Privacy policy

Gridspin is a free football game. It keeps as little about you as it can: an email address if you want an account, the name you pick, and the seasons you play. There are no adverts and no trackers, nothing is sold or handed to anyone else, and the two things it does record - a counter for visits and a report when the game crashes - set no cookie, carry no name, and cannot follow you off the site.

Anything below can be undone by writing to privacy@gridspin.app.

Playing without an account

You can play Gridspin without signing up, and nothing is asked of you to do it. A draft in progress is kept in your own browser so you can come back to it, and it never leaves your device until a season is finished.

When you finish a season, the site makes a guest account for you so the score can go on the leaderboard. A guest account holds no personal information at all: no email address, no name you gave it - just a name the site generates, like Guest_4F2A1, and the seasons played under it. You can turn it into a real account later, and everything carries over.

Accounts

An account is an email address, a password and the username you pick. The password is handled by Supabase, the service that runs the database and sign-ins, and is stored only as a hash - nobody at Gridspin can read it.

If you sign in with Google instead, Google sends the site your email address, your name and a link to your profile picture. The email address is what identifies the account; the name and picture link sit unused in the account record, and the game shows only the username you choose.

Account emails are sent for one reason: running the account - confirming an address, resetting a password. There is no mailing list and no marketing.

What other people can see

Your username, your scores, your records, your best lineups and your badges are public: that is what a leaderboard is. So are anything you write in your bio, the picture you choose and the team you pick as your favourite.

Your email address is never shown to anyone, whether you signed up with it or arrived through Google.

What the game records as you play

Every finished season and every abandoned one: the boards you were dealt, the players you drafted, the score, the result and when it happened. The same for the daily, for Over/Under, Build-a-player, Century and Guess the Player, and for the picks either side of a duel.

The coins a season earns, the badges it unlocks and anything bought in the shop. Coins are a game score - there is no real money anywhere in Gridspin and nothing to buy with real money.

Pictures

A profile picture is cropped to 256 by 256 in your own browser before it is uploaded, and every piece of metadata the file carried - where and when it was taken, what took it - is removed in the process. What reaches the server is the picture and nothing else.

Pictures are stored in a public bucket, which means anyone with the address of the file can open it, the same as any image on any website. A moderator can remove a picture or a bio that breaks the site's rules.

Where it all lives, and who else sees it

The database, the sign-ins and the pictures are held by Supabase. The site itself is served by Vercel. Both keep ordinary server logs to run the service, which include IP addresses and the times requests were made.

The typefaces come from Google Fonts, so Google's servers receive the request for them when a page loads. Signing in, signing up, resetting a password or having a guest account made for you also loads Cloudflare Turnstile, an anti-robot check: Cloudflare sees that request and decides whether the browser making it looks like a person. It runs invisibly and never asks you to solve a puzzle, and what Cloudflare collects in order to decide is covered by their Turnstile Privacy Addendum, at https://www.cloudflare.com/turnstile-privacy-policy/. It runs on those four moments only, it is not loaded while you play, and it is there because an account that costs nothing to make is an account somebody can make thousands of.

There is a counter, so the site can tell whether anybody is arriving and from where. It is run by Vercel, who already serve the site, and it records that a page was opened, which page it was, and which site you came from - never who you are. It sets no cookie. The identifier it uses is a number worked out from the request itself and thrown away at the end of each day, so it cannot tell that today's visitor is yesterday's, and it cannot follow you to any other site. This page and the terms do not carry it at all: a page you came to read to find out what is collected is not a good place to collect anything.

If the game crashes, your browser sends a report so the fault can be found and fixed. It carries the version of the game, the error and where in the code it happened, which screen you were on and which browser you are using - never your name, your account, your email address or your IP address. The screen is a name like "profile" rather than the address you were at, so a report sent from somebody's profile page cannot say whose. Reports are kept no longer than 90 days, and are removed as later ones arrive. This page and the terms cannot send one at all: they carry none of the game's code.

There are no adverts, no tracking pixels and nothing from an advertising network. Nothing else on the site is loaded from anywhere else.

Nothing is sold, rented or handed to anyone else.

What is kept on your device

A draft in progress, a Century or Guess the Player game in progress, which dailies you have already played, the scoring format you last chose, whether you have seen the rules, and - if you are signed in - the token that keeps you signed in. It lives in your browser's own storage rather than in advertising cookies, and clearing your browser data removes it.

Your choices

You can change or clear your bio, your picture and your favourite team whenever you like, from your profile. To close your account, use Close my account on your profile - or write to privacy@gridspin.app from the address the account uses and it will be done for you.

Closing it erases the person: your name, your email address, your bio, your picture, your favourite team, your coins, the items you own and your badges. The seasons, dailies, duels and mini-games you played stay on the leaderboards, under a name that is nobody's and cannot be traced back to you. They are not kept to hold on to you - they are part of other players' leaderboards and other players' duels, and taking them away would quietly change somebody else's record.

A guest account identifies nobody, so there is nothing to delete - stopping playing is enough. If you would rather its scores came off the leaderboard, write in and say which name it was.

Children

Gridspin is for people aged 16 and over, and no data is knowingly kept from anyone younger. If you believe someone under 16 has made an account, write in and it will be removed.

Changes to this page

This page says what the site does today, and it is updated when the site changes. It was last updated on 5 October 2026.

Play Gridspin How to play Gridspin Gridspin leaderboards Terms of use

Player and team statistics from nflverse, used under CC BY 4.0 and modified: the ratings, boards and eras are this game's own. Not affiliated with the NFL.