Privacy Policy

Last updated 24 September 2026

This policy explains what personal data GridTradingDesk collects, why, and what you can do about it. We've tried to write it to actually match what the product does, rather than as generic boilerplate — if something here seems off, tell us.

1. Who's responsible for your data

Pacedall Labs Ltd (Company No. 16619412, 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom) is the data controller for GridTradingDesk under UK GDPR.

2. What we collect

Account data

If you create an account: your email address, and your password — stored as a one-way bcrypt hash, never in plain text. Nothing else is required — we don't ask for your name, address, or date of birth.

Game data

Your in-game progress (day, cash, fleet, prices, achievements, career stats) — either saved locally in your browser if you're not signed in, or synced to our server against your account if you are, so it follows you between devices.

Feedback

If you use the feedback form, we store the message, the category you picked, and (if you're signed in, or you choose to give one) an email address, so we can follow up.

Technical & security data

To keep accounts secure we log things like failed sign-in attempts and lock accounts temporarily after repeated failures. We don't run any analytics or advertising trackers — see Cookies below for the full, short list of what's actually stored in your browser.

Billing data

If you subscribe, payment is handled entirely by Stripe — we never see or store your card number. We keep a record of your subscription status (active/cancelled, renewal date, which plan) so the game knows what you're entitled to.

3. Why we collect it

• To provide the service — running your account, saving your game, running the subscription (contract necessity).
• To keep accounts secure — brute-force lockouts, optional email one-time codes (legitimate interest / contract necessity).
• To respond to you — replying to feedback or support requests (legitimate interest, or consent where you've given us an email specifically for that).
• To meet legal obligations — for example keeping billing records as UK tax law requires.

4. Who we share it with

We use a small number of service providers to run GridTradingDesk, and only share what each one needs to do its job:

• Stripe — payment processing and billing, if you subscribe. Stripe holds your card details; we don't.
• Resend — sends our transactional emails (verification codes, password resets, welcome/receipt emails). Your email address is shared with Resend for this purpose only.
• Our hosting provider — runs the server and database that store your account and game data.

The game's "live UK grid data" features call the National Energy System Operator's Carbon Intensity API and Elexon's Insights Solution API — both public UK grid-data sources. These calls are made from our own server, not your browser, so your IP address and personal data are never sent to them.

We don't sell your data, and we don't share it with anyone for advertising or marketing purposes.

5. Cookies & local storage

We keep this deliberately short because there isn't much to say:

• One cookie — a session cookie that keeps you signed in. It's set to httpOnly (your browser's JavaScript can't read it) and secure in production, and expires automatically (14 days normally, 30 if you tick "remember me"). This is strictly necessary for the account system to work — without it, you couldn't stay signed in.
• Local storage, not cookies — your browser's local storage (not sent to any server) holds your in-progress game save if you're playing without an account, a "trusted device" flag that lets you skip repeat sign-in codes on your own device for 30 days, and this notice's dismissal so we don't show it every visit.

That's everything. No analytics, no advertising or tracking cookies, no third-party trackers, no cross-site tracking. Because everything above is strictly necessary to run the service, we don't need to ask for cookie consent — but we tell you about it anyway, and you're always free to clear your browser's cookies and storage for this site at any time (you'll just be signed out, and any unsynced local save will be lost).

6. How long we keep it

We keep your account and game data for as long as your account exists. If you delete your account, your personal data is removed; we keep a hashed, non-identifying record that an account with that email once existed and was deleted (for fraud-prevention and legal-record purposes), not your actual email or any of your game data. Billing records are kept for as long as UK tax law requires after a subscription ends.

7. Your rights

Under UK GDPR you have the right to:

• Access your data — from account settings, "Download my data" gives you an immediate JSON export of everything tied to your account.
• Delete your account and the personal data tied to it — also from account settings, at any time, no need to ask us first.
• Correct inaccurate data — mainly your email address, which you can update from account settings, or ask us to do for you.
• Object to or restrict some processing, and data portability for data you've given us.
• Complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), if you think we've got something wrong — though we'd appreciate the chance to fix it first, via the feedback form.

8. Children

GridTradingDesk isn't directed at children under 13, and we don't knowingly collect account data from anyone under that age. If you believe a child has created an account without appropriate permission, contact us and we'll remove it.

9. International transfers

Our service providers (Stripe, Resend, our hosting provider) may process data outside the UK, including in the US. Where they do, they rely on recognised safeguards such as the UK's International Data Transfer Addendum or equivalent Standard Contractual Clauses.

10. Changes to this policy

We may update this policy as the service changes or the law requires. We'll update the "last updated" date above, and for material changes we'll try to let signed-in users know.

11. Contact

Questions about this policy, or a request relating to your data — reach us via the feedback form, or by post at Pacedall Labs Ltd, 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.