Privacy

Short version: we keep the email you give us, send one launch email, keep the feedback you choose to send, and count page steps without knowing who took them. Only if you say yes do we count your return visits, under a random number. No cookies, no IP addresses on disk, and nobody else gets your data apart from Cloudflare, which carries the traffic to the site.

Who we are

Grumbly is run by OWNER-NAME-TO-FILL. For anything about your data, write to CONTACT-EMAIL-TO-FILL.

The waitlist

If you join the waitlist we store:

• your email address;
• the city you picked, if you picked one;
• the time you ticked the consent box;
• the label of the link you came from (for example "reddit"), so we know which posts worked.

We use it for one thing: a single email when the Grumbly app launches. The legal basis is your consent. We don't share, sell or hand the list to a mailing service before that email, and we delete the list once it's sent or if the project stops.

You can leave the list at any time with the form under "How do I get off the list?" on the main page: type your address and every entry with it is deleted at once. You don't need to write to anyone, and the form looks the same whether or not the address was on the list, so it can't be used to find out who signed up.

Counting visits

To see whether anyone finds Grumbly useful, the page and the app send anonymous step events: page opened, "Try it" tapped, waitlist joined, quiz started, dish shown, order button tapped, quiz ran out of dishes, and the outcome you log. Each event holds its name, the time, the link label, the website that sent you (the domain only, like "reddit.com") and, for the order button, whether it was Wolt, Bolt Food or cooking.

Quiz events also carry how the quiz went, as numbers: how many questions you answered, how many seconds it took, which dish in a row it was (the first, or one after "Not it?"), the app's language, and whether it runs installed on your home screen or inside the demo on our page. They carry a random number that exists only while that one quiz is open, so its steps can be counted as one; it is never stored on your phone and is gone when you close the page.

From your browser's user-agent header the server keeps only three coarse facts: iPhone, Android or other; whether the page was opened inside Instagram, Facebook or TikTok; and whether it looks like an automated crawler. The header itself is not kept.

If the app hits an error, it sends the error's type and message with any web address removed, at most five per visit.

Events never include your answers, the dishes you got, cookies or, unless you say yes below, any identifier. Your IP address is held in the server's memory for at most 11 minutes, for rate limiting, and is never written to disk. We keep events for up to 12 months and the server deletes older ones every day.

Statistics, if you say yes

The first time the app shows you a dish, it asks whether it may count your return visits. "Yes" and "No" are equally easy, and the app works the same either way.

If you say yes, the app keeps a random number in your browser's storage and adds it to the events above, so we can see whether people come back: how many used Grumbly this week or month, and how many return a week later. It also remembers the link label you first came from. The number is not linked to your email, your name or anything else about you. If you say no, the app remembers only that you said no, so it doesn't ask again, and nothing is counted on later visits unless you arrive from one of our links.

The legal basis is your consent. You can withdraw it at any time with the "Statistics" switch at the bottom of the app's History screen: the number is deleted from your phone at once. Events already sent stay anonymous in our files until they are deleted after 12 months, since without the number we can't tell which were yours.

Feedback

If you send feedback from the app we store the text you typed, the dish that was on screen (if you sent it from a dish), the link label, the time and the time you ticked the consent box. Feedback sent from a dish also carries that quiz, unless you untick "Attach my answers to the questions": the questions you were asked, your answers and how long each took, how many times you tapped "Not it?", the dish shown, and whether you ordered, cooked or skipped it and where. That lets us see what went wrong. Nothing else: no cookies, no identifier, and your IP address is handled as described above. We read it to make Grumbly better and keep it for up to 12 months.

The legal basis is your consent, given with the box next to the Send button; it is never ticked for you. Because feedback about food and your answers can reveal your diet, allergies or health, that box is your explicit consent to our keeping those details too (GDPR article 9(2)(a)).

Anything you put in the text, such as an email address so we can answer, is stored as you typed it. Please don't include more about yourself than you need to. You can withdraw your consent at any time: write to us and quote your message, since the feedback isn't tied to you, and we'll delete it. Withdrawing doesn't make our earlier use of it unlawful.

What stays on your phone

The app keeps your past picks in your browser's storage so Grumbly can remember what you didn't order. That never leaves your device. It also keeps your answer to the statistics question and, if you said yes, the random number described above. Clearing the site's data in your browser removes all of it.

Where it lives

Everything is stored in plain files on a server we rent in the EU (Finland). The hosting company runs the machine.

Traffic to and from grumbly.app passes through Cloudflare, which delivers the site and protects it from attacks. On the way, Cloudflare sees your IP address and what you send, such as the email you type into the waitlist form, and may handle it outside the EU. It acts for us as a data processor under its own privacy terms. Nobody else receives the data.

Your rights

To delete your email, use the form on the main page; it takes effect immediately. To see what we have or correct it, write to CONTACT-EMAIL-TO-FILL from the address you signed up with and we'll answer within 30 days. You can also complain to the Cyprus data protection commissioner (gov.cy/dataprotection).

Last updated 23 September 2026.