Privacy Policy

Last updated: 9 September 2026

This policy explains what information Gridline collects, how it is used, and the choices you have. It covers all three parts of the service: this website (gridline.cc), the Gridline Dashboard (app.gridline.cc), and the Gridline Discord bot. Gridline is operated by AlexFrush under the project name Gridline Development ("we", "us").

1. This website (gridline.cc)

The marketing site is a set of static pages. It has no forms, no accounts, and no database of its own, and it asks you for nothing. Visiting it does not create a record about you beyond the standard server logs described in section 6.

The only request the page makes on your behalf is to /api/stats, which returns two rounded public figures — roughly how many people Gridline reaches, and how many race weekends it has run. That endpoint returns counts and nothing else; no information about you is sent to it or comes back from it.

1a. Cookies and browser storage on this website

This website sets no cookies at all. No analytics, no advertising pixels, no session tracking, no fingerprinting. Fonts are self-hosted, so loading a page makes no requests to third-party font servers.

2. The Gridline Dashboard (app.gridline.cc)

The Dashboard lets league staff and stewards run their league from a browser instead of from Discord. It is a second door onto the league data Gridline already holds — the same attendance, calendar, stewarding and Driver of the Day records described in section 3. Opening your league in a browser does not create a second copy of it and does not collect anything new about your drivers.

2a. Signing in

The Dashboard authenticates with Discord, using the OAuth2 authorization-code flow. There is no Gridline password, because there is no separate Gridline account: your Discord identity is the account.

We request exactly two Discord permissions and no others:

• identify — so we know which Discord user is signing in.
• guilds — read once, at sign-in, to answer one question the bot cannot answer for itself: which servers you administer that Gridline has not yet been added to, so the server picker can offer to add it. Of that response we keep only the id, name and icon of servers you could actually add a bot to. Servers you are merely a member of are discarded, as are banners, features and permission sets.

We ask for nothing that would let us read your messages or act on your behalf, and we never receive your Discord password.

The access token Discord issues is never stored. It exists only inside the function that exchanges the sign-in code, is used once to read your user id and that server shortlist, and is discarded when that function returns. There is no token for us to leak, refresh, or misuse later.

2b. Your session

Signing in creates a session. We store, for as long as it lasts:

• A hash of your session token — the token itself exists only in your browser; we keep a SHA-256 hash, so the database cannot be used to impersonate you.
• Your Discord user ID, and the times the session was created, last used, and expires.
• The server shortlist from section 2a, so the picker works without re-asking Discord on every page.

Sessions expire 12 hours after sign-in and are deleted when you sign out. Separately, the answer to "may this person manage this server?" is cached for 60 seconds and then re-checked against Discord — deliberately short, so that losing a role in Discord takes effect on the Dashboard almost immediately.

2c. Cookies and browser storage on the Dashboard

The Dashboard sets two strictly necessary cookies, and no others. Neither is used for analytics, profiling, or advertising, and nothing about your visit is shared with anyone.

• __Host-gl_session — your session token. HttpOnly (unreadable by scripts), Secure (HTTPS only), SameSite=Lax, and carrying the __Host- prefix, which browsers themselves enforce as host-only: it can never be sent to gridline.cc or anywhere else. Lifetime: 12 hours.
• __Host-gl_state — a random value that lets us confirm the sign-in coming back from Discord is the one you started, protecting you against cross-site request forgery. It lives only for the seconds of the sign-in round trip.

Two small flags are also kept in your own browser and never sent to us: a sessionStorage note of how you navigated to a page, so going back behaves sensibly, and a localStorage note that you have already seen a feature walkthrough, so it is not shown twice. Clearing your browser data removes both.

2d. What the Dashboard records

Changes made through the Dashboard are written to the same league records the bot uses. In addition, each league has an audit log: a list of which staff member changed what, and when — for example that a round was rescheduled or a verdict recorded. It is shown to that league's own staff so a league can see its own history; it is not shared between leagues and is not used for anything else. Navigation — opening a page, signing in — is recorded operationally (section 4) but is not treated as a change and is not shown in the league's audit log.

3. The Gridline Discord bot

When a server adds the Gridline bot, it stores only what it needs to run that server's league. Gridline does not monitor general server chat or read old message history. It processes only the commands, buttons, forms, attachments, and direct messages that you send to Gridline for its features. Where Discord provides member or message metadata needed for a feature, Gridline uses it only to operate that feature.

For each server, Gridline stores:

• Discord identifiers — server (guild) IDs, user IDs, role IDs, channel IDs, and message IDs, so it knows where to post and who has responded.
• Event details staff create — name, round, description, an optional attached photo, start time, timezone, and points settings.
• Your attendance responses — whether you're attending or not, and an optional reason you type when you decline.
• Reserve queue — whether you've joined an event's reserve list, and when.
• Incident cases — reports drivers file after a race (session, lap, corner, drivers involved, a description, and optional evidence you choose to attach, such as screenshots or video links), responses from the drivers involved, and the steward decisions, penalties, penalty points, and appeals recorded on each case.
• Driver of the Day votes — who you voted for on an event, so each driver votes once and the result can be counted.
• Driver profiles — the details a driver chooses to put on their own profile, such as a display name, number, and nationality, together with the league statistics Gridline has already recorded for them.
• League applications — where a league runs its sign-ups through Gridline, the answers an applicant submits and the staff decision recorded on them.
• Results and championship standings — for leagues using the results feature, the finishing order staff record for each round and the standings calculated from it.

To DM the right drivers, Gridline uses Discord's Server Members access to see which members hold a configured driver role. Server staff who use Gridline are responsible for letting their members know that attendance and related features are run through Gridline.

Only attach evidence you have the right to share.

4. Operational and error logs

To keep the service running we record a minimal operational trail: a timestamp, the server and user an action belonged to, which feature it used, and whether it succeeded. When something goes wrong we also record the error itself — its message, the feature it happened in, and the server name and Discord username of whoever hit it — so it can be diagnosed and fixed. These logs exist to operate and repair Gridline. They are not profiles, they are not used to analyse behaviour, and they are not shared.

5. New features

As Gridline grows, new features may process information this policy does not yet describe. We will update this policy and the "last updated" date before any such feature starts collecting new data.

6. Who receives your data

• Netlify — serves this website (gridline.cc) and keeps standard server logs (IP address, user-agent, referrer, timestamp, pages requested) for security and reliability. Netlify holds no league data.
• Railway — hosts the Gridline bot, the Dashboard, and their databases. This is where league data actually lives.
• Discord — the bot runs on the Discord platform and the Dashboard authenticates against it, so the data above is sent through Discord to operate. Your use of Discord is governed by Discord's own privacy policy.

We do not sell your data or share it with anyone else. We do not use it for advertising.

7. Why we use it (lawful basis)

We use league data solely to provide the features you and your server ask for, and sign-in data solely to establish who you are and what you are allowed to do. We do not add you to any mailing list. For users in the EU/UK, our lawful basis is your consent — given by approving the Discord authorization screen and by using the features — together with our legitimate interest in operating and securing the service. Where a league processes its drivers' information through Gridline, that league is the controller of its own league data and we act as its processor.

8. How long we keep it

Sessions expire after 12 hours. League data is kept while Gridline is in your server; if the bot is removed, or a league erases its data through Gridline, or you ask us to delete yours, we will delete or anonymize it within 30 days, unless we need to retain limited records for security, abuse prevention, legal compliance, or backup integrity. Operational and error logs are kept only as long as they are useful for diagnosis. You can request deletion anytime by emailing hello@gridline.cc.

9. Your rights

You can ask us to access, correct, or delete your information, or to stop contacting you. Email hello@gridline.cc and we will action it. We do not sell or share personal information (as defined under US state privacy laws such as the CCPA). EU/UK users also have the right to lodge a complaint with their local data-protection authority.

10. Children

Gridline is not directed to children under 13. You must be at least 13 years old and meet the minimum age required by Discord and the laws of your country to use Gridline. If you are below the digital age of consent in your country, you may only use it with your parent or guardian's knowledge and permission. We do not knowingly collect personal data from anyone below 13; if you believe someone under 13 has provided us information, contact us and we will delete it.

11. External links

We may link you to our community on Discord. Discord is a separate service governed by its own privacy policy; joining it is your choice.

12. Security

Everything is served over HTTPS. This website is static and holds no data of its own. On the Dashboard, session tokens are stored only as hashes, the session cookie is HttpOnly, Secure and host-only, every state-changing request is origin-checked, and what you are allowed to see is re-verified against Discord on each request rather than trusted from your session. League data is stored on access-controlled infrastructure and used only to operate Gridline.

13. Changes

We may update this policy as Gridline develops. Material changes will be reflected by the "last updated" date above.

14. Contact

Questions about this policy or your data: hello@gridline.cc.

← Back to Gridline  ·  Terms of Service