Privacy Policy
Last updated: 7 October 2026
Grind Order is made by a small independent team. This page explains, in plain words, what personal data this website and the game server handle, why, for how long, and what you can do about it. Short version: we only keep your email address if you put it on the waitlist, we use it only to tell you about the game, and you can have it deleted at any time. There are no cookies and no advertising on this website.
Who is responsible
The Grind Order team is the data controller. Contact for anything about your data: hello@grindorder.com.
What we collect, and why
| What | Why (legal basis) | How long |
|---|---|---|
| Waitlist: your email address, the time you ticked the consent box, which version of the consent text you saw, and which button on the site you used (for example “hero”). Nothing else: no name, no IP address, no device details. | To email you about Grind Order (launch news, test invitations). Your consent (GDPR Art. 6(1)(a)). You can withdraw it at any time. | Until you ask us to delete it, or 24 months after you signed up, whichever comes first. |
| Server logs: when you open a page, our web server records the time, the page you asked for, your IP address, the browser name and the result. This is standard for every website. | To keep the site running and secure and to find faults (legitimate interest, Art. 6(1)(f)). | About 14 days, then deleted automatically. |
| Rate limiting: to stop abuse of the waitlist form, the server remembers how often an IP address used it, in memory only. | Security (legitimate interest). | Minutes to a day. Never written to disk. |
| Your email, when you write to us: the message and your address. | To answer you (Art. 6(1)(b) or (f)). | As long as needed to answer and follow up, then deleted. |
If you play the game in your browser (the “play in browser” link), the game server also stores your hero (name, level, items and progress) under a random identifier created on your device, so that your progress is kept and other players in the shared world can see your hero. It does not ask for your name or email. See the cookie and storage notice for what the game keeps in your browser. Chat messages are passed on to the other players on your map and are not stored by us.
What we do not do
- No cookies and no tracking scripts on this website. No analytics of any kind, no advertising pixels, no social media widgets.
- No third-party fonts or content networks: fonts, pictures and code are served from our own server.
- We do not sell or rent your data, and we do not use a third-party email service for the waitlist. Your address goes straight into our own database.
- We do not make automated decisions or profiles about you.
Where it is kept, and who can see it
The website, the game server and the waitlist database run on a server we rent from Hetzner Online GmbH in Germany (data centre in Falkenstein, EU). Hetzner provides the machine. Cloudflare provides our domain name (DNS) service, which means it answers the question “which server is grindorder.com”; the pages themselves are not sent through Cloudflare. The waitlist table can be read only by the game server software and by the team members who run it. We do not transfer the waitlist outside the EU/EEA.
Your rights
Under the GDPR you can ask us for: a copy of your data (access and portability), correction, deletion, restriction of its use, and you can object to processing based on legitimate interest. You can withdraw your consent at any time; withdrawing does not affect what we did before.
- Leave the waitlist: every email we send will have a one-click unsubscribe link that deletes your address immediately. Until the first email is sent, write to hello@grindorder.com from the address you signed up with and we delete it, normally within a few days and always within 30 days.
- Complain: if you think we handle your data wrongly, you can complain to your national data protection authority (in Sweden, IMY,
imy.se). We would like the chance to fix it first.
Children
The waitlist is for people aged 16 and over. If you are younger, please ask a parent or guardian to sign up. If we learn that we hold the address of a child without a parent’s consent, we delete it.
Security
Connections are encrypted (HTTPS). The waitlist database is not reachable from the internet, only from the game server on the same machine. Addresses are never written to our log files. Access to the server is limited to the team and uses keys, not passwords.
Changes
If we change this policy in a way that matters (for example, adding analytics), we will change the date above, and if it affects the waitlist we will tell the people on it before using their data in a new way.