Privacy

1. The short version

• You can listen without an account. Nothing personal is needed for that.
• Signing in is optional and only works through Google or Discord. We never see your password.
• No ads, no ad networks, no third-party trackers, and we do not sell or rent data to anyone.

2. If you use the site without an account

Your settings, queue, playback position, favourites and playlists live in your browser (localStorage). They stay on your device.

To build charts and keep the site healthy we record anonymous events: which page or track was opened, the referring website's domain, a rough country taken from the Cloudflare header, the device type (phone, tablet or computer) and a session ID. The session ID is a one-way hash of your IP address and browser, salted with a value that changes every day, so it cannot be turned back into your IP. Raw IP addresses are not written to our database.

3. If you sign in

• From Google or Discord we receive your email address, the account ID at that provider, your name and avatar. This is handled by Supabase Auth.
• Profile: username, display name, avatar, banner, bio and whether your listening stats are public.
• Synced library: favourites, playlists and their covers, saved collections, likes, follows, listening history and personal stats, so they follow you across devices.

4. Google Sign-In — what we get and how we use it

When you choose "Continue with Google", Google asks you to approve access. We request only basic profile information needed to create and secure your Grail account:

• Google account ID (stable identifier for your login);
• Email address (to identify the account, send security-related messages such as deletion confirmations, and show which login methods are linked);
• Name and profile picture (to pre-fill your display name and avatar; you can change or remove them later).

5. Google user data — purpose, sharing and Limited Use

Grail's use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

We use Google user data only to: (1) authenticate you, (2) create and maintain your Grail account, (3) show your name/avatar on your profile if you keep them, and (4) let you manage linked login methods in Settings. We do not use Google user data for advertising, credit scoring, or lending decisions.

We do not sell Google user data. We do not share it with third parties for their own marketing. The only processors that handle it on our behalf are Supabase (authentication and database hosting) and, for delivery of the site itself, Cloudflare as a CDN/security layer. We do not transfer Google user data to other apps you have not chosen.

We do not allow humans to read Google user data except: with your consent, for security/abuse investigation, to comply with law, or when data is aggregated and no longer tied to you.

6. What other people can see

Your username, display name, avatar, banner, bio, badges and role badge, playlists you publish, and your listening stats if you switch them to public. Your Google email is never shown on your public profile. Anything public can be copied or screenshotted by others, so only put there what you are fine sharing.

7. Why we use this data

• To play music, sync your library and show your profile.
• To count plays for charts and recommendations.
• To stop abuse: rate limits look at your IP for a short time in server memory.
• To find and fix bugs.
• Google account data: solely for sign-in and account features described above.

8. Services we rely on

• Supabase: database and sign-in (stores the Google/Discord account identifiers and profile fields above under our project).
• Cloudflare: DNS, content delivery, the tunnel to our server and attack protection. Like any CDN it sees your IP address and requests.
• Google: only if you choose Google Sign-In; Google's Privacy Policy also applies to data Google holds about you.
• Discord: only if you choose Discord sign-in; Discord's privacy policy applies to data Discord holds.
• Music files and covers are served from our own server.

9. Cookies and local storage

We use a sign-in cookie (Supabase session), localStorage for settings, library and player state, and a service worker cache for app files and covers. There are no advertising or tracking cookies. Clearing site data in your browser signs you out and resets local settings.

10. How long we keep it

Account data stays until you delete the account (or until a scheduled deletion finishes after 7 days). Anonymous statistics are kept to build charts and only ever shown as totals. Server logs are kept for a short operational period.

11. Your choices

You can edit your profile and settings yourself, make playlists private, hide your stats, disconnect Google or Discord under Settings → Account, or delete the account (see /legal/deletion or request deletion by email). Deleting your Grail account removes the Google identifiers and profile copy we stored; it does not delete your Google account. For a copy of your data or other requests, write to legal@juicewrldgrail.com. We may ask you to confirm that the account is yours.

12. Children

Grail is not meant for children under 13. If we learn an account belongs to a child under 13, we delete it.

13. Security

Traffic is encrypted (HTTPS), the database uses row-level security and only our server can write statistics. No system is perfectly secure, so keep your Google or Discord account protected.

14. Contact

Privacy questions and data requests: legal@juicewrldgrail.com. Operator of the service: Juice WRLD Grail fan project, website https://juicewrldgrail.com.

15. Changes

If this policy changes, we update the date at the top of the page. Using the site after that means you accept the new version.