PRIVACY.
PLAINLY STATED.

SCOPE

This Privacy Policy explains how GRIMWIRE Actual collects, uses, shares and protects information when you visit grimwireactual.com, create an account, join a waitlist or use a GRIMWIRE service that links to this policy.

INFORMATION YOU PROVIDE

If you create an account, GRIMWIRE may receive your email address, display name, profile image and account preferences. If you join a waitlist, GRIMWIRE stores the email address you submit. Information you voluntarily send through Discord, support requests or other community channels is also received by the service you choose to use.

GOOGLE AND YOUTUBE DATA

If you choose to connect a Google or YouTube account, GRIMWIRE requests only the permissions shown during Google's authorization process. These include basic account identity and read-only YouTube channel information. GRIMWIRE uses that information to identify the connected channel and operate authorized YouTube features for the connected user. Refresh tokens are encrypted before storage, and access tokens are used server-side for authorized requests. The data protection measures below explain these safeguards in more detail.

GRIMWIRE Actual's use and transfer of information received from Google APIs will comply with the Google API Services User Data Policy, including its Limited Use requirements. You can also revoke access in your Google Account.

HOW WE PROTECT GOOGLE USER DATA

We use the following safeguards to protect Google user data and other sensitive information, including authorization tokens, linked-account records and private YouTube Analytics reports.

Encryption in transit. Connections to this website and our server requests to Google APIs use HTTPS/TLS to encrypt information while it travels over the network. The website also sends HTTP Strict Transport Security instructions to supported browsers.

Encryption of stored authorization tokens. Google and YouTube refresh tokens are encrypted with AES-GCM before they are saved in our database. The encryption key and Google client secret are held in server-side environment configuration, separately from the token records. Google access tokens are used on the server for authorized API requests; access tokens, refresh tokens and client secrets are not included in public pages or leaderboard responses.

Account and permission checks. Server-side authentication and permission checks restrict access to connected-account records and private tools. YouTube linking is tied to the signed-in account. Private YouTube Analytics reports and the Command Center require a verified site-owner session. Other visitors receive only information intended to be public, such as public channel content or the leaderboard identity and supporter appearance a user chooses to display.

Authorization and session safeguards. Google connection flows use PKCE and expiring authorization state to help prevent intercepted or substituted sign-in responses. YouTube account linking additionally uses single-use state tied to the initiating account, browser and login session. Sensitive connection and Command Center cookies use Secure, HttpOnly and SameSite settings. Request-origin checks and rate limits help protect account changes and other sensitive actions against forged or excessive requests.

PUBLIC CHANNEL INFORMATION

GRIMWIRE may use public YouTube information, including channel details, video titles, thumbnails, publication dates and live-stream status, to show current broadcasts and recent videos. This public information can be retrieved without connecting your personal account.

OWNER CHANNEL DASHBOARD

The site owner can separately authorize the GRIMWIRE Actual channel for a private Command Center. Read-only YouTube Data access supplies channel statistics, recent video details and broadcast status. Read-only YouTube Analytics access supplies views, watch time, average view duration and subscribers gained or lost for dated reports and daily charts. The verified GRIMWIRE owner session and the authorized YouTube channel ID control dashboard access, including channels managed through Brand Accounts. These private reports are not shown to players or public visitors, and player channel linking does not request Analytics access. Refresh tokens are encrypted server-side. Dashboard snapshots refresh approximately every 15 minutes while in use; snapshots older than 24 hours are not displayed and are removed during site activity. Locking the dashboard closes its browser session while preserving authorized site integrations. The owner can revoke access in Google Account permissions and request deletion of stored integration data using the privacy form below.

HOW INFORMATION IS USED

Information is used to operate accounts, remember preferences, provide requested channel tools, maintain waitlists, deliver requested updates, secure restricted systems, troubleshoot problems and improve the website. GRIMWIRE does not sell personal information or use it to build third-party advertising profiles.

GRIMWIRE BOT DASHBOARD

Connecting Discord for the bot dashboard requests access to your server list so we can verify Manage Server or Administrator permissions. Access tokens are handled server-side through our sign-in provider and are not shown in the dashboard. We store server, channel and notification-role identifiers and names, chosen settings and announcement templates, configuration revisions, connection status, and recent announcement delivery summaries. Each request to read or change a server’s settings checks your current Discord permissions. Connection codes expire after ten minutes and can be used once; connection credentials are stored as hashes on the website. You can revoke the bot connection from the dashboard. Configuration history is retained for up to 180 days, with cleanup during bot activity. Server management stores requested changes, the requesting website and Discord identifiers, message drafts you submit, optional reasons, and execution results for up to 30 days, except moderation actions retained for the server’s chosen case-retention period, with cleanup during site activity. The bot reports server settings and channel/role inventories. Member lookups, bans, invites and audit summaries are retrieved only when a manager requests them; results are limited and visible to server managers. Current Discord permissions and role order are checked again before execution. Ordinary Discord conversations are not collected. Moderation cases from staff commands and AutoMod actions are stored on the bot host and synchronized to a private website timeline accessible to server managers. Records include actor and target Discord identifiers, rule and channel identifiers, action, reason, matched keyword when available, timestamps, outcome and optional message references. Full message content is not stored in the case timeline. Website moderation actions join the same timeline. Case retention is chosen by a server manager (7–730 days); expired records are hidden and cleaned up during activity. The bot also records server activity metadata for joins, departures, invite changes, inferred inviter links, boosts, voice channel changes, message edits and deletions, and available Discord audit actions. These records may include member, actor, inviter, channel and invite identifiers, timestamps, audit reasons and bounded change summaries, but do not include ordinary message bodies or attachments. Managers can search this activity and view inferred invite totals. Departures and invite attribution may be ambiguous. Activity shares the server’s 7–730 day retention setting and is removed through periodic housekeeping. Server managers may append private case follow-up notes and resolution states; these include their Discord ID and timestamps and share case retention. Optional join spike alerts record threshold crossings and send a private staff message. Optional onboarding assigns a selected server role to recent new members; the host temporarily saves member and role IDs for retries. Native AutoMod rule settings, keywords and exemptions are stored on Discord and synchronized to the dashboard. Enabled native rules continue operating in Discord while the host is offline; activity from an offline interval is not recovered. Discord staff log messages and backups have separate retention. Contact us through the privacy form below for questions or deletion requests.

PROVING GROUNDS

Ranked play stores your selected public callsign or confirmed connected identity, scores, accuracy, input category, measured browser render rate and achievements. Your selected name, recognition, best scores and their measured render rates appear publicly in rankings. Supporter target, ally and panel appearances are optional; when enabled, your name and uploaded profile image are public in the range. Turning the appearance off removes it from new range loads. Shot records are processed to calculate scores and are not retained; round verification records are kept for 30 days, with cleanup during site activity. Best scores, range profiles, saved training summaries and mastery badges remain while your account is active. Saved training summaries include performance metrics and settings so you can review your progress. Custom practice and guided operations are saved privately when you are signed in; they do not appear on public leaderboards. Saved operation presets contain your chosen name, ordered drills and round settings. They are private to your account and remain until you delete them or your account is removed. Deleting a preset does not delete completed training records. Guest practice and ordinary unsaved practice stay in your current session. YouTube linking is optional. When you connect, Google verifies channel ownership and we select your public channel name for the leaderboard. We store the channel ID, name, URL and an encrypted refresh token to keep that identity current. You can disconnect in your range profile or Identity Control; we revoke Google access and remove the linked YouTube data while preserving your game scores. Channel connections are checked daily during site activity, and connections that cannot be refreshed are removed after at most 29 days without successful verification. Your account email is not published in the range.

SITE MEASUREMENT

The website records limited first-party activity such as page views, referral sources and important actions including YouTube, Discord, Ko-fi and Armory clicks. This measurement is used to understand site performance. GRIMWIRE does not intentionally store IP addresses, advertising identifiers or cross-site tracking profiles in its first-party analytics.

SERVICE PROVIDERS

GRIMWIRE relies on service providers to operate parts of the site. Clerk provides account authentication. Google and YouTube provide connected-account and channel data. Fourthwall handles store checkout, payment, shipping and order support. Ko-fi handles contributions made through its platform. Discord supports community communication. Each provider processes information under its own terms and privacy policy.

DISCORD WELCOME CARDS

If you save a personal welcome card, we store your verified Discord user ID, GRIMWIRE account ID, sharing choice and card design. Sharing is off until you enable it. Participating servers may show your card with your current Discord name and avatar when you join. Server administrators control whether and where cards appear. You can turn off sharing or delete your saved card on the My Welcome Card page. Disconnecting Discord stops your personal design from being used once the linked identity check detects the change; existing messages in Discord remain until removed there. Join delivery identifiers are kept on the bot host for up to one day to prevent duplicate messages; cleanup runs while the host is active.

DISCORD LEVELS AND XP

When a server manager enables XP and the bot host supports it, the bot records member Discord IDs and names, message IDs, award amounts and timestamps to calculate levels and daily, weekly, monthly and all-time leaderboards. It does not store message text or attachments for XP. Messages earn XP at most once per minute per member; a newly detected server boost can award a one-time bonus. Server managers can view rankings and choose channels without XP. Public rankings are off by default; when a manager enables them, anyone with the link can see member names, XP and levels. XP history and lifetime totals are kept until the server requests removal; leaderboard periods reset, but lifetime totals do not. A level up card may appear in a Discord channel chosen by the server manager. Contact us through the privacy form to request correction or deletion.

FUTURE COMMUNITY TOOLS

Planned GRIMWIRE Systems features may process basic Discord user, server, channel and role identifiers, configuration settings, alert preferences, assignments, timestamps, moderation actions and audit records. Private messages will remain private. Ordinary message content will be processed only when a clearly explained feature requires it and the appropriate permissions have been granted.

DATA RETENTION

Site measurements and waitlist entries are kept for up to 180 days, and security audit records for up to one year. Request-abuse protection uses a daily salted digest of an address or account identifier, never a raw address in that table, and expires it after 24 hours. Command sessions expire after seven days and can be revoked sooner. Cleanup runs during site activity, so expired records can remain in storage while the site is idle. Public overlay reads never include chat older than 60 seconds; stored messages are removed during streaming or the next cleanup run. Account records and preferences remain while the account is active. After identity deletion is confirmed with the login provider, linked member records and the current custom avatar are removed during housekeeping. Owner identities require a manual recovery or closure process to protect the site.

YOUR CHOICES AND REQUESTS

You may browse the public website without creating an account or joining a waitlist. You can disconnect Google access from your Google Account permissions, and you may request access to, correction of or deletion of information held directly by GRIMWIRE. Removing access may disable connected features but does not affect public site access.

CHILDREN

GRIMWIRE Actual is not directed to children under 13, and GRIMWIRE does not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact GRIMWIRE so it can be reviewed and removed where appropriate.

CHANGES

This policy may be updated as GRIMWIRE services develop. Material changes will be posted on this page with a revised effective date. Continued use of the site after an update means the revised policy applies from its effective date.