GREYPILE

THE PILE OF SHAME

Privacy Policy

Last updated: July 2, 2026

1. Who We Are

GreyPile ("we", "us", "the app") is operated by Andrea Caserini, an independent developer based in the European Union. You can reach us at neuralsand@gmail.com.

For the purposes of the EU General Data Protection Regulation (GDPR), we are the data controller for the personal data processed in connection with the app.

2. What Data We Collect

2.1 Account information

• Email address — required to create an account and log in.
• User identifier — a unique ID assigned by our authentication provider (Supabase). Used to associate your content with your account.
• Authentication provider — if you sign in with Apple or Google, the provider returns an identity token we use to create or match your account. We do not receive your social account password.

2.2 Content you create

• Armies, units, painting state, notes, notification preferences, sort order.
• Timestamps (created, updated, completed).

2.3 Purchase information

• If you upgrade to GreyPile Pro, our payment processor (RevenueCat) records the purchase, restore and entitlement status linked to your user ID. We do not store credit card details — these are handled by Apple App Store or Google Play.

2.4 Diagnostic and crash data

• When the app encounters an error, we automatically collect crash logs, performance data, device information and IP address to help us find and fix bugs.
• For a sample of app sessions — and for every session where an error occurs — we also record a session replay: a visual recording of the app screens shown to you during that session, used to reproduce and diagnose issues. Session replays do not use your device's camera or microphone and do not capture activity outside the app.

2.5 What we do not collect

• We do not run advertising trackers.
• We do not collect location, contacts, or photos.
• We do not sell your data to third parties.

3. Why We Collect It

• App functionality — store and sync your armies and miniatures across sessions and devices.
• Authentication — verify your identity at sign-in.
• Notifications — schedule local reminders for unpainted units (only when you enable them).
• Pro entitlement — unlock features after purchase and allow restoring purchases on a new device.
• Diagnostics — detect, diagnose and fix crashes and bugs (see 2.4).

Legal basis under GDPR: performance of a contract (Art. 6(1)(b)) for account and content data; consent (Art. 6(1)(a)) for notifications; legitimate interest (Art. 6(1)(f)) for security and abuse prevention.

4. How and Where Data Is Stored

Your account and content are stored on infrastructure provided by Supabase (EU region) in a PostgreSQL database with row-level security: each row is accessible only to its owner. All traffic between the app and our backend uses HTTPS/TLS.

Authentication tokens are stored locally on your device by the operating system so you stay signed in between launches.

5. Third Parties We Share Data With

We only share data with service providers that help us operate the app:

• Supabase (database and authentication) — receives your email, user ID and content.
• RevenueCat (in-app purchase management) — receives your user ID and purchase events. RevenueCat privacy policy.
• Apple App Store / Google Play — handle the actual payment when you upgrade to Pro.
• Apple / Google — if you choose social sign-in, your chosen provider authenticates you and shares an identity token with us.
• Sentry (crash reporting and diagnostics) — receives crash logs, performance data, device information, IP address, and, for a sample of sessions, an on-screen session replay, to help us diagnose bugs (see 2.4). Sentry privacy policy.

None of these providers receive your data for advertising or analytics outside their role described above.

6. How Long We Keep Your Data

• Active accounts: for as long as your account exists.
• After deletion request: your account is marked as deleted immediately and becomes inaccessible. Data is permanently erased within 30 days. Within that window you may sign in again to recover your account.
• Purchase records: RevenueCat retains transaction records as required by tax and consumer protection laws (typically up to 10 years for receipts).

7. Your Rights

Under GDPR and similar laws (CCPA, UK GDPR, etc.) you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your account and associated data (in-app: Settings → Delete Account).
• Portability — request a machine-readable copy of your content.
• Object to processing or restrict it.
• Withdraw consent for notifications at any time (in-app or in your OS settings).
• Lodge a complaint with your local data protection authority.

To exercise these rights, write to neuralsand@gmail.com. We will respond within 30 days.

8. Children's Privacy

GreyPile is intended for users aged 13 or older. We do not knowingly collect data from children under 13. If you become aware that a child under 13 has provided us with personal data, please contact us so we can delete it.

In the European Economic Area, the minimum age may be higher (16 in some member states). Where required, parental consent is necessary.

9. Security

We use industry-standard measures to protect your data: HTTPS in transit, row-level security in the database, and isolation of user content. No system is perfectly secure — if a breach affecting your data occurs, we will notify you and the relevant authority as required by law.

10. International Transfers

Our infrastructure is hosted in the European Union. Some service providers (e.g. RevenueCat, Apple, Google) may process data in the United States or other jurisdictions. Where this applies, transfers are protected by Standard Contractual Clauses or equivalent safeguards.

11. Changes to This Policy

We may update this policy from time to time. The "Last updated" date at the top of this page reflects the latest revision. Material changes will be announced in the app and, where required, communicated by email.

12. Contact