Privacy policy
This policy explains what the GridStats iPhone app and the gridstats.io website collect, why and what you can do about it. GridStats shows your audience numbers from different platforms in one grid. We keep this short because we collect very little.
GridStats uses each platform's official sign-in and data tools. We never ask for your passwords and never scrape profiles.
The GridStats app
Your GridStats account
You sign in with your email address, so we store that address and the dates you signed in. We use it to run your account and to send your sign-in emails. We also store which plan you are on and the tiles on your grid, in the order you arranged them.
Instagram, Facebook Pages and Pinterest
These tiles only work if you choose to sign in to that platform through its own official sign-in screen. We never see your password. We read follower counts and basic profile information only, and we never post, change or send anything on your behalf.
| Platform | What we read | Access we ask for |
|---|---|---|
| Your account ID, username, name, account type and follower count. | instagram_business_basic | |
| Facebook Pages | Your Facebook user ID and name, the permissions you granted, the Pages you chose to share (ID, name, username and follower count) and an access token for each Page. For Pages owned by a business portfolio, we also look up which portfolios you can access so we can find those Pages. We don't keep the portfolio details. | pages_show_list, pages_read_engagement, business_management |
| Your account ID, username, business name and follower count. | user_accounts:read |
We don't read your posts, photos, messages, comments, followers' identities, insights or ad accounts.
Why we read it. To show your follower count on your tile and how it has changed over 24 hours, 7 days and 30 days. The names let you tell your tiles apart. We use this data for nothing else.
How often. Once when you sign in and add a tile, then about once an hour while the tile is connected.
Where it is stored. In our Supabase database, in Supabase's London region. The access tokens that let us read your counts are encrypted in Supabase Vault. They are never sent to the app, shown to anyone or written to logs. Only you can see your connected accounts and their history in the app.
Read-only, never sold or shared. Our access is read-only. We never sell this data, never share it with anyone else and never use it for advertising. The only company that handles it for us is Supabase, listed below.
Disconnecting. Open a tile in the app and choose Disconnect. We delete that login's tokens straight away and stop reading the account. The tile keeps its history and shows Reconnect until you remove it. You can also remove GridStats in the apps and websites settings of Facebook, Instagram or Pinterest, and we then can't read that account any more.
YouTube, Bluesky and tiles you type in
For YouTube and Bluesky you give us a public channel or handle. We read its public subscriber or follower count once an hour, using the YouTube API Services and Bluesky's public API, without you signing in. Using YouTube tiles means you also agree to YouTube's Terms of Service, and Google's Privacy Policy applies to that data. We keep YouTube readings for no more than 30 days. You can also type in a number yourself, and we store what you enter.
Readings for public YouTube, Bluesky and X accounts are shared between GridStats users who track the same account. Each user only sees the accounts on their own grid.
X (formerly Twitter) accounts
When you add an X account to your grid, you give us its public @handle. Once a day GridStats asks X's official API for that account's public follower count and stores one reading per day, which we use to show the change over 24 hours, 7 days and 30 days. We don't ask you to sign in to X and we read nothing else from the account. Readings for a handle are shared between GridStats users who track the same public account, and each user only sees the accounts on their own grid.
Following X's Developer Policy, if a daily read finds that an account has become protected, has been suspended or has been deleted, we stop showing its numbers (the tile shows only its status) and delete its stored follower history straight away. If the account becomes public again, a new history starts from the next daily read; the deleted history is not restored.
We keep a log of our requests to X (dates and the number of accounts asked for, never the handles) for 180 days, to manage our costs.
How long we keep app data
- Follower history is kept while your subscription is active. If your subscription lapses, we delete the history 12 months later. On the free plan, which has no subscription to lapse, it is kept until you remove the tile or delete your account.
- Removing a tile deletes its history straight away.
- Deleting your account deletes everything straight away, as described below.
- Access tokens are kept only while the login is connected.
- Backups: we keep backup copies of the database on our own equipment in the UK, to recover from a failure. Each copy is deleted within 90 days, so data you delete can remain in a backup until then. We don't use backups for anything else.
Deleting your data
You can delete your data yourself at any time, and you don't need to ask us.
- Open GridStats and sign in.
- Tap the ⋯ button at the top right.
- Tap Delete my GridStats account, then Delete everything.
This immediately and permanently deletes your sign-in, your tiles, your follower history and all your Instagram, Facebook and Pinterest tokens. It can't be undone.
To delete a single account instead, open its tile and choose Remove from GridStats, which also deletes its history.
If you can't open the app, email hello at gridstats dot io from the address you signed in with and ask us to delete your data. We will do it and confirm within one month, and usually much sooner. You don't need to give a reason.
Who processes data for us
| Company | What it does | What it handles |
|---|---|---|
| Supabase | Database, app backend and scheduled reads (London region) | Your account, tiles, follower history and encrypted tokens, plus the waitlist |
| Resend | Sends email | Email addresses, for waitlist and sign-in emails. No platform data. |
| Apple | Delivers the app and test versions | What Apple's own terms cover. No platform data. |
| Website analytics, only if you accept | Website visits. No platform data. | |
| Our web host | Runs gridstats.io | Server logs. No platform data. |
The app contains no advertising or analytics software today. If we add ads to the free plan we will update this policy first, and your platform data will never be used for them.
Requests from public authorities
If a public authority asks us for your data, we check that the request is valid and lawful, challenge it if it isn't and hand over only the minimum the law requires. We tell you about it first unless the law stops us.
The website
This part covers gridstats.io itself.
Analytics, only if you accept
If you click Accept on our cookie banner, we use Google Analytics to understand how the site is used: which pages are visited, roughly where visitors are (country and city level), what device and browser they use, how they found the site and how long they stay. This helps us see which guides are useful.
If you click Decline, or ignore the banner, Google Analytics is not loaded and no analytics cookies are set.
Google Analytics data is kept for 14 months. Google acts as our processor, and we have not enabled Google Signals or advertising features. Google may process data in the United States; transfers rely on safeguards recognised under UK data protection law. You can read how Google uses data from sites that use its services.
The waitlist
If you join the waitlist using the "Tell me when it launches" form, we store your email address, the date you signed up, the page you signed up on and the wording you agreed to. We then send you one email asking you to confirm. You are only on the list once you press the confirm button in that email.
We use your address to tell you when GridStats launches on iPhone. We will not share it, sell it or add you to anything else. If you later create a GridStats account with the same email address, we may link the two so we can give waitlist members a launch offer.
Every email we send has an unsubscribe link. Unconfirmed sign-ups are deleted automatically after 30 days. Confirmed sign-ups are kept until you unsubscribe or ask us to delete them.
Sign-ups are stored by Supabase (in its London region), and our emails are sent by Resend. Both act as our processors. Resend may process data in the United States; transfers rely on safeguards recognised under UK data protection law.
Emails you send us
If you email us, we receive your email address and anything you write. We use it only to reply. Ask us at any time and we will delete it.
Server logs
Like almost every website, our web host keeps standard server logs, which include IP addresses, the pages requested and browser details. They are used to keep the site running and secure, and are deleted on the host's normal schedule.
Cookies
We only set cookies if you accept analytics:
- _ga and _ga_8YE3Z1HZ9H (Google Analytics): tell visits apart so we can count visitors. They last up to 2 years.
We also store your cookie choice in your browser (local storage, under the name gs_consent) so we do not ask again on every page. This is not sent to anyone.
You can change your mind at any time with the Cookie settings link at the bottom of every page.
Our lawful bases
- Running your GridStats account and showing your tiles: our contract with you.
- Reading Instagram, Facebook and Pinterest accounts you connect: our contract with you, and you can stop it at any time by disconnecting.
- Keeping the app secure, and keeping backups: our legitimate interest in keeping the service working and safe.
- Responding to public authorities: our legal obligations.
- Analytics: your consent.
- The waitlist and launch email: your consent, which you can withdraw at any time by unsubscribing.
- Replying to emails: our legitimate interest in answering people who contact us.
- Server logs: our legitimate interest in keeping the website working and secure.
Your rights
Under UK data protection law you can ask us for a copy of the information we hold about you, ask us to correct or delete it, object to how we use it or withdraw your consent. Email hello at gridstats dot io and we will reply within one month.
If you are unhappy with how we have handled your information, you can complain to the Information Commissioner's Office at ico.org.uk.
Children
GridStats isn't meant for anyone under 13, and we don't knowingly collect their data. If you think a child has given us data, email us and we will delete it.
Changes
If we change this policy we will update the date at the top of this page. If a change affects how we use your connected accounts, we will tell you in the app first.
Who we are
GridStats and gridstats.io are run by Flick Pictures Limited, a company registered in England and Wales (company number 01631573), registered office 11 Sturgeons Hill, Lichfield, Staffs, WS14 9AW. Flick Pictures Limited is the data controller for the app and this website. You can contact us at hello at gridstats dot io.