Gridhush privacy policy

Version 1.0, in effect from 15 October 2026. Earlier versions are kept on the history page.

Gridhush and your privacy, on one page

Gridhush is a calm block puzzle for the web and Android, made by TwoBrosDev. This page is the short version. The full policy below has the details, and if anything here is unclear, the full policy is what counts.

Your game stays on your device. Your scores, Daily results, streak and settings are saved on your phone or in your browser. They never come to us, and we can't see them. Deleting the app, or clearing this site's data in your browser, deletes them from your device. If your phone backs up apps to your Google account, a copy may stay in that backup (section 3).

No accounts. Gridhush has no sign-up and asks for no name, email or password.

What leaves your device, and when. Gridhush is being released in stages. This policy says what happens now and what comes with each update:

• Now, on this website: our web host sees your IP address so it can deliver the page, as every web host does (section 8). The page runs no scripts and sets no cookies.
• In the Android app, from its first test version on Google Play: nothing leaves your phone, except a result card you choose to share through your phone's share menu.
• From the web launch: gameplay analytics. The game sends a short, fixed list of gameplay events, such as "Daily finished" or "Share tapped". They are sent under a random ID made only for Gridhush, never your phone's advertising ID. Your country is recorded, but not your city. The events are stored on servers in the EU, your IP address is not stored, and they are deleted after 12 months. You can turn analytics off in Settings. The remaining details will be set out in section 5 before analytics starts.
• From the ads update (Android only): ads by Google AdMob. Google may use your phone's advertising ID and IP address to show and measure ads and to prevent fraud. In the EU, UK and Switzerland, Google asks you before any ad is requested, and Settings lets you change your answer. No ad interrupts the Daily. Ads that give you a reward are always optional. If you buy the unlock, you see no ads at all.
• From the unlock update: purchases. You can buy the remove-ads unlock through Google Play on Android or through Stripe on the web. We never see your card details.

Not for children. Gridhush is for teens and adults, 13 and over. It is not made for children under 13.

We never sell your data for money. Some US state laws count Google's personalised ads as "selling" or "sharing" data. Section 17 explains how to opt out.

Your choices:

• Turn analytics off in Settings (from the web launch).
• Where Google's consent message applies (the EU, UK, Switzerland and some US states), change your ad choices under Privacy options in Settings (from the ads update).
• Everywhere, reset or delete your phone's advertising ID.
• Delete the app, or clear the site's data in your browser.
• Email us to ask what we hold about you, or to have it deleted.

Contact: [email protected]

At a glance

1. Who we are

Gridhush is made by Mark Bischetsrieder, trading as TwoBrosDev, in the United States. In this policy, "we" and "us" mean TwoBrosDev. Under EU and UK law we are the "controller" of the information described here: we decide how it is used.

• Contact for anything about privacy: [email protected]
• We handle privacy questions by email.

2. What this policy covers

• Gridhush on the web: at gridhush.com, and the versions on itch.io and CrazyGames.
• Gridhush for Android: from Google Play (package name com.twobrosdev.gridhush), including test versions sent out through Google Play.
• The website gridhush.com.
• The private tester site test.gridhush.com, which has its own short section (Part 2).

It does not cover itch.io, CrazyGames, Google Play or the apps you share results to. Each of those has its own privacy policy.

3. What the game keeps on your device

Status: in every version of the game.

Gridhush saves these on your device so the game works:

• Settings: your Sound, Vibration and Screen effects switches, and (from the web launch) the analytics switch.
• Best scores.
• Daily results: which days you played and your results. Your streak is worked out from these.
• A Daily in progress: your moves so far, so you can pick up where you left off.
• First-time guide: how far you got through the guided first moves.
• Your analytics ID (from the web launch): the random install ID described in section 5.
• Your purchase (from the unlock update): in the Android app, whether you own the unlock, so the game knows it even offline. How the web version remembers the unlock will be set out here before the web unlock starts.

Where it lives. In the app, it's in the app's own storage on your phone. On the web, it's in your browser's storage for that site. The gridhush.com, itch.io and CrazyGames versions each keep separate records, and so does the app.

Who can see it. Only you, and anyone who uses your device. None of it is sent to us.

How to delete it. Uninstall the app, or open your phone's Settings, then Apps, Gridhush, Storage, and clear storage. In a browser, clear the site's data. We hold no copy, so we can't bring back a deleted streak.

Phone backups. If your Android phone backs up apps to your Google account, Android may include Gridhush's saved data in that backup, and may put it back if you install Gridhush again. Google holds that backup for you, and we can't see it.

Permissions. Gridhush doesn't ask for your contacts, photos, files, location, camera or microphone.

Cookies. The game sets no cookies. The tester site uses one sign-in cookie (Part 2).

4. Sharing your result

Status: in the Android app from its first test version on Google Play, and on the web from the web launch.

After a Daily you can share a short text card. On a phone it opens your phone's share menu. Otherwise the game copies the card for you to paste.

The card shows the puzzle number, your score, a small grid of symbols showing which moves cleared lines, a one-line summary and a link such as https://gridhush.com/d/42. The link names the puzzle number only. It carries nothing that identifies you.

You choose whether to share, what app to share to and who sees it. We don't learn whether you shared, where, or with whom. Once analytics is live, it can record that the share button was tapped and whether sharing finished (section 5). The app you share to handles the card under its own privacy policy.

5. Gameplay analytics

Status: not in Gridhush yet. It is planned to start with the web launch. In the Android app it starts with a later update, which this policy will name before that update ships. Until then, nothing in this section happens.

This section sets out what is already decided. The rest, listed at the end of this section, will be set out here before analytics starts.

Why. We use analytics to learn whether players come back, finish the Daily and share it, and where the game frustrates them, so we know what to fix. We look at totals, not at individual players.

What is sent. It is sent only while analytics is on:

• A random install ID. The game makes this ID on your device for Gridhush alone. It is not your advertising ID, and it is never joined to your advertising ID.
• A short, fixed list of gameplay events, each with the numbers that go with it and the time. The final list will be published here before analytics starts; nothing outside it is sent, and anything added later will appear here first. It is planned to include:
  • the game opening;
  • a Daily finished (the puzzle number and score);
  • the share button tapped, and sharing finished;
  • from the ads update: an optional ad offered and watched, and how many ads were shown.
• Your country, never your city, region or precise location.
• Basic technical details needed to read the numbers, such as the kind of device, its system or browser version, and the game's version. On the web this can include the page address on gridhush.com and the site that sent you there. The exact list will be checked against what is really sent, and set out here, before analytics starts.

What is never collected: your name, email or advertising ID; your contacts, or anything about other apps on your phone; your precise location, city or region; recordings of your screen or session; anything you type. Like any internet connection, sending an event shows your IP address to the analytics service, but your IP address is never stored.

Who handles it. PostHog stores the data for us on its EU servers in Frankfurt, Germany. PostHog handles it only on our instructions, under a data processing agreement. We never combine it with ad data.

Your switch. Settings will have an analytics switch. While it is off, the game sends no analytics. In the EU, the UK and Switzerland, nothing is sent until you agree.

How long. Events are deleted automatically 12 months after they're recorded.

Still to be set out here before analytics starts:

• how the switch is set when you first play;
• how you can have your analytics data deleted sooner, and what happens to your install ID when you turn analytics off;
• how your country is worked out;
• how the web version treats "Do Not Track" and "Global Privacy Control" signals from your browser;
• whether the versions on itch.io and CrazyGames send analytics.

6. Ads (Android)

Status: not in Gridhush yet. It is planned for the ads update. Until then, the app shows no ads and contains no ad code.

This section sets out what is already decided. The rest, listed at the end of this section, will be set out here before ads start.

Which ads.

• Optional ads for a reward: you choose to watch one for a reward, such as a Revive in Classic or a second try at the Daily. The reward is named before you choose.
• One kind of full-screen ad that you don't choose, shown only after a lost game of Classic: never in the Daily, never mid-game and never when the app opens.
• There are no banners.

Who shows them. Ads come from Google AdMob, through Google's Mobile Ads code in the app. Consent is handled by Google's consent tool, the User Messaging Platform.

What Google collects. Google's own disclosure for its Mobile Ads code lists:

• your IP address, which "may estimate general device location";
• how you interact with the ads and the app;
• diagnostic information;
• device identifiers: your advertising ID and the app set ID.

Google says this is collected for advertising, analytics and fraud prevention, and that it is encrypted in transit. Google's code also asks Android for permission to use Android's own ad features: the advertising ID, ad topics and ad measurement. Before ads start, we will check this list against the version of Google's code the game ships with.

Google uses this data under Google's Privacy Policy. Google explains how it uses information from apps that show its ads at policies.google.com/technologies/partner-sites.

Your consent in the EU, UK and Switzerland. Before any ad is requested, Google's message asks whether Google and its ad partners may store and read information on your phone and personalise ads. The message lists the companies involved. If you say no, Google may still show non-personalised or limited ads. You can change your answer at any time: in Settings, tap Privacy options.

In US states with privacy laws. Google's message for those states lets you opt out of the "sale" or "sharing" of your information for ads, through the same Privacy options row.

Ad content. We ask Google to limit the ads the game shows by content rating. Gridhush isn't made for children, so we don't ask Google to treat it as a children's app (section 16).

Your advertising ID. In your phone's settings you can reset or delete your advertising ID, which stops ads being tied to the old one. Where the setting sits differs from phone to phone; searching your phone's Settings for "ads" usually finds it.

A settings file for ad timing. From the ads update, the app also downloads a small, signed file that sets how often the full-screen ad may appear. If the file can't be reached, the game uses limits built into it. Like any download, fetching the file shows your IP address to whoever hosts it.

After you buy the unlock, no ad plays again.

On the web. The gridhush.com and itch.io versions show no ads. CrazyGames may show its own ads in and around its version, under CrazyGames' privacy policy (section 8).

Still to be set out here before ads start:

• whether ads outside the EU, the UK and Switzerland can be personalised;
• the highest ad content rating we allow;
• how the game takes account of players who may be under the age of consent where they live (section 16);
• whether Google's ad code still starts after you buy the unlock;
• where the settings file for ad timing is hosted (section 8).

7. Purchases

Status: not in Gridhush yet. It is planned for the unlock update.

This section sets out what is already decided. The rest will be set out here before the unlock starts.

There is one purchase: a one-time unlock that removes ads.

On Android: Google Play. Google Play takes the payment, under Google's terms and privacy policy. The game never sees your card or payment details. Google gives us a record of each order, without your card details; what that record holds will be listed here before the unlock starts. The game checks with Google Play when it opens to confirm you own the unlock. The Restore purchases button in Settings asks Google Play again, for example after you reinstall. Purchases are tied to your Google account, not to us.

On the web: Stripe. Stripe takes the payment, under Stripe's privacy policy. We never see your full card number. What Stripe passes on to us, and how your browser remembers the unlock, will be set out here before the web unlock starts.

No account links them. A purchase on the web can't unlock the Android app, and a purchase on Android can't unlock the web version, because Gridhush has no accounts to connect them.

8. Websites, hosting and the game sites

Status: gridhush.com is live now. The itch.io and CrazyGames versions come with the web launch.

• Cloudflare hosts gridhush.com. Like any web host, Cloudflare receives your IP address and browser details whenever your browser loads a page, so it can deliver the page and protect the site from attacks. We don't copy or keep your IP address. Cloudflare's dashboard shows us totals, such as visits by country, and the details of any request it blocks as an attack. See Cloudflare's privacy policy.
• The holding page and this privacy page at gridhush.com run no scripts and set no cookies.
• itch.io and CrazyGames host their versions of Gridhush inside their own pages, and they collect information under their own privacy policies. The CrazyGames version includes CrazyGames' own code, which CrazyGames requires and which can show CrazyGames' ads.

9. Totals we see from the services we use

Google Play, Google AdMob (from the ads update) and Cloudflare show us totals, such as installs, visits or ad views by country and phone model. Google Play also gives us crash and freeze reports from phones whose owners let Google collect diagnostics. We use these to fix problems and to judge how the game is doing. They don't tell us who you are.

10. When you contact us

If you email us, we receive your email address and whatever you write. We use them to answer you and to improve Gridhush. We keep them for 2 years after the last message between us, then delete them.

11. Why we use data (for people in the EU, UK and Switzerland)

These are the legal reasons we rely on under the GDPR, the UK GDPR and Swiss law:

• Saving your game on your device: it's needed to give you the game you asked for. We never receive this data.
• Gameplay analytics (from the web launch): your consent.
• Ads (from the ads update): the consent you give in Google's message, to store and read information on your phone and to personalise ads. Where Google's message lists purposes that rely on legitimate interests instead of consent, you can object to them in the same message.
• Purchases (from the unlock update): to give you what you paid for (a contract), and to keep records that tax law requires.
• Emails: our legitimate interest in answering you.
• The tester site: our legitimate interest in testing the game with friends who agreed to take part. You can stop at any time.

We make no automated decisions about you that have legal or similar effects. If you allow personalised ads, Google uses profiling to choose them.

12. Who receives data

• PostHog (from the web launch): stores gameplay analytics for us, on our instructions.
• Google (from the ads update): AdMob and its consent tool. Google uses ad data under its own privacy policy. Google Play distributes the app and handles Android purchases under Google's terms.
• Stripe (from the unlock update): handles web payments.
• Cloudflare (now): hosts gridhush.com and the tester site.
• itch.io and CrazyGames (from the web launch): host their versions of the game under their own policies.
• Authorities, if the law requires it.
• A successor. If Gridhush moves to a company (for example a TwoBrosDev company) or to a new owner, the data we hold would move with it, still under this policy.

Code from other companies in the game. Gridhush is built with these pieces of other companies' code:

• The Phaser game engine (every version): runs the game on your device and sends nothing.
• Capacitor, with its Share and Haptics plugins (the Android app): runs the game as an Android app, opens the share menu and makes the phone vibrate. They send nothing. Capacitor's App plugin, which opens Gridhush links in the app, comes in a later update and sends nothing either.
• PostHog's web library (from the web launch): sends the gameplay analytics in section 5.
• Google Mobile Ads SDK and Google's User Messaging Platform (from the ads update, Android only), through the AdMob plugin for Capacitor: show ads and ask for consent (section 6).
• Google Play Billing Library (from the unlock update, Android only), through Capgo's native-purchases plugin: handles the purchase with Google Play (section 7). The plugin itself sends nothing.
• CrazyGames' code (the CrazyGames version only): see section 8.

13. Where data goes (international transfers)

We're based in the United States. Information that reaches us, such as your emails, purchase records and the analytics we look at, is handled in the US.

• Analytics is stored in the EU, in Frankfurt, Germany, by PostHog, and we view it from the United States.
• Google, Cloudflare and Stripe run their services worldwide and may process data in the United States and other countries.

14. How long we keep data

• On your device: until you delete it (section 3).
• Gameplay analytics (from the web launch): 12 months, then deleted automatically. How to have it deleted sooner will be set out in section 5 before analytics starts.
• Ad data (from the ads update): kept by Google under Google's policies. Your consent choice is remembered on your phone by Google's consent tool.
• Purchase records (from the unlock update): Google Play and Stripe keep their records under their own policies. We keep our copies of order records for as long as tax law requires.
• Emails: 2 years after the last message between us (section 10).
• The tester site: deleted when testing ends (Part 2).

15. How we protect data

• Gridhush collects as little as it can. It has no accounts, so there are no passwords to leak.
• Everything the game sends travels over encrypted connections (HTTPS).
• Only Mark Bischetsrieder and one business partner can sign in to the services that hold data: Google Play Console and Cloudflare now, and PostHog, AdMob and Stripe as each comes into use.
• Keys and passwords are kept out of the game's code.
• On the tester site, codes are stored only as scrambled copies and IP addresses are never stored (Part 2).
• If data we hold is ever exposed, we will tell the people affected and the authorities as the law requires.

16. Children

• Gridhush is made for teens and adults, 13 and over. It is not directed at children under 13: no characters or wording aimed at children, and nothing in its store listing or marketing aimed at them.
• We don't knowingly collect personal information from children under 13.
• If you're a parent or guardian and think your child under 13 has used Gridhush, contact us. Deleting the app, or clearing the site's data in the browser, removes everything saved on the device. How to have analytics data deleted will be set out in section 5 before analytics starts. For ad data (from the ads update), Google's tools apply: you can reset the phone's advertising ID and see Google Family Link.
• If we learn that we hold personal information from a child under 13, we delete it.
• Teens in the EU, UK and Switzerland: some countries set the age at which you can agree to analytics or personalised ads yourself as high as 16. If you're under that age where you live, ask a parent or guardian before you say yes. How the game takes account of this will be set out here before the game first asks for your agreement.

17. Your choices and rights

17.1 For everyone, wherever you live

• Your game data: delete the app, clear its storage, or clear the site's data in your browser (section 3).
• Analytics (from the web launch): the switch in Settings (section 5).
• Ads (from the ads update): everywhere, reset or delete your phone's advertising ID (section 6). Where Google's consent message applies (the EU, UK, Switzerland and some US states), you can also change your ad choices under Privacy options in Settings.
• Ask us: email [email protected] to ask what we hold about you, to correct it or to delete it. Whether or not a privacy law applies to a business our size, we offer these to everyone.

17.2 In the EU, UK and Switzerland

You have the right to:

• access your data;
• have it corrected;
• have it deleted;
• restrict how it's used;
• object to how it's used;
• receive it in a portable form;
• withdraw consent at any time (this doesn't affect what happened before).

You can also complain to your data protection authority. In the UK that's the Information Commissioner's Office (ico.org.uk). We answer within one month.

17.3 In California and other US states with privacy laws

You have the right to:

• know what personal information we collect, use and disclose;
• have it deleted;
• have it corrected;
• opt out of its "sale" or "sharing" for targeted advertising;
• be treated the same whether or not you use these rights.

We don't collect sensitive personal information. To opt out of sale or sharing in the app, use Privacy options in Settings (from the ads update). Someone you authorise can ask for you. We answer within 45 days.

17.4 Do Not Track and Global Privacy Control

Gridhush itself doesn't track you across other websites or apps; ads in the Android app are covered in section 6. Nothing on gridhush.com tracks you today, so these signals have nothing to switch off. How the web version will treat them once analytics starts will be set out in section 5 before then.

17.5 How we find your data

Gridhush has no accounts, so the only data we can link to you is:

• gameplay analytics, once it starts (section 5 will say how we find yours);
• purchase records, found by the order number on your receipt (from the unlock update);
• emails you sent us.

We may ask for one of these to make sure we're dealing with the right person. Data on your device and data Google holds for ads are outside our reach, so use the controls above for those.

18. Changes to this policy

When we change this policy, we update the version and the date at the top and add a line to "What changed and when" below. If a change is significant, for example it adds a new kind of data or a new company, we'll also show a one-line note in the game the next time you open it. Where the law needs your consent first, we'll ask for it before the change applies to you. Earlier versions are kept on the history page.

19. Contact

• Email: [email protected]
• Who: Mark Bischetsrieder, trading as TwoBrosDev, United States

Part 2: the tester site (test.gridhush.com)

Status: live now, for friends we invite. Its data is deleted when testing ends. It is not part of the public game.

The tester site lets invited friends play test versions of Gridhush in a browser with a personal code. No email or sign-up is involved. When you sign in, the site tells you what it keeps. In full:

• A tester number, never your name or email. Only we know which number is which friend. That list stays on our own computer and is never uploaded.
• A scrambled copy of your code (a hash), not the code itself.
• Each game's numbers: the version, minutes played, score, moves, how many lines you cleared at once, best streak, Undos used, whether the game finished, the build, a random game ID, and when it was played by your phone's clock. The site also notes when each report arrived.
• Answers and messages you choose to send: the test questions, an optional comment of up to 1,000 characters, the one-tap "Enjoying this version?" check-in, and messages you write in the Feedback box in the Menu (up to 1,000 characters each, with the version you had open and when you sent them). Please don't put personal details in comments or messages.
• Sign-ins and visits: your first and last sign-in and your last visit, with counts.
• Short error notes if the game hits an error on your phone: the error, the file name and line where it happened, and your browser and system with their main version numbers only (such as "Safari 17 / iOS 17"). The notes never include your full browser details, web addresses or anything you typed.

On your phone: one sign-in cookie, which keeps you signed in for 90 days. Game reports, answers, messages and error notes wait in your browser's storage until they're sent.

IP addresses are never stored. To slow down anyone guessing codes, the site counts sign-in attempts per network under a scrambled key. Those counts are deleted after an hour.

Who handles it: Cloudflare hosts the site and its small database for us.

How long: everything is deleted when testing ends. Cloudflare's database restore feature can bring it back for up to 30 days after that, and then it is gone. To stop sooner, ask us: we'll switch off your code and delete your records.

Testing on Android through Google Play. If you join the Android test, we add the email address of your Google account to the test's list in Google Play, so that you can join through the link we send you. Google runs the test under its own terms. What you tell us by message may go into our test notes under your tester number, never your name.

What changed and when

Versions so far

Planned updates

Release dates are plans and may move. Each update brings a new version of this policy, published before the update reaches you.