Privacy Policy

Grind Observer ("Grind", "we") is operated as a sole trader by Pirzada Rauf Ahmad, based in Dubai, UAE. Pirzada Rauf Ahmad is the data controller for the personal data described below. For any privacy question, email support@grind.observer.

• Account data — email address, authentication provider (email, Google), display name, and account timestamps.
• Content you submit — the claims, quotes, and URLs you paste into Grind, and the verdicts we produce in response.
• Usage data — number of Grinds per day, which features you use, error events, and coarse device metadata (browser, OS, approximate region derived from IP). We use this to keep the service reliable and to bill correctly.
• Payment data — handled entirely by Paddle. We receive the fact of a successful purchase, the plan or pack, and a customer reference. We do not see or store your card details.

• We do not run third-party advertising trackers on the site.
• We do not sell your personal data to anyone, ever.
• We do not build advertising profiles about you.

We use your data to:

• Provide the service — process your submissions and show you verdicts and history.
• Bill and support paid plans through Paddle.
• Detect and prevent abuse, fraud, and rate-limit evasion.
• Improve accuracy and reliability by studying aggregated error and routing patterns.
• Send transactional email (sign-in confirmations, receipts, product changes) via Resend.

• Contract — to deliver the service you signed up for.
• Legitimate interest — to keep Grind safe, secure, and improving.
• Consent — where you explicitly opt in (e.g. product-update emails).
• Legal obligation — to keep records Paddle or tax authorities require.

We share the minimum data needed with these providers:

• Lovable Cloud (Supabase) — application hosting, database, and authentication.
• Paddle — payment processing as Merchant of Record.
• Resend — transactional email delivery.
• AI model providers via the Lovable AI Gateway — currently OpenAI, xAI (Grok), Anthropic, and Google (Gemini/Perplexity routes). Your submitted claim is sent to whichever model the router selects. Providers process the text under their own privacy terms and do not receive your account identity.
• Cloudflare — edge hosting and DDoS protection.

• Your verdict history stays in your account until you delete individual entries or your whole account.
• Account records are removed within 30 days of a deletion request, except where we're required to keep billing records (typically 5–7 years under UAE tax law).
• Aggregated, non-identifiable usage statistics may be retained indefinitely.

Depending on where you live, you have the right to:

• Access the personal data we hold about you.
• Correct anything inaccurate.
• Delete your account and associated data.
• Export your history.
• Object to or restrict certain processing.
• Withdraw consent for optional communications.

Email support@grind.observer from the address on your account and we'll act within 30 days.

Grind runs on globally distributed infrastructure. Your data may be processed in the EU, the US, and other regions where our sub-processors operate. Where required, we rely on standard contractual clauses and equivalent safeguards.

Data is encrypted in transit (TLS) and at rest. Access to production data is limited to what's required to run the service. No system is perfectly secure, so we can't guarantee absolute security; we do promise to notify affected users promptly if a breach materially affects them.

We use strictly necessary cookies and local storage for sign-in sessions, language preference, and installed-app state. We do not use tracking or advertising cookies. Blocking these will break sign-in.

Grind is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has created an account, email us and we'll delete it.

When we update this policy, we'll change the date at the top and, for material changes, notify you in-app or by email. The current version is always at grind.observer/privacy.