Privacy Policy

Grim Tales operates grimtales.games, a marketplace connecting players with professional Game Masters. For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Grim Tales is the controller of the personal data described in this policy. You can reach us at support@grimtales.games.

Account data. When you sign in with Discord we receive your Discord username, email address and avatar image. We do not receive your Discord password.

Profile and listing data. Information you add yourself, such as a GM profile (display name, bio, experience, game systems, rates), game listings, bookings and reviews.

Payment data. Payments are processed by Stripe. We store booking amounts, fees and Stripe transaction references — never your card number. For GMs, Stripe collects identity and payout information directly under its own terms in order to provide Connect accounts.

Technical data. Standard server logs (IP address, browser type, pages requested, timestamps) kept for security and troubleshooting.

We do not currently use analytics or advertising trackers, and we do not buy data about you from third parties.

To provide the service — creating your account, listing games, processing bookings and payments, and enabling reviews. Lawful basis: performance of a contract.

To keep the platform safe — verifying GM applications, preventing fraud and abuse, enforcing our Terms. Lawful basis: legitimate interests (running a safe, trustworthy marketplace).

To meet legal obligations — accounting, tax and responding to lawful requests from authorities. Lawful basis: legal obligation.

To send service emails — booking confirmations and important account notices. Lawful basis: performance of a contract. Any marketing emails would be sent only with your consent, which you could withdraw at any time.

We do not sell your personal data. We share it only with:

Service providers — Stripe (payments), Discord (authentication) and our hosting providers (currently Heroku, part of Salesforce), each acting under their own security obligations.

Other users — your public profile, listings and reviews are visible to other users of the platform; players and GMs see the booking details relevant to their shared sessions.

Authorities or successors — where required by law, or as part of a business sale or restructuring (in which case this policy would continue to apply to your data).

Our hosting and some service providers process data in the United States. Where personal data leaves the UK we rely on appropriate safeguards recognised under UK GDPR, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or an applicable UK adequacy decision.

We use only essential cookies: session cookies that keep you signed in and protect the sign-in flow against forgery. These are strictly necessary for the service, so no consent banner is required. We will update this policy and seek any required consent before introducing analytics or marketing cookies.

We keep your account data while your account is open. If you close your account we delete or anonymise your personal data within a reasonable period, except where we must keep it longer — for example transaction records for up to six years for tax and accounting purposes, or data needed for an ongoing dispute. Server logs are kept for a short rolling period.

Under UK GDPR you have the right to:

access a copy of your personal data; have inaccurate data corrected; have your data erased; restrict or object to certain processing; receive your data in a portable format; and withdraw consent where processing is based on consent.

To exercise any of these rights, email support@grimtales.games. We will respond within one month. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk, though we would welcome the chance to address your concerns first.

All traffic to the platform is encrypted (HTTPS). Access to personal data is limited to what operating the service requires, and payment card data never touches our servers. No online service can guarantee absolute security, but we take proportionate technical and organisational measures to protect your data and will notify you and the ICO of any breach where the law requires it.

Grim Tales is for adults. We do not knowingly collect personal data from anyone under 18; if we learn that we have, we will delete it. Contact us if you believe a minor has created an account.

We may update this policy as the service evolves. Material changes will be announced on the site or by email, with the "last updated" date above revised accordingly.

Privacy questions: support@grimtales.games. See also our Terms of Service.