate the connected channels, manage content and resolve support or security issues, or meet applicable legal obligations. We review stored information when a connection is removed, a deletion request is received or the service is no longer used, and remove information no longer needed. Disconnecting a channel does not itself erase every previously stored record. See the deletion instructions below to request removal of stored information.