Privacy Policy
Last updated: 2026-10-16
1. Controller
- Controller: Gig Grid ("we"), operator of giggrid.net.
- Data-protection contact: privacy@giggrid.net.
2. Data processed
| Category | Purpose | Retention |
|---|---|---|
| Account: email address, username, password hash | Account operation; account emails | Until account deletion |
| User content: rigs, custom gear designs, saved gear, likes | Provision of the service; display of public rigs | Until deletion by the user or account deletion; exceptions: §6 |
| Agreement records: accepted Terms version, Privacy Policy version in force, timestamp; IP address and user agent when accepted via the agreement page | Evidence of acceptance | Duration of the account |
| Feedback: category, subject, message, email address, page, user agent, viewport, optional screenshot, IP address | Handling of feedback; spam prevention (IP address) | IP address: 90 days. Other fields: until resolved, max. 24 months |
| Rig views: rig, timestamp, account ID or IP address | One count per viewer per hour | 30 days |
| Location: country and region, derived from the IP address by the hosting provider | Affiliate-link selection; analytics regime (§3) | Not stored; country attached to analytics events |
| Analytics; session recordings | §3 | Events: 1 year. Recordings: 30 days |
| Request logs: IP address, path, timestamp, user agent | Operation and security | Hosting provider's log period |
3. Analytics
Regime by location:
- Some regions: enabled by default; adjustable via the Analytics setting (site footer; Account page when signed in).
- Other regions: no analytics in the browser.
- Global Privacy Control or Do Not Track signal: disabled.
Settings:
- On — page views and feature use recorded by the analytics provider via cookie and browser storage; linked to the account ID when signed in (not to the email address or username).
- Anonymous — page views and feature use counted without cookies or identifiers. Visitors grouped per day by a code derived from IP address and user agent; rotated daily; not reversible.
- Off — no collection from the browser.
Further processing:
- Error reports: sent to the analytics provider under On or Anonymous.
- Server-side counts of account actions (creating, publishing, remixing or liking rigs; saving gear): linked to the account ID under On; unlinked otherwise; not recorded under Off, Global Privacy Control or Do Not Track.
- Session recording: opt-in only (sign-up or Account settings); requires On; not offered in some regions. Random sample of approx. 69% of sessions: pages viewed, pointer movement, clicks, scrolling. Form input masked in the browser. Excluded: account, admin, password-reset and agreement pages.
- QR codes on printed material: routed via a link-shortening service, which records each scan (approximate location, device type).
4. Cookies and browser storage
| Name | Purpose | Duration |
|---|---|---|
| sb-…-auth-token | Authentication | ≤ 400 days, or until sign-out |
| sb-…-code-verifier | Sign-up and password-reset links | Until the link is used |
| gg_analytics | Analytics setting | 12 months |
| ph_… (cookie, browser storage) | Analytics identifier and session; On only | 12 months; session data until the tab closes |
| gg_ph_consent (browser storage) | Analytics provider's copy of the setting; On only | Until cleared |
| gg_analytics_notice (browser storage) | Dismissal of the analytics notice | Until cleared |
| giggrid.rigEditor.panels (browser storage) | Editor panel layout | Until the tab closes |
| Bot-protection check | Sign-in and sign-up forms | Set by the provider during the check |
- Anonymous and Off: no analytics data stored on the device.
5. Recipients
Processors acting on our behalf, under data processing terms:
- Database, authentication and file storage — Germany.
- Analytics and session recordings — Germany.
- Hosting and request logs — global network; US provider.
- Bot protection — global networks; US providers.
- Email delivery — United States.
- Link shortening (printed QR codes) — United States.
- Provider identities: on request.
- International transfers: safeguarded under each processor's data processing terms.
6. Public content
- Public rig: visible to anyone with the link (name, gear, dimensions, username); remixable by other users per the Terms of Service.
- Account deletion: public or published rigs retained without the username, preserving remixes; private, never-published rigs deleted.
7. Rights
- Access and portability: Account → Download my data. Analytics data: on request.
- Rectification: on request.
- Erasure: account deletion on the Account page, including analytics data linked to the account.
- Objection; withdrawal of consent: Analytics setting (§3); session-recording setting.
- Requests: privacy@giggrid.net.
- Complaints: the data protection authority of the country of residence.
8. Age
- Minimum age: 16.
- Accounts found to belong to persons under 16 are deleted.
9. Changes
- Material changes: notified in the app.
- Current version: date above.
See also: Terms of Service.