Privacy

The data controller is Comonad Ltd. Contact: alex@comonad.co.uk.

Grid does not ask you to create an account, and we do not store a user profile.

• Vercel platform logs for the site and its APIs: request path, status, timestamp, user agent, and IP address, used to operate, debug, and secure the service.
• An in-memory rate limiter on public /api/* routes (60 requests per minute per IP). The counting window is one minute. After that window ends, or when the server instance recycles, the IP entry is dropped. Counts are not written to a database.
• Optional theme preference in localStorage on your device. That is not a cookie and is not sent to our servers.
• Cookieless Plausible analytics on the production site: page URL, referrer, browser, operating system, device type, and approximate location. See Analytics below.

Grid does not set first-party cookies. The app deletes any Set-Cookie header on cached JSON responses. Theme is stored in localStorage, not a cookie. There is no advertising, no cross-site tracker, and no non-essential analytics cookie, so Grid does not show a cookie banner.

Vercel, as the host, may process connection data as a processor under its own terms. That is infrastructure logging, not a Grid marketing cookie.

The production site measures visits with cookieless Plausible analytics. Plausible does not use cookies and does not collect personal data. It records the page URL, referrer, browser, operating system, device type, and an approximate location derived from the IP address. The IP address and the raw user agent are not stored. A salt that rotates every day turns them into a visitor count for that day only, on this site only.

Plausible is EU-hosted. Visitor data is processed and stored in the EU on European-owned infrastructure and does not leave the EU. The browser sends the measurement to this site, and Grid forwards it to Plausible without a cookie. See Plausible's data policy.

We process this information under UK GDPR legitimate interests: keeping a public dashboard available, preventing abuse of the public API, diagnosing outages, and understanding which pages are used. Logs follow Vercel's retention. Rate-limit counters last about 60 seconds. Plausible keeps aggregate analytics under its own retention, described in its data policy.

You can ask Comonad Ltd for access, rectification, erasure, restriction, or objection, and for a copy of your personal data, by emailing alex@comonad.co.uk. You can complain to the Information Commissioner's Office if you are unhappy with how we handle your information.

The site is hosted on Vercel. Request logs may be processed outside the UK under Vercel's transfer mechanisms. Plausible analytics data stays in the EU. We do not sell personal data.