Privacy

1. The short version

• You can listen without an account. Nothing personal is needed for that.
• Signing in is optional and only works through Google or Discord. We never see your password.
• No ads, no ad networks, no third-party trackers, and we do not sell or rent data to anyone.

2. If you use the site without an account

Your settings, queue, playback position, favourites and playlists live in your browser (localStorage). They stay on your device.

To build charts and keep the site healthy we record anonymous events: which page or track was opened, the referring website's domain, a rough country taken from the Cloudflare header, the device type (phone, tablet or computer) and a session ID. The session ID is a one-way hash of your IP address and browser, salted with a value that changes every day, so it cannot be turned back into your IP. Raw IP addresses are not written to our database.

3. If you sign in

• From Google or Discord we receive your email address, the account ID at that provider, your name and avatar. This is handled by Supabase Auth.
• Profile: username, display name, avatar, banner, bio and whether your listening stats are public.
• Synced library: favourites, playlists and their covers, saved collections, likes, follows, listening history and personal stats, so they follow you across devices.

4. How we access Google user data

When you choose "Continue with Google", Google shows a consent screen. Only after you approve does our application access Google user data through Google OAuth / OpenID Connect (scopes: openid, email, profile). We do not scrape Google products, request Gmail, Drive, Contacts, or any sensitive/restricted scopes. Access happens only at sign-in (and when you re-link Google in Settings).

Google user data our application will access:

• Google account ID (sub) — stable identifier for your login;
• Email address — to identify the account, send security-related messages (e.g. deletion confirmations), and show linked login methods;
• Name and profile picture URL — to pre-fill your display name and avatar (you can change or remove them later).

5. How we use Google user data

Grail's use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

We use Google user data only to provide and improve Grail's sign-in and account features: (1) authenticate you, (2) create and maintain your Grail account, (3) show your name/avatar on your profile if you keep them, and (4) let you manage linked login methods in Settings.

We do not use Google user data for advertising, personalized ads, credit scoring, lending, selling to data brokers, surveillance, or training generalized AI/ML models.

6. How we store Google user data

Google account ID, email, name and avatar URL (or a copy of the avatar you keep) are stored in our Supabase Auth / Postgres project that hosts Grail accounts. Session cookies keep you signed in on your devices. We do not store your Google password.

7. How we share Google user data

We do not sell Google user data. We do not transfer or disclose Google user information to third parties except as needed to operate Grail: Supabase (authentication and database hosting under our project) and Cloudflare (CDN / TLS / attack protection, which sees request metadata such as IP). We do not transfer Google user data to other apps you have not chosen. Your Google email is never shown on your public profile.

We do not allow humans to read Google user data except: with your consent, for security/abuse investigation, to comply with law, or when data is aggregated and no longer tied to you.

8. How we retain and delete Google user data

We retain Google user data for as long as your Grail account exists, or until a scheduled deletion finishes (7 days after you request deletion), unless a longer period is required by law.

You can delete your data via Settings → Account → Delete account, or by emailing [email protected] (details at /account-deletion). Deleting your Grail account removes the Google identifiers and profile copy we stored; it does not delete your Google account. You can also disconnect Google under Settings → Account while keeping the Grail account if another login method remains.

9. How we protect Google user data

Security procedures protect the confidentiality of your data. We use HTTPS encryption in transit; the database uses row-level security; only our application server writes account-related records. Access to production systems is limited to operators who need it. No system is perfectly secure — protect your Google account as well.

10. How we access Discord user data

When you choose "Continue with Discord", Discord shows an authorization screen. Only after you approve does our application access Discord user data through Discord OAuth2 (identify and email scopes). We do not read your Discord messages, servers, friends list, or payment info. Access happens only at sign-in (and when you re-link Discord in Settings).

Discord user data our application will access:

• Discord user ID — stable identifier for your login;
• Email address (if Discord provides it for your account) — to identify the account, send security-related messages, and show linked login methods;
• Username / global display name and avatar URL — to pre-fill your display name and avatar (you can change or remove them later).

11. How we use Discord user data

We use Discord user data only to provide and improve Grail's sign-in and account features: (1) authenticate you, (2) create and maintain your Grail account, (3) show your name/avatar on your profile if you keep them, and (4) let you manage linked login methods in Settings.

We do not use Discord user data for advertising, personalized ads, credit scoring, lending, selling to data brokers, surveillance, or training generalized AI/ML models.

12. How we store Discord user data

Discord user ID, email (when provided), name and avatar URL (or a copy of the avatar you keep) are stored in our Supabase Auth / Postgres project that hosts Grail accounts. Session cookies keep you signed in on your devices. We do not store your Discord password.

13. How we share Discord user data

We do not sell Discord user data. We do not transfer or disclose Discord user information to third parties except as needed to operate Grail: Supabase (authentication and database hosting under our project) and Cloudflare (CDN / TLS / attack protection, which sees request metadata such as IP). We do not transfer Discord user data to other apps you have not chosen. Your Discord email is never shown on your public profile.

We do not allow humans to read Discord user data except: with your consent, for security/abuse investigation, to comply with law, or when data is aggregated and no longer tied to you.

14. How we retain and delete Discord user data

We retain Discord user data for as long as your Grail account exists, or until a scheduled deletion finishes (7 days after you request deletion), unless a longer period is required by law.

You can delete your data via Settings → Account → Delete account, or by emailing [email protected] (details at /account-deletion). Deleting your Grail account removes the Discord identifiers and profile copy we stored; it does not delete your Discord account. You can also disconnect Discord under Settings → Account while keeping the Grail account if another login method remains.

15. How we protect Discord user data

The same security procedures as for other account data apply: HTTPS in transit, database row-level security, application-server-only writes, limited production access. Protect your Discord account as well.

16. What other people can see

Your username, display name, avatar, banner, bio, badges and role badge, playlists you publish, and your listening stats if you switch them to public. Your Google or Discord email is never shown on your public profile. Anything public can be copied or screenshotted by others, so only put there what you are fine sharing.

17. Why we use this data (site-wide)

• To play music, synchronize your library and show your profile.
• To count plays for charts and recommendations.
• To stop abuse: rate limits look at your IP for a short time in server memory.
• To find and fix bugs.
• Google and Discord account data: solely for sign-in and account features described above.

18. Services we rely on

• Supabase: database and sign-in (stores the Google/Discord account identifiers and profile fields above under our project).
• Cloudflare: DNS, content delivery, the tunnel to our server and attack protection. Like any CDN it sees your IP address and requests.
• Google: only if you choose Google Sign-In; Google's Privacy Policy also applies to data Google holds about you.
• Discord: only if you choose Discord sign-in; Discord's Privacy Policy also applies to data Discord holds about you.
• Music files and covers are served from our own server.

19. Cookies and local storage

We use a sign-in cookie (Supabase session), localStorage for settings, library and player state, and a service worker cache for app files and covers. There are no advertising or tracking cookies. Clearing site data in your browser signs you out and resets local settings.

20. How long we keep other data

We retain personal information for the length of time needed to fulfill the purposes in this privacy policy (providing your account and the archive), unless a longer period is required by law. Anonymous statistics are kept to build charts and only ever shown as totals. Server logs are kept for a short operational period.

21. Your choices

You may request that your data be deleted by using Settings → Account → Delete account, or by emailing [email protected] (see also /account-deletion). You can edit your profile, make playlists private, hide your stats, or disconnect Google or Discord under Settings → Account (while at least one login method remains). For a copy of your data, write to [email protected]. We may ask you to confirm that the account is yours.

22. Children

Grail is not meant for children under 13. If we learn an account belongs to a child under 13, we delete it.

23. Contact

Privacy questions and data requests: [email protected]. Operator of the service: Juice WRLD Grail fan project, website https://juicegrail.com.

24. Changes

If this policy changes, we update the date at the top of the page. Using the site after that means you accept the new version.