Last updated: October 26, 2026
Contents
1. WHO WE ARE
Grid Team is a mobile app published by Milan Labs, a French micro-business owned by Thomas Pensec.
- Data Controller: Thomas Pensec (Milan Labs)
- Address: France
- Contact email: [email protected]
- Website: gridteam.app
We're a team of one. No investors, no media group behind us. This policy reflects our genuine commitment to your privacy.
2. WHAT DATA WE COLLECT
2.1 Data you give us directly
| Data | When | Why |
|---|---|---|
| Sign-up | Authentication + transactional notifications | |
| Name / Nickname | Sign-up | Display in leaderboards and leagues |
| Predictions | Each GP | Core of the service — without this, the app doesn't work |
| League chat messages (text, replies, reactions) | When you write in a league chat | Show them to the league members, and check them before they are posted |
| Reports (reason, with a copy of the reported message) | When you report a message | Moderation: keeping players safe |
| Previous community chat messages | Before this feature was removed | Former community chat |
| Language preferences | Settings | Localize UI |
| Favorite sport (F1 / MotoGP) | Onboarding | Personalize content |
2.2 Data collected automatically
| Data | Source | Why |
|---|---|---|
| Ad identifier (IDFA / GAID) | Your phone OS | Native ads via AdMob (optional, opt-out) |
| Anonymized crash logs | Sentry | Debug without identifying you |
| Product events (screens opened, in-app actions) | PostHog (EU hosting) | Understand what actually gets used — no email, no name |
| Anonymous usage stats | Server logs | Understand which features work |
| IP address | Connection | Security (anti-spam) — anonymized after 30 days |
| Push token (Expo Push, Apple APNs, Google FCM) | Your phone, if you allow notifications | Send you notifications (races, scores, league chat) |
| Device type + OS | OS | Adapt performance |
2.3 The league chat, plainly
- Your messages are visible to the members of the league only, including those who join it later (they see the chat history).
- Before it is posted, the text of each message goes through an automatic filter, then through Mistral AI (artificial intelligence, French company, hosted in the EU), which checks it against the chat rules. Only the text of the message is sent — not your nickname, not your email.
- A message refused when it is sent is not posted and its text is not stored on our side: we only keep, for 24 hours, a trace of the refusal (who, in which league, and its category, for example "insult"). Our usage statistics (PostHog) also count refusals, with their category, never the text; and after several refusals in a short time, the team receives an alert with your nickname.
- If the check was unavailable when you sent it and the message is refused later, it is never posted: it stays visible to you only, marked "Hidden by moderation", until you delete it.
- When a member writes, the other members may receive a notification with the league name, the author's nickname and an excerpt of the message (for several messages: how many, and their authors' nicknames). Anyone can turn it off, league by league (the chat bell) or in their phone settings.
- A report keeps a copy of the reported message, so that we can review it even if the message has been deleted since.
2.4 What we DON'T collect
- ❌ Precise location
- ❌ Contacts
- ❌ Photos / videos
- ❌ Microphone / camera
- ❌ Browsing history outside the app
- ❌ Behavioral data for ad profiling
3. WHY WE PROCESS YOUR DATA
GDPR Article 6 legal bases:
| Purpose | Legal basis | Data |
|---|---|---|
| Provide the service (auth, picks, leagues, standings) | Contract performance (6.1.b) | Email, name, picks |
| The league chat (show your messages, notifications) | Contract performance (6.1.b) | Messages, nickname |
| Chat moderation (check before posting, reports, exclusions) | Legitimate interest (6.1.f) — player safety | Message text, reports |
| Transactional comm | Contract performance | |
| Security (anti-spam, anti-abuse) | Legitimate interest (6.1.f) | IP, logs |
| Personalized AdMob ads | Consent (6.1.a) | IDFA / GAID — you can refuse via UMP on launch |
| Contextual ads (no tracking) | Legitimate interest | No personal data |
| Marketing comm (newsletter) | Consent | Email — explicit opt-in |
5. HOW LONG WE KEEP YOUR DATA
| Data | Duration |
|---|---|
| Active account | As long as you use it |
| Inactive account | Auto-deletion after 24 months of inactivity |
| Predictions | Kept while account exists (deleted with it) |
| League chat messages | As long as the league and your account exist, even if you leave the league: delete them before leaving if you want them gone (or write to us). A message you delete, or that the league creator removes, loses its text immediately; it may remain for at most 30 days in the encrypted backups |
| Messages refused by moderation | Refused when sent: text never stored on our side, trace of the refusal deleted after 24 hours. Refused after a delayed check: hidden, visible to you only, until you delete them or your account or the league is deleted |
| Reports (with the copy of the reported message) | Until your account or the message author's account is deleted (the copy goes with its author's account) |
| Chat exclusions (reason, duration) | Until your account is deleted |
| Previous community chat messages | As long as your account exists; you can ask for their deletion at [email protected] |
| Server logs | 30 days then deleted |
| Crash logs | 90 days then deleted |
| Newsletter email opt-in | Until you unsubscribe |
6. YOUR RIGHTS (GDPR)
You have the right to:
- ✅ Access your data (JSON export in the app — Profile → Export my data, league chat included — or on request)
- ✅ Rectify inaccurate data (editable in app)
- ✅ Delete your account and all data ("Delete my account" button in your profile, or email [email protected])
- ✅ Restrict processing (temporarily suspend)
- ✅ Receive your data in portable format (JSON)
- ✅ Object to processing based on legitimate interest
- ✅ Withdraw consent for personalized ads anytime (Settings → Privacy)
- ✅ Complain to the French data authority CNIL (cnil.fr) or your local EU equivalent
To exercise these rights: [email protected] — reply within 30 days max.
7. DATA SECURITY
We implement technical and organizational measures:
- 🔒 Encryption in transit: HTTPS everywhere, TLS 1.3
- 🔒 Encryption at rest: Supabase DB encrypted
- 🔒 Authentication: Secure JWT tokens, time-limited sessions
- 🔒 Passwords: bcrypt hashed (never stored in plain text)
- 🔒 Internal access: Minimal — only the solo dev (Thomas) accesses prod DB, read-only except critical interventions
- 🔒 Backups: Daily, encrypted, 30-day retention
In case of a data breach affecting your rights, we'll notify you within 72 hours (GDPR Article 33).
8. MINORS
Grid Team is intended for users 13 years and older.
- If you're under 13, don't create an account. If we find a child account, we delete it.
- If you're a minor, sign-up requires your parents' approval (see the Terms, §5).
9. INTERNATIONAL TRANSFERS
Some providers process data outside the EU: Resend, Google AdMob, Expo, and Apple and Google for delivering notifications. Guarantees:
- The EU–US Data Privacy Framework, when the provider adheres to it
- Otherwise, the European Commission's Standard Contractual Clauses set out in its terms
10. ADMOB NATIVE ADS — HOW IT WORKS
The app is funded by native ads (cards that look like articles, frequency-capped to 1 ad max per 5 cards).
- With your consent (UMP popup on first launch) → personalized AdMob ads using your IDFA / GAID
- Without consent → contextual ads (no tracking, based only on app content)
You can change your choice anytime: Settings → Privacy → Ad personalization.
12. POLICY CHANGES
If we change this policy, we update the "Last updated" date at the top of this page; for a significant change, we also let you know in the app or by email.
13. CONTACT
For any question, request, or complaint:
- 📧 Email: [email protected]
- 📬 Response: Within 30 days (usually faster)
- 🇪🇺 Complaints: Your local EU data protection authority (or CNIL in France)
Version 1.2 — 26/10/2026 · Made with 🏁 in France