Privacy Policy

Effective October 29, 2026

This policy explains what personal information grailworth collects, how it's used and shared, and the choices you have. grailworth (the website at grailworth.com) is run by an individual based in Illinois, USA ("we", "us"), who is responsible for your information. Questions: [email protected].

The short version: we collect what we need to sign you in, keep your collection and run your membership. We don't sell your information, show ads, or track you across other companies' apps and websites.

1. What we collect

Your account

You sign in with Google. From Google we receive an account ID, your email address and your name. We store your account ID, email, name, when you first and last signed in, and internal identifiers that link your account to your purchases. We never see your Google password.

Your collection

If you add comics to your collection, we store what you enter: the issues, their grade and grading company, edition, your answers to the condition check, the price you paid and where you bought it, and any value you set yourself.

Defect photos

While grading a copy, you can take or pick photos of its defects. They're used only for that copy's grade report, which only you can open (and share if you choose). We remove the photos' metadata, such as where they were taken, before storing them. They're deleted when you remove the photo, the copy or your account.

Your membership

We keep a record of your grailworth Pro membership: the plan, its status, trial and renewal dates, and the transaction and subscription records Dodo Payments sends us about it (such as subscription IDs, prices and dates). We never receive or store your card or bank details. Dodo Payments collects those directly.

Technical information

• Security checks. To keep automated abuse out, the website uses Google's reCAPTCHA Enterprise through Firebase App Check. It checks that requests come from a real browser, and may process device and browser information (such as your IP address) to do so.
• Server records. Our servers keep short-lived technical logs for running and securing the service, for example when a membership changes or a sign-in is rejected. These may include your account ID.

What we don't collect

We only see the defect photos you choose to take or pick. We don't use your contacts or location, we don't use advertising identifiers, and we don't run analytics.

2. How we use it

• To sign you in and keep your collection.
• To value your collection and provide grailworth Pro.
• To sell, run and support your membership, including answering questions and handling refunds.
• To keep the service secure, prevent abuse and fraud, and fix problems.
• To meet legal, tax and accounting obligations.

If you're in the European Economic Area or the UK, the legal bases we rely on are: performing our contract with you (your account, collection and membership); our legitimate interests in keeping the service secure and improving it (security checks, logs); and our legal obligations (tax and accounting records).

3. Who we share it with

We don't sell or rent your personal information, and we don't share it for advertising. We share it only with the service providers that run grailworth for us, under their own privacy commitments:

• Google (Firebase): sign-in (Firebase Authentication) and security checks (App Check, reCAPTCHA Enterprise). If you sign in with Google, Google's own privacy policy also applies. Google privacy policy.
• Dodo Payments: our reseller and Merchant of Record. When you buy a membership we send Dodo Payments your email address, your name and an internal account reference, and Dodo Payments collects your payment and billing details directly. Dodo Payments privacy policy.
• Our hosting provider: hosts our servers and database in the United States.

We may also disclose information if the law requires it, to protect the rights, safety or property of our users or others, or as part of a transfer of grailworth to a new owner (who would remain bound by this policy).

4. Where it's kept

grailworth is run from the United States, and your information is stored and processed there and wherever our service providers operate. If you're outside the US, your information is transferred to the US, where privacy laws may differ from yours. Our service providers use recognized safeguards, such as standard contractual clauses, for such transfers.

5. How long we keep it

• Account and collection: while your account exists. When you delete your account, it's removed from our live systems at once (within 30 days if you ask us by email); it may remain in our backups for up to 7 more days until they're replaced.
• Membership and transaction records: as long as tax and accounting laws require (typically up to 7 years). Dodo Payments keeps its own records under its policies.
• Server logs: short-term, for operating and securing the service.

6. Cookies and similar technology

The website uses only what it needs to work. No advertising or analytics cookies.

• gw_id and gw_ac: set when you're signed in, so pages like your collection know it's you; each lasts up to an hour and is renewed while you use the site.
• Sign-in storage: Firebase keeps your sign-in in your browser's storage so you stay signed in.
• Preferences: your browser remembers small settings, such as the shipping cost you enter in the grading break-even and your membership status for a few minutes.
• reCAPTCHA, when it runs, and Dodo Payments, on the checkout, may set their own cookies under their policies.

7. Your choices and rights

• See, correct or export your data: your collection is visible and editable on the website. Ask us at [email protected] for a copy of everything we hold about you.
• Delete your account: at grailworth.com/account/delete. This deletes your account, collection and profile, and cancels your membership. You can also email [email protected] and we'll do it for you. We keep the transaction records described above.
• Sign out at any time.

Depending on where you live, you may have other rights, such as to object to or restrict some processing, to data portability, or to withdraw consent. EEA and UK residents can also complain to their data protection authority. California and other US state residents have the right to know, access, correct and delete personal information, and to opt out of its sale or sharing for targeted advertising. We don't sell or share personal information that way, and we won't treat you differently for using your rights. We answer requests within 30 days (or as the law requires) and may need to confirm your identity first.

8. Children

grailworth isn't directed to children under 13, and we don't knowingly collect personal information from them. If you believe a child under 13 has given us information, contact us and we'll delete it.

9. Security

We protect your information with encryption in transit (HTTPS), verified sign-in tokens on every request, device and browser checks, and restricted access to our servers and database. No system is perfectly secure, but we work to keep your information safe and will notify you as the law requires if a breach affects you.

10. Changes to this policy

We'll update this policy when what we do changes. We'll change the date at the top, and tell you on the site or by email before significant changes take effect.

11. Contact

grailworth, Illinois, USA · [email protected]