Privacy Policy

Effective date: 2026-10-30

This Privacy Policy explains how GrailSociety LLC, a limited liability company with its principal address at 4030 Wake Forest Road, Ste 349, Raleigh, NC 27609, US ("we," "us," or "our"), handles information through the GrailSociety website and related services. Get in touch: hello@grailsociety.co, or reach the operator responsible for this processing through our Legal & Privacy contact page, including without an account.

GrailSociety includes public profiles, private account tools, collectible photography, a shared catalog, social activity, and an invite-only beta waitlist. A copyright license and permission to process personal information are different. Our Terms of Service and optional Catalog Contribution License describe content rights; they do not take away your rights under applicable privacy law.

1. Information you provide

• Accounts: handle, display name, email if provided, password, invitation information, account preferences, and recovery credentials. We store a salted password hash, not a readable account password. An account made with Google or Apple has no password until you set one (see Section 2). A signup email is private, even if your profile is public.
• Password resets and account security: if you ask to reset a forgotten password, we email a one-use link to your account's confirmed email. We store only a hash of the link's secret, a hash of the email address it went to, a fingerprint of your stored password hash (so a password change ends the link), and when it was made, expires and was used. The full link exists only in the email and, briefly, while the email is being delivered. We also record security events such as a password reset, change or first password, and connecting or disconnecting Google or Apple.
• Profiles and collections: bio, avatar, cover, interests, showcase settings, chosen visibility, catalog selections, item descriptions, photos, grades, certificate or serial numbers, provenance, purchase or trade details you enter, and current or archived status.
• Capture and drafts: original files you capture or upload, display derivatives, image dimensions and hashes, crop choices, label-reading results, draft details, and upload progress. Original files may contain embedded information such as camera details, capture time, or location. The public display derivatives generated by our standard upload processing remove embedded EXIF metadata; visible text or location clues within a photograph are not automatically removed.
• Community activity: follows, blocks, comments, reactions, votes, wishlists, collecting requests, achievements, event attendance and locations you enter, messages, and proposed transaction details. We store messages in a form the application can read; messaging is not end-to-end encrypted.
• Trust and support: possession challenges, evidence photos, review outcomes and reasons, reports, correspondence, and account-security information. A reported conversation may include a snapshot of recent messages for moderation. If you submit a legal or privacy request, we store the name and reply email you provide, the request category and message, submission time, reference number, and review status. The request is available to the site's authorized operator, not other collectors.
• Waitlist and referrals: name, email, referral code, referral source, signup and sharing actions, priority status, and any social-post link you voluntarily supply. Joining the waitlist does not create an account or grant rights in photographs.
• Legal choices: accepted policy versions, acceptance time and context, adult-eligibility attestation, and records identifying photos contributed under a particular license. We keep the applicable document and image digests to document the scope of permission.

Do not provide government identification, payment-card details, wallet secret keys, sensitive health information, or unnecessary information about other people through collection descriptions or messages. Those details are not needed for the current beta.

Optional GIFs from GIPHY

When GIFs are enabled, opening the picker or searching sends GIPHY the search words or trending request and a random identifier assigned to your account for this feature. We do not send GIPHY your email, name, collection or conversation text, and we do not retain or log GIF search words. Loading GIPHY media and sending the seen/sent events also lets GIPHY receive your device's IP address and normal connection information. We send only seen and sent events, not click events. GIPHY handles this information under its privacy policy.

A GIF you send is attached to its comment or message, with its GIPHY identifier, attribution and display links. It has the same audience as that comment or conversation. We do not download or rehost GIPHY media. You can hide a GIF for yourself or report the containing comment or conversation through the existing moderation tools. Moderators can remove its display for everyone. Account deletion removes attached GIF records along with the affected content; existing moderation-report retention still applies. These features remain unavailable until the required provider permissions are in place.

2. Technical information and information from others

When you use the Service, our systems and infrastructure providers process normal request information such as IP address, browser or device information, requested pages, timestamps, errors, and security signals. We use temporary or pseudonymous identifiers for rate limits, abuse prevention, referral counting, and linked capture sessions. An IP-derived hash is not necessarily anonymous information. Your browser may also send us an automatic security report when a page tries to load something our content security policy doesn't expect; we log only the rule involved, the website origin of the blocked item, and the page path, not the full address or the page's contents.

Product usage and usage stats. To learn which parts of GrailSociety help collectors, we record the days you use the Service while signed in (one entry per day, with nothing about what you did) and, unless you turn Share usage stats off, product events: which screens and features you use, the steps of adding a collectible, counts such as reaching your 5th card (as a range, not an exact number), the categories of questions you ask Grailien and whether you rated an answer up or down, which notifications you open, the outcome of a certificate lookup (found or not found), and the kind of device and app version. Each event uses only values from a fixed list. Usage stats never include your photos, card titles or details, certificate or serial numbers, values or prices, chat, message or Grailien text, search terms, your name, handle or email, or your precise location. Events are linked to a random-looking identifier that we derive from your account on our server; PostHog, our analytics provider (Section 6), does not receive your account ID, name, handle or email. The iPhone and Android apps send their events to our server, which forwards them; on the website, PostHog's script is served from our own site, keeps nothing in cookies or local storage, and records no page addresses, clicks, page text or screen recordings.

Signed-out visitor counts. We count signed-out visits on our own server without cookies or PostHog's browser script. To avoid counting the same browser repeatedly within one UTC day, we derive a daily rotating salted hash from the request's IP address and browser user agent; these raw inputs are not stored by the visitor-counting system. The daily hashes are deleted on the next day. We retain aggregate counts for up to 13 months, filter known bots, group profile and collectible pages by type, and keep only the referring domain and approved campaign tags rather than full addresses or search terms. An IP-derived hash is pseudonymous, not proof of a unique person.

Sign in with Google or Apple. If you choose to continue with Google or Apple, you sign in on that company's own page, and it confirms who you are with a signed token: your account identifier with that service, the email address it shares, and whether it has verified that address. Google also shares your name. Apple shares your name only the first time, and may give us a private relay address from Hide My Email instead of your real email. For each service you connect, we keep its identifier for you, the email it shared and whether that is a relay address, and when you connected and last used it. We use the name only to suggest a display name and username, and ignore other profile details. A verified email becomes your account email only if no other account uses it. From Apple we also keep a refresh token, encrypted, only so we can ask Apple to revoke it when you disconnect Apple or delete your account; we do not store access tokens. We never connect a Google or Apple sign-in to an existing account just because the email matches: you connect it by signing in once with that account's password, or from Settings while signed in. Google and Apple learn that you used them to sign in to GrailSociety and handle that under their own terms and privacy policies; they do not receive your collection.

For linked phone and desktop capture, we process an account-linked batch identifier, per-device identifiers, activity state, previews, upload progress, and your draft changes so your devices can work on the same collection. Both devices must be authorized for the account. Previews can sync while you review a capture; approved originals upload in the background. Camera access does not mean we stream your entire camera session to other collectors.

We receive catalog facts, images, identifiers, and source information from integrated catalogs, grading services when available, and approved community contributions. Other users may mention you, follow you, reply to you, or report an interaction involving you. We may compare those records to prevent duplicate submissions, detect abuse, and resolve catalog matches. Search terms and certificates you ask us to look up may be sent to the relevant provider; do not include unrelated personal information in those searches.

3. How we use information

We use information to create and secure accounts; save and present collections; sync and process photos; suggest catalog matches; operate profiles, feeds, messages, events, and referrals; deliver in-app notifications; provide support; review reports and possession claims; enforce rules; maintain permission records; and understand and improve the Service.

Account security. When you set a new password (at sign-up, with a reset link or recovery key, when you change it, or when you add a first password to an account made with Google or Apple), our server checks it against a public list of passwords already exposed in data breaches, and asks you to choose a different one if it is on that list. Your password is never sent anywhere for this check: our server sends a security service only a short, partial fingerprint of it, which cannot be turned back into the password and matches many different passwords, and never your account or email. If the check can't be completed quickly, the password is accepted under our other password rules. We send security emails only to a confirmed address: a reset link you request, and notices when your password changes, when a recovery key is made, and (to the previous address) when your sign-in email changes. Activity email preferences don't turn these off.

Camera alignment and countdown run in the browser. The current label-reading tool uses locally loaded OCR software, and server image processing runs within our application infrastructure.

Photo matching. When you add a collectible, we send a cropped photo of its front to our card-identification partner, CardSight, to suggest which item it is. We remove location and camera details from the photo first. CardSight may keep and use these photos to improve its identification service, under its own terms. You can turn photo matching off at any time in Settings → Privacy; your photos then stay with GrailSociety only, and you choose the item yourself. We do not send CardSight the back photo, your account email, password, or ownership history for this purpose. CardSight’s published terms allow it to use uploaded data to train and improve its models; we have no separate no-training or fixed deletion commitment from CardSight. Review CardSight’s terms and privacy policy before choosing. We do not keep a separate identification-upload copy, but your collection photo remains subject to the collection and deletion rules in this notice. OCR and matching results can be wrong and should be checked before saving. Possession decisions may require an authorized human reviewer; automation does not guarantee authenticity or legal ownership.

Card identification by vision models. When photo matching is on, we may also send the photos you take of a card (its front, and its back when you add one) to Anthropic and Google, whose vision models read the card to suggest which item it is. When this feature uses Ximilar, a card-identification service, we also send it the front photo. We send a smaller copy of your original photo with location and camera details removed. We do not send your account email, password, ownership history, or a certificate number. Anthropic and Google provide these models under their paid API terms, which do not allow them to use the photos to train their models. They may keep them for a limited time for security and abuse monitoring, under their own terms. Ximilar processes the front photo to return a match, under its own terms. With photo matching on, we may also send these card photos to the same providers to find the card's edges, so the photo can be cropped and straightened automatically. The same Settings → Privacy → Photo matching switch controls this: turned off, none of these photos are sent. Identification results can be wrong; you confirm the card, and anything we could not read clearly (such as a serial number) is left for you to fill in.

To check and improve identification, we keep a private record of each identification for 180 days: which of your photos were read, what each model returned, the suggestion we showed, how long it took and what it cost, and later what you saved. Only authorized personnel can see it. It is deleted after 180 days, or sooner when you delete your account. It does not keep your copy's serial number.

Grailien, the collecting buddy. Where Grailien is on for your account, what you send it (your messages, the photos you attach, and the piece you ask about) and the collection, wishlist, value and leaderboard information its tools look up for your question are sent to Anthropic, whose AI model writes the reply. We keep your Grailien conversations with your account so you can list, search and continue them; they are private to you and are never used to answer another member. Where memory is on, Grailien may offer to save a short note about your collecting (what you collect, want, chase or prefer), quoting the words you used; nothing is saved until you tap Save, and notes may not hold information about other people, money or budgets, health, contact details or similar private matters. Saved notes are given to the model only in your own conversations. You can rate an answer up or down and pick a reason; that rating is stored with the answer and reviewed only as totals. Separately, you may choose to share one answer with the team that reviews Grailien's quality: you see the exact excerpt first (your message and the reply, with amounts, numbers, links and other members' handles removed, and no photos or values), it is shared only if you tick the box, you can withdraw it, and it is deleted after 30 days. Each reviewer view is logged.

We may feature content you publish publicly in promotion of GrailSociety under the Terms. Content you separately contribute under the Catalog Contribution License may also be used for the catalog products described in Section 5. Neither use authorizes public disclosure of private messages or verification evidence.

We may use aggregate or deidentified information to understand catalog coverage, product performance, and collecting trends. When we represent information as deidentified, we take reasonable measures to prevent linking it back to individuals, do not attempt reidentification except to test those measures or where law permits, and require the same protection from recipients where applicable.

4. What is public and what stays restricted

Profiles and collectibles you publish publicly may be seen by visitors, other users, search engines, and people following shared links. Public actions, such as commenting on a public collectible or marking attendance public, may appear in feeds or notifications. Making your own profile private does not necessarily hide comments you chose to post on someone else's public item.

Private collection records, original photo files served through private-original routes, draft batches, account email, and verification evidence are access-restricted. Authorized personnel and service providers can access them as needed for the uses described in this policy. Certificate and serial text fields are restricted in public collection responses, but the same number can remain readable in a public photo. Check both your visibility selection and the contents of your images before publishing.

Anyone who can view public material may copy or share it independently. Changing a setting on GrailSociety does not erase those independent copies. You can change collection visibility, edit or remove material, and block or report users through the available controls.

5. Catalog images, commercial products, and business value

The shared catalog is separate from a member's private collection. If you expressly license selected material as a catalog contribution, we may maintain reference copies independently of your account and make those contributions available in commercial image libraries, paid APIs, datasets, feeds, integrations, and partner products. They may support collectible identification, matching, search, analytics, and catalog-related machine learning as described in the contribution license. These are permitted product directions; this notice does not assert that every such product is already operating.

We intend catalog licensing to concern collectibles and appropriately licensed reference imagery, not the sale of our private member directory, messages, possession evidence, or private ownership histories. We may remove account attribution from reference assets. A visible face, a slab number, or a linkable image can still contain personal information even if a username has been removed.

Before any new commercial distribution involving personal information, we will assess applicable legal grounds, recipients, purposes, notices, contracts, and choices. If a use is a regulated sale, sharing for targeted advertising, or another activity requiring an opt-out or opt-in, we will provide the applicable mechanism before starting it. A contribution checkbox is not a waiver of those rights. We do not currently operate a third-party advertising-pixel or targeted-advertising program within the application.

Help build the catalog. Unless you turn it off in Settings → Privacy, we use the card facts of your public cards (category, franchise, manufacturer, set, year, card number and subject) and the cleaned, cropped image of a public, ungraded card, with photo metadata such as EXIF and location removed, to build and check the shared catalog. To decide whether a card is ready to add, we compare your saved card details with the readings of your own photo-matching scan of that card, and we compare fingerprints of members' public card photos (a file digest and a perceptual hash) so that the same photo is never counted twice. These checks stay internal: the catalog shows no member name, and a photo is credited "Photo from a collector". Private pieces, private profiles, original photos with their background, graded-slab photos, and reference or verification images are never used. Turning the setting off stops future use; what is already in the catalog remains, as described below.

Selected catalog contributions may remain after account deletion under their applicable license. Personal account data and permission evidence have separate retention rules. A privacy or infringement request can still require limiting or removing a licensed asset. We will not silently apply a new commercial license to older images whose existing permission is narrower.

6. Who receives information

We disclose information only as appropriate for the purposes described here:

• Other users and the public: content and activity you publish, messages to their participants, and public reference contributions.
• Service providers: infrastructure, storage, security, technical maintenance, and authorized support or review providers who help operate the Service. The hosted beta uses Render for application hosting and its database, Cloudflare R2 for photo storage, and Resend to deliver email, which receives the recipient address and the message, including any reset link. These providers process the information necessary to deliver their services.
• Catalog and grading sources: the relevant search terms, source IDs, and certification requests needed to retrieve a result. Current adapters include CardSight, TCGdex, Scryfall, Open Library, and Grand Comics Database. PSA lookup is supported but access and successful results depend on that provider. These adapters do not send your password or account email as part of a card search. The optional photo-matching features send photos as described under Photo matching and Card identification by vision models in Section 3: the cropped front photo to CardSight, and the front and back photos to Anthropic and Google (and the front photo to Ximilar when that service is used), unless you turn photo matching off in Settings → Privacy. Other catalog searches do not send camera photos.
• Product analytics: PostHog, Inc. receives the usage stats described under Product usage in Section 2, as our service provider, in the United States, to give us usage reports. It receives the opaque identifier and listed event values, not your account ID, name, handle, email, photos, collection details or messages. On the website your browser sends these events to PostHog directly, so PostHog also receives normal network and browser-request information such as your IP address and browser type; we ask PostHog not to keep IP addresses. Turning Share usage stats off in Settings → Privacy stops them.
• Sign-in providers you choose: Google (Sign in with Google) and Apple (Sign in with Apple), as described in Section 2. Our server sends the provider the one-time sign-in code and our app credentials to confirm a sign-in, and asks Apple to revoke its token when you disconnect Apple or delete your account. If you use Apple's Hide My Email, our emails reach you through Apple's relay.
• Breached-password check: the security service that keeps the list of breached passwords receives only the short, partial fingerprint of a new password described under Account security in Section 3, never the password itself, your account or your email.
• External image hosts and linked services: loading an externally hosted catalog image can disclose normal network and browser-request information to that host. If you open a social-sharing composer, event page, marketplace link, or another external service, that service's terms and privacy policy apply there.
• Security services if enabled: a service such as Cloudflare Turnstile may process browser and network signals and a verification token for anti-bot checks. These checks are used when enabled for the relevant feature.
• Catalog business licensees: the selected, appropriately licensed reference assets and related catalog data described in Section 5, subject to the required rights and data-protection checks.
• Legal and safety recipients: authorities, professional advisers, or affected parties when reasonably necessary to comply with law, respond to valid process, investigate misuse, establish or defend claims, or protect safety and rights. We evaluate requests rather than promising unrestricted disclosure.
• Business successors and advisers: parties involved in a contemplated or completed financing, reorganization, merger, acquisition, or transfer of GrailSociety or relevant assets, under appropriate confidentiality and data-use restrictions. A successor must honor applicable privacy commitments. A new incompatible purpose requires the notice and choices the law requires.

Access by a provider does not give it an unrestricted right to independently sell your private content. Future integrations with materially different data use will be assessed and disclosed before activation where required.

7. Cookies, local storage, and device permissions

We use a session cookie to keep you signed in, generally lasting up to 30 days unless ended earlier. If you continue with Google or Apple, two short-lived cookies tie that sign-in to your browser and hold the step before you choose a username; they last at most 10 and 15 minutes. We also use local or session storage for preferences, referral state, waitlist status access, onboarding acknowledgements, upload recovery, linked-device operation, and sign-in steps, such as a password reset link you opened or an invitation code you typed before continuing with Google or Apple. These are not advertising cookies.

Capture drafts and original images can remain in your browser's IndexedDB storage so you can recover after a reload or interruption. Signing out or deleting your server account does not automatically erase every locally stored draft on every device. Remove unwanted draft items and clear GrailSociety site data in each browser to remove local copies. Clearing site data can also erase unsynced photos and sign you out; save anything you need first.

Your browser or operating system asks for camera access. You can deny or revoke that permission and use a supported file-upload option instead. We do not require continuous background camera or precise GPS permission for collecting. An event location you type or location embedded in an original photo may still be processed as described above.

The current application does not use third-party marketing pixels, advertising identifiers, or cross-site or cross-app tracking. Usage stats (Section 2) are analytics for improving the Service, sent to PostHog as our service provider; they are not used for advertising, not combined with other companies' data, and not sold. PostHog's script on the website keeps its state in memory only: it sets no cookie and writes nothing to local storage. If we add nonessential tracking that requires a choice, we will provide that choice before it runs where required. Browser privacy signals do not themselves remove account content; applicable sale or sharing opt-out signals will be honored when the relevant law and activity apply.

8. Retention and deletion

We retain information for the service purpose, your choices, safety and dispute needs, and legal obligations. Different records have different lifetimes:

• Account, collection, and social records: generally remain while needed for your account and the features you use. An archived collectible or archived waitlist entry remains stored; archiving is not deletion.
• Photos and drafts: remain until you remove them or the relevant account-deletion process runs, except for separately retained catalog references or justified legal records. Hosted photo deletion is queued and retried by a background worker, so removal from storage may follow removal from the interface.
• Identification records: the private record of each card identification described in Section 3 is deleted after 180 days, and with your account. Anthropic, Google and Ximilar keep what they receive only under their own terms, as Section 3 describes.
• Grailien conversations and notes: kept with your account until you delete them. Deleting a conversation deletes its messages and the ratings and shared excerpts for them; a note you saved stays until you delete it, and a deleted note is not offered again. We keep a minimal record that a deletion happened (never its text) so it can be reapplied after a restore. Shared excerpts are deleted after 30 days. Everything is deleted with your account. Anthropic keeps what it receives only under its own terms.
• Usage records: the record of which days you were signed in is deleted after 13 months, and with your account. Usage stats sent to PostHog are kept under our PostHog project's retention setting, no longer than 13 months; deleting your account removes the only link between your account and their identifier, and you can ask us to have the events under that identifier deleted.
• Linked-capture presence and previews: live presence expires after roughly one minute without renewal; temporary photo previews expire within about 24 hours or are replaced by the accepted upload. This does not delete your saved photo or draft batch. Technical cleanup can occur after expiry.
• Sign-in and reset records: a password reset link expires after 30 minutes and works once; its record is cleaned up after expiry and deleted with your account. A Google or Apple sign-in in progress expires within 10 minutes, and an unfinished sign-up within 15; those records are cleaned up after expiry. A connected Google or Apple account stays linked until you disconnect it or delete your account, and its stored Apple token is deleted with the link.
• Permission and safety records: limited acceptance receipts, file digests, catalog grant records, evidence fingerprints, referral-abuse markers, and relevant audit or report records may remain to establish licenses, prevent replay or fraud, resolve disputes, or meet legal obligations. These are not automatically anonymous. Retention is limited to what those purposes justify and is subject to applicable rights.
• Legal and privacy requests: we retain request records while handling the matter and for justified follow-up, compliance, or dispute needs. Closing a request marks its status; it is not automatic erasure. Contact us about deletion of the request record itself. Account deletion does not automatically remove an independently submitted request.
• Approved catalog references: can persist independently under their accepted license. Account attribution is detached on account deletion; a reference image itself may still include visible identifying details.
• Backups and infrastructure logs: may retain information after it is removed from active use until the applicable retention and backup process completes. Access should be restricted to recovery, security, legal, or operational needs. We do not promise immediate removal from every backup or independent recipient.

Account deletion removes the main profile, personal collection, and associated records through our deletion process. It does not necessarily erase another person's report about you, all historical safety records, independent public copies, or a catalog contribution subject to an enduring license. A standalone waitlist entry may require a separate request, especially if it was never linked to your account. Contact us for these requests or if a deletion appears incomplete.

9. Your choices and requests

Use Account Settings and collection controls to update supported information, change visibility or messaging preferences, turn Help build the catalog on or off, turn Share usage stats on or off (Settings → Privacy; on by default, and off takes effect at once on the website, the apps and our server), export available account records, or delete your account with password confirmation (for an account without a password, a Google or Apple sign-in within the last 15 minutes). Under Settings → Sign-in & recovery you can change your password, make a recovery key (this needs your current password), and connect or disconnect Google or Apple where offered. You can't disconnect your last way to sign in; set a password first. The current export is a convenience export of available profile, collection, activity, and related records; it is not a guarantee that every personal-data category or original image byte is included. Contact us for a broader access request.

In Grailien, Your chats lets you search and delete conversations, one at a time or all at once. Settings → Grailien memory shows every note Grailien keeps about you with the words it came from, and lets you edit or forget each one, forget everything (and optionally all your chats), turn memory off (Grailien stops using and offering notes) and turn off recall of your earlier chats. The account export includes your conversations, ratings, shared excerpts, notes and these settings.

Through our Legal & Privacy contact page, you may request access, correction, deletion, or information about processing, and raise an objection or ask to withdraw a consent where applicable. Specify your handle or the email used for the waitlist and the request; do not send a password or recovery key. We may reasonably verify your identity and authority without collecting unnecessary information. We will explain a refusal or limitation when required and respond within applicable legal time limits. If your law provides an appeal, include the earlier request reference and say that you are requesting an appeal so it can be reviewed. Submitting this form saves a request for the operator; it does not itself delete data or send an automated email response.

Depending on your location and which laws apply, you may also have portability, restriction, sale or targeted-advertising opt-out, sensitive-information limitation, authorized-agent, or complaint rights. We will not unlawfully discriminate for exercising those rights. A broad content license does not extinguish them.

We may send necessary service communications using available channels. Joining the waitlist permits communications about your requested beta access; it is not an automatic subscription to unrelated promotional campaigns. If we introduce optional email marketing, we will provide required choices and an unsubscribe mechanism. You control whether to post a social share yourself.

10. Regional information and international processing

Information may be processed where we and our providers operate, including the United States for the hosted beta. Privacy laws and available protections may differ across locations.

Where the GDPR or similar law applies, we rely on performance of our agreement for requested account features; legitimate interests for appropriate security, service administration, and improvements, balanced against your rights; legal obligations where applicable; and consent where required, including particular optional uses. A content license is not itself consent for all personal-data processing. You may contact the relevant data-protection authority and exercise applicable access, correction, deletion, restriction, portability, objection, and consent-withdrawal rights. Any required transfer mechanism must be established for the actual transfer; this policy does not claim certification or a contractual safeguard that has not been put in place.

For U.S. state privacy laws, applicable rights depend on the law's scope and our activities. The categories, sources, purposes, and recipients above describe the beta. Before starting a regulated sale or targeted-advertising sharing program, we must provide the required notice and operational controls, including recognition of legally required browser opt-out signals. We do not infer that information is exempt from protection merely because it appears somewhere online.

11. Security and children

We use controls such as HTTPS, which browsers are told to always use for our site; salted, deliberately slow password hashing; password rules, including the breached-password check in Section 3; one-use, time-limited reset links; security notices to your confirmed email; sign-in and reset rate limits; signing out your other devices when your password is reset or changed; authenticated access to private content; permissions for reviewers; and request protections. No system can guarantee absolute security. Protect your devices and account, be thoughtful about publishing valuable collections and locations, and report suspected security issues through the contact above.

The beta is intended for adults 18 and older, and is not directed to children under 13. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action. An age statement does not replace obligations that apply if we learn we are processing a child's information.

12. Changes and contact

We will publish revisions with an updated effective date and provide additional notice for material changes where appropriate or required. We will seek permission where required before materially expanding use of previously collected information. Merely editing this policy does not silently convert private photos or legacy reference assets into commercially licensed catalog contributions.

Service operator: GrailSociety LLC

Principal address: 4030 Wake Forest Road, Ste 349, Raleigh, NC 27609, US

Get in touch: hello@grailsociety.co

Privacy and legal requests: Contact GrailSociety. You do not need an account to submit a request.