Privacy Policy
Effective November 12, 2026
In short: we keep what your account needs (your email, username, avatar choice and the collections you build), we don't sell it, we don't track you for advertising, and you can delete it all from the app at any time. Your Card Creative designs and the logos you add to them never leave your phone.
Who we are
GrailX is an app for trading card collectors, made by GrailX LLC ("GrailX", "we", "us"). This policy covers the GrailX app and grailx.co. Questions go to support@grailx.co.
What we collect
Your account
- Your email address, which you sign in with. We email you sign-in codes and nothing else unless you ask.
- The username, preset avatar and collecting interests you choose during setup.
- When you confirmed you're 13 or older and accepted our Terms.
What you do in the app
- Collections, cards you add to them, your watchlist and wishlist.
- People you follow or block, and your notification settings.
- Your recent searches in the Library, so you can pick them up again. You can clear them in the app.
- If you're a maintainer: checklist and odds files you upload, and which sets you uploaded them for.
Technical information
- Your device's IP address when the app talks to our servers, which we use to keep the service running and to stop abuse (for example, limiting how many requests one address can make). It appears in short-term server logs and isn't stored with your account.
What we don't collect
- Card Creative designs and logos. Labels you design, and any image you add to them, are stored on your device only. They're never uploaded to us.
- Face ID or other biometrics. Face ID is checked by your device; we only learn whether it succeeded.
- Your location, contacts, photos library or advertising identifier.
- Analytics or tracking. The app and this website contain no third-party analytics, advertising or tracking code, and the website sets no cookies.
How we use it
- To sign you in and run your account.
- To show your collections and profile, and other collectors' public profiles to you.
- To suggest sets based on what you collect.
- To keep GrailX secure, prevent abuse and fix problems.
- To meet legal obligations.
What other people can see
Your username and avatar are public to other GrailX users. Collections are visible to others only when you make them public. Your email address is never shown to other users.
Who we share it with
We don't sell your information or share it for advertising. We use a few service providers who process it on our behalf, under contracts that limit what they may do with it:
- Amazon Web Services (United States): sign-in (Amazon Cognito), sending sign-in emails (Amazon SES), and the servers and database that run GrailX.
- Apple: if you buy a premium feature, Apple handles the payment under its own privacy policy. We receive confirmation of the purchase, not your payment details.
Pokémon card pictures are loaded from TCGdex, an open card database, so TCGdex's servers receive your device's IP address when those pictures load. We may disclose information if the law requires it, to protect people's safety, or as part of a sale or merger of GrailX (in which case this policy continues to apply).
How long we keep it
We keep your account information until you delete your account. When you delete it, your account, collections, follows, blocks, history and notifications are deleted right away, and your sign-in is removed. Copies in our encrypted backups are gone within 30 days. Checklist files uploaded by maintainers may be kept as the source of a set's checklist, without being linked to your account.
Your choices and rights
- Delete your account in the app: Profile, then Delete Account. Or email us from your account's address.
- See or correct your information: most of it is visible and editable in the app; for a copy of everything, email us.
- Depending on where you live (for example California, the EU or the UK), you may have further rights, such as to object to or restrict processing, or to complain to a data protection authority. Email us to use them; we'll answer within 30 days.
Children
GrailX is for people 13 and older, and everyone confirms their age when they create an account. We don't knowingly collect information from children under 13. If you believe a child under 13 has an account, email us and we'll delete it.
Security
Information is encrypted in transit and stored with access limited to the people who run GrailX. No system is perfectly secure, so we can't promise that information will never be accessed without permission, but we'll tell you if a breach affects your account.
Where it's stored
GrailX's servers are in the United States. If you use GrailX from elsewhere, your information is transferred to and processed in the United States.
Changes
If we change this policy, we'll update the date above. If a change is significant, we'll tell you in the app before it applies.
Contact
GrailX LLC · support@grailx.co