What we store
- Account: your username and a scrambled (hashed) version of your password. We can't read your password.
- Email (optional): only if you add one, so you can reset your own password. It is used for that and for account notices, never for marketing.
- Your content: the entries you write (including private ones), your tags, the group memberships you have, copies you saved from others, people you have blocked, and reports you make.
- Sign-in sessions: a random token that keeps you signed in on each device (a cookie on the website, secure storage in the app). Only a hash of it is stored on our server.
- Technical data: the hosting service may keep ordinary server logs (such as IP addresses and times of requests) for security and reliability. The Grimoire itself uses your address only briefly in memory to slow down repeated sign-in attempts, and does not store it with your account.
We do not collect your location, contacts, photos, device identifiers or advertising identifiers, and the apps contain no analytics or advertising tools.
Who can see it
- Public entries (with your username as the author) can be read by anyone, including people without an account, and may be saved by other members.
- Group entries are visible to that group's members.
- Private entries are visible to you. Administrators can also open them, only for moderation, support and keeping the service running.
- Your email address and password are never shown to other members.
How it is used
Only to run the Grimoire: signing you in, showing entries to the people you chose, handling reports and abuse, sending password-reset or confirmation emails you asked for, and keeping backups. We don't sell your data, use it for advertising, or build profiles about you.
How long we keep it, and deleting it
We keep your data while your account exists. You can delete your account yourself at any time under Your account, on the website or in the app. That removes your profile, entries, saved copies, group memberships, blocks, sessions and email. Reports that others filed about content stay so moderators have a record, but they no longer link to your account. Automatic backups and hosting snapshots that already contain your data are replaced on a rolling basis and are gone within about a week.
You can also edit or delete individual entries whenever you like. Copies other members saved from a public entry remain theirs, and show no author name once your account is deleted.
Security
Connections are encrypted (HTTPS), passwords are hashed with a slow, salted algorithm, sign-in attempts are rate-limited, and the database is backed up daily. No online service can be perfectly secure, so choose a strong, unique password and keep especially sensitive material out of the app.
Your choices and rights
You can view and change your entries, email and password in the app, block members, and delete your account and data yourself. Depending on where you live (for example the EU/UK or California) you may have further rights, such as receiving a copy of your data or correcting it. To exercise those, contact us using the details below.
Children
The Grimoire is not for children under 13, and we do not knowingly collect their information. If you believe a child has an account, tell us and we will delete it.
Changes
If this policy changes in a meaningful way we will update the date above and ask you to review it the next time you sign in.
Contact
Use the contact details on the Grimoire's store listing or website. To report a person or entry, use the in-app Report button.