Privacy Policy

GRAIN (“we”, “us”) operates the GRAIN play-to-earn photo game and this website. For any privacy question, or to exercise your rights, contact us at [email protected].

• Waitlist email — the email address you submit to join the waitlist.
• Account data — your sign-in identifier, username/display name, and preferences.
• Photos & metadata — the photos you submit for quests, plus technical metadata (resolution, capture-time signals) and quality/verification scores our systems compute.
• Wallet & rewards — your Solana wallet address, in-app token and GEMS balances, spins, and withdrawal records.
• Usage & device — pages viewed, actions taken, approximate location (from IP), device and browser type, and diagnostic logs.
• Support — messages you send us.

We do not ask for your name, government ID, or payment card details to browse or play, though identity or age verification may be required before withdrawals.

• Run the game — assign quests, grade and verify photos, award spins and tokens, and process withdrawals.
• Anti-cheat — analyse photos (including with AI) to confirm they match the quest and are genuine live captures, and to detect screenshots, re-photographed screens, and other abuse.
• Leaderboards — display your username, avatar, and score to other players.
• Communications — send you the waitlist / launch email you asked for, and important service notices.
• Improve & secure — understand usage, fix bugs, prevent fraud, and keep the service safe.
• Legal — comply with law and enforce our Terms.

When you submit a quest photo, it is stored in our object storage and analysed to produce a quality grade and a match/authenticity verdict. This analysis includes sending the image to a third-party AI vision provider that returns a structured result. We use the verdict to decide whether the quest is accepted; we do not use your photos to advertise to you, and we do not sell them.

Where GDPR/UK GDPR applies, we process personal data to perform our contract with you (to run the game), for our legitimate interests (anti-cheat, security, improving the service), with your consent (waitlist emails, any optional analytics), and to meet legal obligations.

We share data only as needed to run the service:

• Service providers — hosting, storage, email delivery, analytics, and the AI vision provider that verifies photos. They may only use the data to provide their service to us.
• The Solana blockchain — reward transactions and your wallet address are recorded on a public blockchain and cannot be deleted.
• Legal & safety — authorities where required by law, and to protect our rights, users, or the service.
• Business transfers — a successor entity if we merge, are acquired, or reorganise.

We do not sell your personal data.

We keep personal data for as long as your account is active and as needed for the purposes above — for example, to run the game, prevent repeat abuse, and meet legal and accounting obligations. When data is no longer needed we delete or anonymise it. Note that on-chain reward records are permanent and outside our control.

Depending on where you live, you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent (for example, unsubscribing from emails). California residents have rights under the CCPA/CPRA, including to know and delete personal information and to opt out of “sale” or “sharing” (we do not sell your data). To exercise any right, email [email protected]. We will respond as required by law. We cannot remove data already written to the public blockchain.

We may process and store data in countries other than yours. Where we transfer personal data internationally, we use appropriate safeguards (such as standard contractual clauses) as required by applicable law.

We use technical and organisational measures to protect your data, including access controls and encryption in transit. No system is perfectly secure, so we cannot guarantee absolute security — keep your credentials and wallet safe on your side.

Our sites use essential cookies/local storage to function (for example, to remember your theme and session) and may use privacy-respecting analytics to understand usage. Where required, we ask for consent before setting non-essential cookies. You can control cookies in your browser settings.

GRAIN is not for anyone under 18 (or the age of majority where you live). We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.

We may update this policy from time to time. We will update the date above and, for material changes, provide additional notice where appropriate. Please check back periodically.

Questions or requests? Email us at [email protected].