Privacy Policy — Gridbench
Last updated: 17 August 2026
Gridbench is a measurement app. It exists to tell you how you performed and how that compares to other people. Everything below follows from that one purpose: we collect what a comparison needs and nothing else.
The short version
- No account, no email, no password. You are identified by an anonymous ID the app generates for you.
- No advertising, no ad SDKs, no tracking across apps or websites. There is no App Tracking Transparency prompt because there is nothing to ask about.
- No analytics SDK. We do not use Firebase, Amplitude, PostHog, Sentry or similar. We do record our own errors when the app breaks — the fault itself, never what you were doing.
- Your data is deletable from inside the app, in one step, permanently.
What we collect
On your device only
Your records, your run history, your streak and your settings live in the app's own storage. They never leave the device unless a run is submitted, and even then only the fields listed below go.
On our servers
| What | Why |
|---|---|
| An anonymous account ID | To attach your runs and streak to you rather than to a device, so they survive reinstalling |
| Each submitted run: mode, seed, the positions and timings you tapped, resulting level, score and duration | To verify the run is genuine by replaying it, and to build the leaderboard and the comparison distributions |
| The calendar date of a run (your local date) | Daily Challenge is one shared puzzle per day; the streak is a set of dates |
| A display name — only if you choose to set one | So a leaderboard row can be recognised. Optional; without it you appear as "Anonymous" |
| A push token — only if you turn notifications on | To send the reminders you asked for |
| Platform (iOS/Android) and time zone | Time zone so a 10:00 reminder means 10:00 where you are |
| The time of your last run | To stop sending reminders to someone who has stopped playing |
| If the app breaks: the error message, a truncated stack trace, the app version, platform and OS version | To find out that it broke at all. React Native failures often leave a blank screen rather than a crash, which no store report shows us |
Error reports contain the failure and nothing about you: no scores, no screens visited, no inputs. They are grouped by fault so the same break from a thousand devices is one line to fix, not a thousand records about a thousand people.
What we deliberately do not collect
- Your name, email address, phone number or contacts
- Your precise location
- Advertising identifiers (IDFA/AAID)
- Anything about other apps on your device
- Any health or medical data
What Gridbench is not
Gridbench measures performance on visual and motor tasks. It is not a medical device, not a diagnostic tool, and not a treatment. Results describe how you did on these specific tasks on this specific day. They say nothing about your health, and they are not a substitute for advice from a qualified professional.
Who else sees it
Our servers are hosted by Supabase (Postgres and edge functions), which processes this data on our behalf. Nobody else receives it. We do not sell it, rent it, or share it with advertisers or data brokers — there is no arrangement under which that could happen.
Leaderboards are public in one narrow sense: if you place on a board, other players see your rank, your score, and the display name you chose. If you set no name, they see "Anonymous".
How long we keep it
Runs and records are kept while your account exists, because the comparison distributions are built from them. Delete your account and they go with it.
Deleting everything
Settings → Account & data → Delete all data.
That removes your account and, with it, every run, record, streak entry and leaderboard position on our servers, plus everything stored on your device. It is immediate and irreversible. We keep no shadow copy.
There is a separate Reset progress. It erases your records, your streak and your leaderboard position — on this device and on our servers — but keeps your anonymous account, so you carry on as the same player starting from zero.
Reset keeps the log of individual runs, because the comparison distributions are built from it and a run stays an honest measurement of a person doing the task whether or not that person later chose to start over. If you want that gone too, use Delete all data.
Children
Gridbench is not directed at children under 13, and we do not knowingly collect data from them. There is nothing in the app that asks a child — or an adult — for personal information.
In the EU, the age at which a child can consent on their own behalf is set by each country; Spain sets it at 14. That threshold matters for the one thing here that runs on consent — push notifications. Everything else the app stores is what the app needs to work at all, so it does not rest on consent and the age rule does not apply to it.
Changes
If this policy changes materially, the app will say so before the change takes effect rather than quietly updating a date at the top.
Your rights in the EU and the UK
Gridbench is published from Spain, so the GDPR applies to it.
Who is responsible. The data controller is Roman Nikitin, trading as Nikro, at Avenida Marina Baixa 7, 03509 Finestrat, Alicante, Spain. There is no data protection officer; there is one person, and that is who answers.
Why we are allowed to hold it. Everything on our servers is there because it is needed to give you the app's core function — comparing your result to other people's. That is performance of a contract (GDPR art. 6(1)(b)). Push notifications are the one exception: those rest on the consent you give in the system prompt, and turning them off withdraws it.
What you can ask for. Access to your data, a copy of it, correction of it, its erasure, restriction of its use, and objection to it. Erasure needs no request — Settings → Account & data → Delete all data does it immediately and completely. For anything else, write to the address below; we answer within 30 days, or tell you why it will take longer.
Where it is processed. Our servers are run by Supabase, in Ireland
(eu-west-1). Your data does not leave the European Economic Area, so there is
no international transfer to safeguard and no Standard Contractual Clauses to
rely on.
If you think we got it wrong. You can complain to your national data protection authority. In Spain that is the Agencia Española de Protección de Datos (aepd.es); in the UK, the Information Commissioner's Office (ico.org.uk). You do not have to contact us first, though it will usually be faster.
Contact
Questions or requests about your data: support@nikro.app