Team Grit Privacy Policy

This Team Grit Privacy Policy (the “Policy”) is designed to help you better understand the information that Team Grit LLC (“Team Grit,” “we,” “us,” or “our”) collects and the different ways we may use or share it. Our relationship with our players, customers, and partners is built on trust and transparency, so we have tried to use plain, easy-to-understand language. If you have questions about this Policy or our information practices, contact us at privacy@grit.gg.

This Policy applies to your use of any of our websites, games, apps, or other products or services that link to this Policy (the “Services”). “Services” has the meaning given in the GRIT End User License Agreement. Additional terms may also apply depending on how you interact with us — please read the other Player Agreements as well.

Controller. Team Grit LLC, 1100 Bellevue Way NE, Ste 8A-557, Bellevue, WA 98004, U.S.A. is the controller of the personal information described in this Policy.

1. Information We Collect

When you use the Services we generally collect information in three ways: (A) you give it to us; (B) we collect it automatically; and (C) other parties give it to us.

(A) Information you give us

There is no Team Grit account, and we do not take payments. GRIT® is bought and played through Steam. Valve is the merchant of record, so we never see your payment card details, your billing address, or your Steam password. What we hold when you play is described in Section 1(B).

You may still choose to give us information directly. Common examples:

• contacting us for any reason, including technical support, a privacy request, or a Code of Conduct appeal;

• entering a competition, tournament, or special event that we run;

• completing a survey;

• reporting a security vulnerability under the Security Disclosure Policy.

In each case we collect what you choose to send us — usually an email address and the contents of your message.

(B) Information we collect automatically

We collect some information automatically when you visit or use the Services, through server logs and usage data transmitted from the Services to our servers. We use it to operate, secure, and improve the Services, address technical issues, prevent fraud and misuse, and understand how the Game is played. It generally includes:

• Technical information about your computer, device, hardware, or software, such as IP address and device identifiers, device make and model, operating system, browser, and system specifications;

• Usage information about your interaction with the Services, such as pages visited, referring and exit pages, page views, time on page, clicks, platform type, which game you played, for how long, and when;

• Crash reports, generated automatically when a game or application crashes, including information about your system and the crash;

• Experience and safety information, such as your display name, saved preferences, game progress, and device identifiers used for authentication and fraud prevention; and

• Approximate location, derived from your device's IP address.

Anti-cheat

GRIT® is a competitive game, and protecting it from cheating is essential to it being worth playing. The Game uses Easy Anti-Cheat, developed by Epic Games, to detect cheats and unauthorized programs and devices.

Easy Anti-Cheat includes a kernel-level component. That means part of it runs with a high level of access to your computer — the same level of access as your operating system itself. We are telling you this plainly because it is the kind of thing you should know before you install a game, not something to find out afterward.

It runs only while GRIT® is running. It starts with the Game and stops when you close the Game. It is not active when you are not playing.

What it looks at. While the Game is running, the Anti-Cheat Technology examines the Game's own files and memory, and the processes and drivers running on your computer, in order to detect programs, modifications, and hardware configurations that give players an unfair advantage in GRIT®. It is looking for cheats. It is not there to read your personal files, your messages, or your browsing.

What leaves your computer is limited to: identifiers for detected unauthorized programs, hardware and device identifiers used to enforce restrictions, and diagnostic information about the detection. We keep anti-cheat detection data for as long as necessary to keep GRIT® fair, and no longer. Where it relates to a restriction or ban that is still in force, we keep it for as long as that action lasts, so we can enforce it, handle an appeal, and defend the decision if it is challenged. Everything else is deleted within twenty-four (24) months. We use this data only to detect and prevent cheating and to enforce the GRIT Code of Conduct.

Epic Games processes this information on our behalf as the provider of Easy Anti-Cheat. It is listed as a recipient in Section 2(B). Epic's own handling of Easy Anti-Cheat data is described in Epic's agreements governing Easy Anti-Cheat.

Voice chat

GRIT® has voice chat so you can play with your squad. We do not record it, store it, or listen to it, and there is no recording for us to review afterwards. GRIT® has no text chat.

(C) Information we receive from others

Other parties may provide information about you, or allow us to collect it, in four situations: (1) you interact with Team Grit through a service we do not control, such as a social network; (2) you use a social feature of the Services; (3) you access the Services through another party, such as a gaming platform, console, or mobile device operator; or (4) you link a third-party account to your player account. We cannot always control what those parties make available to us; we use only what we need. Once we receive it, we treat it in accordance with this Policy.

GRIT Ledger (ledger.grit.gg)

GRIT Ledger is our match-statistics service, and it requires a Steam sign-in. It is part of the Services, and it is the subject of a separate, more detailed GRIT Ledger Privacy Notice, which supplements this Policy. Two flows of information run between the Game and GRIT Ledger, and both are described here so that this Policy remains a complete picture:

• Match data goes out to GRIT Ledger. When you play a match, the game server records it and sends it to GRIT Ledger. This happens whether or not you have ever visited that site. What is recorded includes your Steam ID and persona name, match details, gameplay events, and position samples — your in-game location sampled roughly once per second for the length of the match. Position samples are game-world coordinates only. They are not real-world location, and we do not collect real-world location of any kind.

• Cosmetic information comes back from the Game. To draw your in-game nameplate on the site, GRIT Ledger asks the Game's own services which banner, badge and title you have equipped. These are cosmetic item identifiers already visible to anyone who sees you in a match.

GRIT Ledger requires you to sign in with Steam. Once signed in, a player can see match records, player profiles and leaderboards — including yours. The site is not open to the public and is not indexed by search engines. If you are in the EEA or the UK, you have the right to object to this processing — see Section 7 and the GRIT Ledger Privacy Notice.

Steam and Valve

GRIT® is distributed through Steam, operated by Valve Corporation. Valve is a separate company and an independent controller of the information it collects about you. When you buy GRIT® on Steam, your payment is processed by Valve, not by Team Grit, and we do not receive your full payment card details. What we receive from Valve is limited to information necessary to deliver and operate the Game, such as your Steam account identifier, entitlement and ownership status, and, where you enable them, friends and presence data. Valve's own collection and use of your information is governed by the Valve Privacy Policy, not by this Policy.

2. How We Use and Share Information

(A) How we use it

We use the information we collect to provide, improve, customize, analyze, secure, and market the Services where we have an appropriate legal basis to do so:

• To perform our contract with you — operating your account, delivering the Game and its online features, matchmaking, processing purchases, and providing support.

• For our legitimate interests — securing the Services; detecting and preventing cheating, fraud, and abuse; understanding how the Game is played so we can improve it; communicating with you and responding to your requests; personalizing your experience; managing advertisements and promotional offers; and internal purposes such as auditing and analysis. In each case we balance these interests against your rights.

• To comply with legal obligations — including tax and accounting requirements, responding to lawful requests, and reporting obligations relating to child safety.

• For public interest purposes — health, safety, and cooperation with official investigations or legal proceedings such as subpoenas, warrants, and court orders, and to protect our rights and property and those of our players and others.

Corporate transactions. If all or some of our assets are sold, assigned, transferred to, or acquired by another company through merger, divestiture, restructuring, reorganization, dissolution, financing, acquisition, bankruptcy, or otherwise, your personal information may be among the transferred assets.

(B) How we share it

• Service providers. We share personal information with providers engaged to perform services on our behalf and under our instructions — for example cloud hosting and storage, anti-cheat, and security monitoring. They are not authorized to use or disclose personal information except as necessary to perform those services or comply with law.

• Epic Games, for anti-cheat. The Game uses Easy Anti-Cheat, provided by Epic Games, Inc. Anti-cheat detection information described in Section 1(B) is processed by Epic on our behalf and under our instructions. Epic is a processor for this purpose, not an independent recipient, and it is not permitted to use the information for its own purposes.

• Affiliates. We may share personal information with our subsidiaries or affiliates to support the Services worldwide.

• No advertising or marketing partners. We do not disclose device identifiers, advertising identifiers, or any other personal information to advertising networks, data brokers, or marketing partners. See Section 8.

• Other players. Social and multiplayer features share information such as your display name, account ID, and match activity with other players.

• Other signed-in players, on GRIT Ledger. Match records, player profiles and leaderboards on ledger.grit.gg are visible to anyone who signs in to that site with a Steam account. The site is not open to the public and is not indexed by search engines. The audience is still large and undefined — any Steam account holder can sign in — so treat this as disclosure to a broad group rather than to a defined recipient. See the GRIT Ledger Privacy Notice.

• Legal and safety. We may disclose information where required by law, legal process, or a lawful request from law enforcement or other government officials; where disclosure is necessary or appropriate to prevent physical harm or financial loss or in connection with an investigation of suspected or actual illegal activity; or where necessary to protect someone's vital interests.

3. International Transfers of Your Information

Team Grit is based in Washington State in the United States, and we process personal information in the United States and in other countries where we or our service providers operate. This means your personal information may be transferred outside the country where you live.

Our application, our databases and both of our websites are in the United States. The game servers you connect to run in five regions — Los Angeles, São Paulo, Frankfurt, Tokyo and Sydney — including in the European Economic Area, so that players connect to a server near them. Match data is created on the server you played on and is then brought back to our systems in the United States. We have no staff outside the United States.

One standard, everywhere. GRIT® is sold worldwide, and privacy law differs from country to country. Rather than apply a different standard to different players, we apply the same standard to everyone: the one set by the European Union's General Data Protection Regulation, which is among the strictest in the world. Wherever you live, you get the protections described in this policy — how we limit what we collect, how long we keep it, how we secure it, what we tell you, and how you can object. Where the law where you live gives you a right this policy does not mention, that right still applies and we will honor it — write to privacy@grit.gg.

Where we disclose personal information to a service provider — our hosting provider, our crash-reporting provider, or Epic Games for anti-cheat — we do so under written terms that require them to protect it and to process it only on our instructions, and we rely on the Standard Contractual Clauses approved by the European Commission (with the UK International Data Transfer Addendum for the United Kingdom) where those are required. You can request a copy by writing to privacy@grit.gg.

4. How Long We Keep Your Information

We keep personal information only as long as we need it for the purposes described in this Policy, and then delete or anonymize it. In general:

We may keep information for longer where we are required to by law, or where it is needed to establish, exercise, or defend legal claims.

5. Your Rights and Choices

We aim to give you meaningful choices. We generally ask only for the personal information necessary to provide the Services you request. You can decline, but some features may not work.

Where we rely on your consent, you are not required to give it and you may withdraw it at any time. Withdrawal is effective going forward and does not affect processing we carried out while relying on your consent.

Your general choices:

• You can browse our website without providing personal information, though we collect some limited information automatically as described above.

• Signing in to GRIT Ledger with Steam does not create an account with us. We hold no password, no registration details and no sign-up record — signing in just proves the Steam account is yours, so we can show you your own record and take an appeal or a request from you. There is nothing on our side for you to close.

• We do not send marketing messages, so there is nothing to unsubscribe from.

• You can manage the one session cookie we set, and block cookies generally, through your browser settings — see Section 6.

What we actually hold about you

It is a short list, and knowing it up front will usually answer your question faster than a request would:

• Your match data, tied to your Steam ID — the matches you played, what happened in them, and the statistics derived from them. Most of this is already published on your player page at ledger.grit.gg, so you can see it without asking us for anything.

• Anti-cheat detection data, if our Anti-Cheat Technology recorded a detection for your account (Section 1(B)).

• Any correspondence you have sent us — a support message, an appeal, a privacy request — and the contact details you used to send it.

• Technical and log information described in Section 1(B), such as IP address and device information.

There is nothing else. No account, no password, no email address unless you gave us one, no payment details, no age or date of birth, no real-world location, and no voice recordings.

Making a request

To make a request — for access to your personal information, a copy in portable format, correction, deletion, restriction, or to object to our processing — email privacy@grit.gg with “Data Subject Request” in the subject line. We will respond within one month, and will tell you if we need to extend that period as applicable law allows. If you are in the EEA or the UK you can also use our Trust Center at https://app.prighter.com/portal/13907821695, which reaches us through our European representatives (Section 7).

Verifying who you are. Almost everything we hold is keyed to a Steam ID, so before we act we need to be satisfied that the Steam account is yours.

• The simplest way is to sign in to GRIT Ledger with Steam and submit your request there — the same place you would submit an appeal. Signing in proves control of the account, and it tells us nothing about you that we did not already have.

• If you cannot sign in, email us and we will give you a short code to add to your Steam display name for a few minutes. Your persona name is publicly visible, so we can check it and confirm the account is yours; change it back as soon as we confirm.

We will not ask you for identity documents, and we will not ask for more personal information than we already hold. If we cannot reasonably tie a request to a Steam account, we may not be able to act on it, and we will tell you so.

Limits on these rights

Your rights are subject to the limitations and exceptions in applicable law. Three come up often enough here to state plainly:

• Match records are a factual record of what happened. We will correct information that is genuinely wrong, but a match result is not inaccurate because you would prefer a different one.

• We may keep enforcement records. Where an account has been restricted or banned, we keep what we need to enforce that decision, to handle an appeal, and to defend the decision if it is challenged. A request to delete your data does not remove a ban and will not erase the record of it.

• Some data supports the integrity of the Game for everyone. Where we decline a request, we will tell you why.

6. Cookies and Local Storage

We do not use tracking cookies. We run no analytics services, no advertising services, and no third-party tracking pixels, beacons, or trackers on our websites or in the Game.

What we do store on your device. The only thing our websites store is what is strictly necessary to provide a feature you have asked for:

If you never sign in to ledger.grit.gg, that site stores nothing on your device at all.

No consent banner, and why. Cookies that are strictly necessary to provide a service you have requested do not require consent under the ePrivacy Directive or its national implementations. Because we set nothing else, we do not ask you to make a cookie choice and we do not show a consent banner. If we ever introduce analytics or advertising technologies, we will ask for your consent before setting them, and we will update this Policy first in accordance with Section 11.

Browser controls. You can block or delete cookies through your browser settings. Doing so will sign you out of ledger.grit.gg but will not otherwise affect your use of the Services.

Service-specific notices. Each of our websites also has its own short notice: the GRIT Website Privacy Notice for grit.gg, and the GRIT Ledger Privacy Notice for ledger.grit.gg. Both supplement this Policy and neither replaces it.

7. If You Are in the European Economic Area, the United Kingdom, or Switzerland

Controller. Team Grit LLC, 1100 Bellevue Way NE, Ste 8A-557, Bellevue, WA 98004, U.S.A. is the controller of the personal information described in this Policy. You can reach us at privacy@grit.gg.

Our representatives. Team Grit LLC is established in the United States. Under Article 27 of the GDPR we have appointed Prighter EU Rep GmbH, Schellinggasse 3, 1010 Vienna, Austria, as our representative in the European Union, and Prighter Ltd (UK), 20 Mortlake High Street, London SW14 8JN, United Kingdom, as our representative in the United Kingdom. Both are part of the Prighter Group, which acts as our privacy representative and your point of contact for the European Union and the United Kingdom. You may contact either of them, and a supervisory authority may, on any matter relating to our processing of your personal information.

The quickest route is our Trust Center, at https://app.prighter.com/portal/13907821695, which reaches our representatives and us together. Emailing privacy@grit.gg reaches us directly and is usually faster still.

Data Protection Officer. Team Grit has assessed its processing against Article 37 of the GDPR and has concluded that it is not required to appoint a Data Protection Officer under the GDPR. We have designated one anyway, because other laws require it. Under section 11(3) of Singapore's Personal Data Protection Act every organization must designate a data protection officer and make their contact details available. Ours is reachable at privacy@grit.gg, which is monitored by a named person. Privacy questions from anywhere in the world should go to that address.

Legal bases. We process personal information on the following bases: to perform our contract with you (operating your account, delivering the Game and its online features, processing purchases, providing support); on the basis of our legitimate interests (securing the Services, publishing match history, player profiles and leaderboards on GRIT Ledger and calculating the statistics and rankings derived from them, detecting and preventing cheating and fraud, understanding how the Game is played so we can improve it — balanced in each case against your rights); and to comply with legal obligations. We do not currently rely on consent for anything. If we introduce a feature that needs it, we will ask you first and you will be free to say no.

Objecting to publication on GRIT Ledger. You have the right to object at any time, on grounds relating to your particular situation, to our publication of your match data on GRIT Ledger. If you object, we will stop unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms. How to exercise this is set out in the GRIT Ledger Privacy Notice.

DPO assessment. Our Article 37 assessment has been reviewed in light of GRIT Ledger and the conclusion is unchanged: no Data Protection Officer is required. The assessment is recorded in our Data Protection Impact Assessment.

Your rights. You have the right to request access to your personal information; to have inaccurate information corrected; to have your information erased; to restrict or object to our processing, including processing based on legitimate interests and processing for direct marketing; and to receive your information in a portable format. You also have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. Where an account restriction results from automated detection, you may request human review under the appeals process in the GRIT Code of Conduct.

How to exercise them. Email privacy@grit.gg with “Data Subject Request” in the subject line. We will respond within one month, and will tell you if we need to extend that period. We may need to verify your identity first.

Complaints. If you are unhappy with how we have handled your personal information, you have the right to lodge a complaint with your local data protection supervisory authority. In the United Kingdom this is the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to address your concern first — please contact us at privacy@grit.gg.

8. U.S. State Privacy Rights

We do not sell or share your personal information. We do not sell it for money or for anything else of value, we do not share it for cross-context behavioral advertising, and we do not disclose it for targeted advertising. We have no advertising partners, run no advertising or analytics technologies, and disclose no device or advertising identifiers to anyone for marketing purposes. There is therefore no “Do Not Sell or Share My Personal Information” link and nothing for you to opt out of.

We do not collect or use sensitive personal information as that term is defined in U.S. state privacy laws.

We will not treat you differently for exercising a privacy right. We will not deny you service, charge you a different price, or give you a lower quality of service because you made a request.

If you live in a U.S. state with a comprehensive consumer privacy law, you may have rights over your personal information under that law. Write to privacy@grit.gg with “Privacy Request” in the subject line and we will honor the rights that apply to you. Identity verification works the same way as described in Section 5. You may use an authorized agent, and we may require proof of their authority. If we decline a request you may appeal by replying to our response, and we will answer the appeal within forty-five (45) days.

9. How We Protect Your Information

We maintain appropriate administrative, technical, and physical safeguards to protect your personal information from accidental, unlawful, or unauthorized destruction, loss, alteration, access, disclosure, or use.

Transmission of information over the internet is not completely secure. Although we have designed the Services with the protection of your information in mind, we cannot guarantee the security of information transmitted through them, and any transmission is at your own risk.

If we determine that a security incident has compromised the security, confidentiality, or integrity of your personal information, we will notify you and the relevant regulators as and when required by applicable law, and within the timeframes the law requires. We will describe what happened, what information was involved, what we are doing about it, and what steps you can take.

10. Children and Younger Players

GRIT® is sold and played through Steam. Team Grit does not create or manage player accounts, does not operate an age gate, and holds no date of birth or age information about any player from any source. Age requirements for Steam accounts are set and applied by Valve under the Steam Subscriber Agreement.

The EULA requires you to be at least 13 years old, or the higher minimum age that applies where you live, to play GRIT®. That is a condition you agree to when you accept the EULA. It is a commitment you make to us, not something we verify.

We do not knowingly collect personal information from children under 13. Because we hold no age signal, we cannot identify which players are children and we do not attempt to. We do not profile players by age, and we do not use anything we hold to guess how old anyone is.

If you are a parent or guardian

Write to privacy@grit.gg. Tell us the Steam persona name or Steam ID, and that you are the parent or guardian.

We will ask you to show that you or your child control the Steam account, in the same way described in Section 5 — either by signing in to GRIT Ledger with that Steam account, or by adding a short code we give you to its Steam display name for a few minutes. We will not ask you for identity documents, and we will not ask for proof that you are the parent. We are checking control of the account, nothing more.

Why we ask. Everything below is done at the request of someone we cannot see, about an account we cannot verify belongs to them. Acting on an unverified email would let anyone erase another player's record by claiming to be their parent. The check protects your child as much as it protects us.

If the account cannot be reached — it is closed, or the password is lost — tell us and we will still stop publishing. We will not delete the underlying record without the check, because deletion cannot be undone and hiding can.

Once we are satisfied, here is what we do — you do not have to ask for each of these separately:

• We stop publishing that player's data. They no longer appear on GRIT Ledger. Where a match record has to remain because other players took part in it, their name and Steam ID are replaced with a neutral placeholder.

• We delete what we can. We delete the personal information we hold about that player, except where we are required to keep something by law or need it to enforce a ban already in force. If something has to stay, we will tell you what and why.

• We tell you when it is done. We act without undue delay and in any event within thirty (30) days. If a request is unusually complex we may need up to two further months — if that happens we will tell you within the first thirty (30) days, and tell you why.

If you would rather the player simply stopped being visible than have their data deleted, say so and we will do that instead.

Younger players generally

People under 18 play GRIT®, and their match data is recorded and published like anyone else's, because we cannot tell who they are. Any player, or a parent on their behalf, can ask us to stop publishing their data at any time by writing to privacy@grit.gg — the same route, and we apply it the same way. This is set out in Section 5 and in the GRIT Ledger Privacy Notice, Section 9.

11. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices or in the law. Each version carries a version number and an effective date, shown at the top of this document. We do not publish an archive of previous versions. For material changes we will give notice in accordance with Section 16 of the EULA — at least thirty (30) days in advance, at grit.gg and by in-Game notice — and, where the change requires your consent, we will ask for it.

12. How to Contact Team Grit

For general questions about the Services — game issues, account trouble, bugs, payment matters, or content concerns — contact support@grit.gg.

For questions about this Policy or our privacy practices, or to exercise your rights, email privacy@grit.gg or write to us at:

Team Grit LLC, 1100 Bellevue Way NE, Ste 8A-557, Bellevue, WA 98004, U.S.A.

End of Privacy Policy.