GrimFace Privacy Policy

We collect information in the following categories.

We may use information to:

• Create, authenticate, maintain, and secure accounts
• Deliver missions, trials, encounters, cards, realms, rewards, public profiles, and other Service features
• Track progress, streaks, completions, balances, and daily cycles
• Personalize the Service based on selections and activity
• Process memberships, payments, renewals, cancellations, and refunds
• Operate public profiles, Ember gifting, community features, and notifications
• Respond to support requests and communicate about the Service
• Send transactional, administrative, security, and account notices
• Send promotional communications where permitted and subject to available choices
• Analyze performance, usage, reliability, and feature effectiveness
• Detect, investigate, and prevent fraud, abuse, unauthorized access, and security incidents
• Enforce our Terms of Service and other policies
• Comply with legal obligations and protect rights, safety, and property
• Maintain records, resolve disputes, and defend legal claims
• Develop, test, and improve the Service

We do not use GrimFace identity results, missions, reflections, or activity to provide medical diagnoses or professional treatment recommendations.

You control whether your profile is public where the Service provides that control.

Before enabling a public profile or creating public-facing content, review the information carefully. Public missions and public mission completion activity should be treated like information posted in a public or shared online space.

You are responsible for avoiding the disclosure of:

• Medical diagnoses or treatment details
• Mental-health records
• Financial account information
• Passwords or security credentials
• Home addresses or precise location
• Government identification numbers
• Private information about another person
• Any information you do not have the right to publish

We may remove or restrict content that violates our policies, creates safety or privacy risks, infringes rights, or is otherwise unlawful.

We may disclose information in the following circumstances.

GrimFace does not sell personal information for money.

No behavioral advertising: GrimFace does not share personal information for cross-context behavioral advertising or use personal information for targeted advertising as those terms are defined by applicable state privacy laws.

We do not sell consumer health data.

We may use cookies, local storage, pixels, software development kits, and similar technologies to:

• Keep users signed in
• Remember preferences
• Maintain security
• Measure performance
• Understand feature usage
• Diagnose errors
• Support permitted analytics and communications

You may be able to control some technologies through browser, device, or in-product settings. Disabling essential technologies may prevent parts of the Service from working.

GrimFace is a habit, productivity, self-reflection, and personal-development service. It is not a medical provider, health-care provider, therapist, crisis service, or emergency service.

The Service is not designed to receive medical records, protected health information maintained by a HIPAA-covered entity, diagnoses, treatment plans, medication records, or other clinical information.

However, information a user enters about routines, exercise, sleep, mood, habits, substance use, diet, stress, or personal goals may be considered sensitive or “consumer health data” under certain laws, even when GrimFace does not request a diagnosis.

We limit collection and use of such information to operating the features requested by the user, maintaining security, complying with law, and other purposes disclosed in this Policy or a separate Consumer Health Data Privacy Policy.

Where required by law, we will obtain consent before collecting, using, or sharing consumer health data for additional purposes.

IMPORTANT: Because GrimFace may collect or infer health-adjacent information, Lofty Dreams LLC should publish and maintain a separate Consumer Health Data Privacy Policy if the Washington My Health My Data Act or a similar law applies. That policy should be linked prominently from the homepage and from locations where covered data is collected.

We retain information for as long as reasonably necessary to:

• Provide and maintain the Service
• Preserve account history and user-requested progress
• Complete transactions
• Comply with legal, tax, accounting, and reporting duties
• Resolve disputes
• Enforce agreements
• Prevent fraud and abuse
• Maintain security and backups

Retention periods vary by data type and purpose.

When an account or information is deleted, some information may remain temporarily in backups, archives, fraud-prevention systems, transaction records, or legally required records. Where applicable to consumer health data, deletion from archived or backup systems may take additional time as permitted by law.

We may retain de-identified or aggregated information that cannot reasonably be linked to an individual.

We use administrative, technical, and organizational safeguards intended to protect information against unauthorized access, loss, misuse, alteration, or disclosure.

No system is completely secure. You are responsible for maintaining the confidentiality of your login credentials and for promptly notifying us of suspected unauthorized access.

Depending on your location and applicable law, you may have the right to:

• Confirm whether we process your personal information
• Access personal information
• Correct inaccurate personal information
• Delete personal information
• Obtain a portable copy of certain information
• Withdraw consent
• Opt out of certain sales, sharing, targeted advertising, or profiling
• Request information about categories of data and recipients
• Appeal a decision regarding a privacy request
• Receive equal service without unlawful discrimination for exercising privacy rights

You may manage certain information directly through account settings.

To submit a privacy request, contact:

Email: grimface@grimfaceofficial.com

We may need to verify your identity before completing a request. Authorized agents may submit requests where permitted by law, subject to verification.

We will respond within the period required by applicable law. Some information may be exempt from access or deletion, including information required for security, fraud prevention, legal compliance, transaction records, or legal claims.

Where the Washington My Health My Data Act or a similar law applies, you may have rights to:

• Confirm whether we collect, share, or sell consumer health data
• Access covered consumer health data
• Obtain information about third parties or affiliates receiving it
• Withdraw consent to collection or sharing
• Request deletion
• Appeal a refusal to act on a request

Submit requests through:

Email: grimface@grimfaceofficial.com

Our separate Consumer Health Data Privacy Policy, if applicable, will provide additional details.

Residents of California and other states may have additional privacy rights if the applicable law covers GrimFace.

The categories of information we may collect are described in Section 1. The business and commercial purposes are described in Section 2. The categories of recipients are described in Section 4.

We do not discriminate against users for exercising legally protected privacy rights.

GrimFace is operated from the United States. Information may be processed and stored in the United States and other countries where our service providers operate.

Those countries may have different data-protection laws than your country. Where required, we use appropriate safeguards for international transfers.

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13.

If you are under the age of majority where you live, you may use the Service only with the permission and supervision required by applicable law and our Terms of Service.

If we learn that we collected personal information from a child in violation of applicable law, we will take reasonable steps to delete it.

Parents or guardians may contact grimface@grimfaceofficial.com with concerns.

The Service may link to or integrate with third-party services. Their privacy practices are governed by their own policies. We are not responsible for third-party services that we do not control.

GrimFace may use rules, scoring, selections, or automated processes to assign or recommend factions, archetypes, missions, encounters, realms, cards, or other content.

These features are intended for entertainment, organization, motivation, and personalization. They are not medical, psychological, employment, credit, insurance, housing, or legal determinations.

We may send transactional messages concerning account activity, security, payments, subscriptions, feature changes, or Service administration.

Where permitted, we may also send promotional communications. You may unsubscribe from promotional emails using the link provided, but you may continue receiving essential transactional or legal notices.

You may request account deletion through our in app cancellation function or by contacting grimface@grimfaceofficial.com.

Account deletion may remove or deactivate your profile and associated data, subject to legal, security, transaction, backup, and fraud-prevention retention.

Public information previously copied, captured, or redistributed by others may remain outside our control.

We may update this Privacy Policy to reflect changes in the Service, law, technology, or data practices.

We will post the updated Policy and revise the “Last Updated” date. Where required, we will provide additional notice or obtain consent before materially changing how we collect, use, or disclose information.

For privacy questions, requests, or complaints:

Lofty Dreams LLC
Doing business as GrimFace
Email: grimface@grimfaceofficial.com

For support: grimface@grimfaceofficial.com