Privacy

Your account

Your Grandful account is your Grandkids Are Wonderful customer account, which Shopify runs. Depending on what the store has switched on, you can sign in with Google, Facebook, Apple, Shop, or a one-time code sent to your email. Grandful does not keep a password of its own for you.

Shopify holds your name, email address, addresses and order history. Grandful reads what it needs from Shopify while you are signed in. It keeps a private identifier for your account so the things you save in Grandful stay with you. That identifier is not your email address or your Shopify customer number.

You can browse Home, the Feed and the Shop without signing in.

Shopping and orders

Products, prices, checkout, payment, orders and shipping are handled by the Grandkids Are Wonderful store on Shopify. You pay in Shopify’s checkout, which appears inside the app. Grandful does not receive or keep your card details.

Grandful notes that an order was placed from the app so it can confirm your purchase and apply app offers, such as free shipping on your first order from the app.

What Grandful saves for you

When you are signed in, Grandful keeps the things you choose to save: the titles your family calls you, your Wishlist, the posts you save, and your reactions to posts. They are kept on Grandful’s servers, linked to your private account identifier, and are not shown to other people. Public reaction counts show totals only, never who reacted.

Grandful uses your saved title to prefer Feed posts and products that match it.

Rewards

Your Rewards points and status are held by LoyaltyLion, the store’s rewards provider. Grandful reads them to show you and does not keep a points balance of its own. If you choose to sign up for Rewards emails or texts, or add your birthday, that information goes to Shopify or LoyaltyLion, which keep it. Grandful does not keep a copy of your email address or phone number for this.

Reviews

Customer reviews shown in the app come from Loox, the store’s review service. Grandful displays published reviews. It does not collect reviews itself.

Ask Grandful

Ask Grandful is an AI assistant. When you send a question, its text goes to Grandful’s servers and to an AI service provider (OpenAI), which writes the answer. If you are signed in and ask about your own orders or Rewards, Grandful’s server looks up the relevant details and shares them with the provider so it can answer.

Grandful does not keep a history of your Ask Grandful conversations, and asks the provider not to keep them. Grandful never sends what you ask, or what Ask Grandful answers, to its analytics services. Please do not type card numbers or passwords into Ask Grandful.

Notifications

Notifications are off until you turn them on in My Grandful. If you do, Grandful registers a token for your device with Expo’s push notification service so it can send order updates, Rewards news, reminders and content. You can turn notifications off at any time in your phone’s settings.

Grandful keeps a short list of the notifications it sent to your device, so Home can show them. It keeps at most the newest 100 from the last 30 days.

Grandful is built to send a reminder when you leave items in your cart. To do that, it keeps a record of a cart left behind, linked to your account and your device, using a scrambled fingerprint of the cart rather than the cart itself, and it stops the reminder once you order. Cart reminders are sent only when Grandful has turned them on, so they may not be active.

The Feed and its media

The Feed shows posts from the Grandkids Are Wonderful Facebook Page. Grandful does not read your Facebook account or your Facebook activity. To make the Feed load reliably, Grandful may copy the Page’s public photos and video preview pictures to its own storage with Cloudflare. When you play a video, it streams from the Page’s source, which can see your device’s network address, as any video service would.

Product analytics

To learn how the app is used and fix problems, Grandful is built to send short, simple events, such as opening a product or adding to the cart, to two analytics services: PostHog and Google’s Firebase Analytics (Google Analytics for apps). They receive anything only in app versions where Grandful has switched them on, so they may not be active in every version.

While you are signed in, these events carry an analytics identifier that Grandful’s server works out from your account using a secret key, so the services never see your Shopify customer number. Before you sign in, they carry the identifier Grandful gave the app on your device. Grandful never puts your name, email address, phone number, saved titles, family details, search words, Ask questions, or message text into these events.

When they are switched on, these services also collect basic details about the app and device on their own, such as device model, operating system and app version, language and time zone, and approximate location worked out from the network address. Grandful asks PostHog not to work out your location. It does not control everything each service collects, and each uses it under its own policy.

Grandful does not use your device’s advertising identifier and does not show the tracking-permission prompt.

Links and attribution

Grandful is built to use AppsFlyer so that tapping a link, even one you tapped before installing the app, opens the right screen, and to learn which links and ads bring people to Grandful. AppsFlyer runs only in app versions where Grandful has switched it on, so it may not be active in every version. When it is, AppsFlyer documents that it collects basic technical details on its own, such as an app and device identifier, app and operating system versions, device model, language and network address. Grandful adds no name, email address, phone number or advertising identifier.

When AppsFlyer is on, Grandful also reports a few shopping actions to it: viewing a product, adding to the cart, starting checkout and completing a purchase. A completed purchase carries only a code that Grandful’s server works out from your order and that does not reveal your order number. It carries no amounts.

Measuring advertising with Meta

Grandful’s server is built to report a few shopping actions to Meta, the company behind Facebook and Instagram, to measure advertising: viewing a product, adding to the cart and starting checkout, and, only if separately switched on, completing a purchase. This reporting runs only when Grandful has turned it on, so it may not be active.

When it runs, it sends the action, an event code, whether you use iPhone or Android, and a scrambled (hashed) form of the identifier Grandful gave the app on your device. It sends no name, email address, phone number, address, saved title or amount.

Messages you send us

If you use Contact Grandful, we use your reply email address and your message only to answer you. Your message is sent by email, through an email service Grandful uses, to Grandful’s support mailbox. Grandful’s server passes it along and does not keep a copy in its own database, its logs or its analytics, and the app does not save it on your phone. The copy in the support mailbox is kept for as long as needed to help you and to handle any follow-up.

Please do not include card numbers or passwords in a message.

How long information is kept

We keep information only as long as it is needed for what it is used for. For example:

• The recent-notifications list: up to 30 days, and at most the newest 100.
• A link waiting to open after you install or sign in: up to 24 hours, on your phone only.
• Titles, Wishlist and saved posts: until you remove them or delete your account.
• Orders and related records: kept by the store for as long as accounting, tax, fraud-prevention and legal rules require, even after an account is deleted.

Who else receives information

Grandful shares information with the services named on this page: Shopify, LoyaltyLion, Loox, OpenAI, Expo, Cloudflare, PostHog, Google Firebase, AppsFlyer and Meta, and the email service that carries the messages you send through Contact Grandful. Each uses it under its own terms and privacy policy, and some collect technical details on their own, as described above. We may also disclose information when the law requires it.

Keeping information safe

Grandful uses encrypted connections, keeps your sign-in and your app’s private identifier in your phone’s secure storage, and only lets an account see its own private information. No system is perfectly secure, so we cannot promise absolute security. If you think someone else has access to your account, tell us right away.

Children

Grandful is for adults and is not meant for children. It has no child profiles and does not ask for children’s photos.

Your choices and rights

You can turn notifications off in your phone’s settings, sign out, and remove your saved titles, Wishlist items and saved posts in the app.

You can ask us what information we hold about you, ask us to correct it, or ask us to delete it. Depending on where you live, local law may give you other rights too. Some information is held by Shopify or the other services named above, and we will work with them on your request where we can.

If you are signed in, you can delete your account in the app. It is described in the next section.

To make any privacy request, use Contact Grandful (in My Grandful, open Help & Legal, then Contact Grandful) and choose the Privacy topic.

Deleting your account

If you are signed in, you can delete your account in the app: open My Grandful and choose Delete account. You will be shown what it does and asked to confirm before anything happens. It cannot be undone.

Deleting your account does two things. First, it erases the account information Grandful itself holds for you: your saved posts, reactions, Wishlist and titles, the Rewards visit and redemption records Grandful keeps, cart reminders, your notification history, and the links between your account and your devices. Second, it submits Shopify’s customer-data-erasure request for your Grandkids Are Wonderful store account. You are then signed out. If the request to Shopify cannot be sent, the app tells you so.

Shopify and the other services named on this page finish their own parts afterwards, which can take additional time. Grandful can report that the request was submitted; it cannot report that Shopify or any other service has finished, and it does not say so. LoyaltyLion, which holds your Rewards points and status, is documented to follow Shopify’s erasure request under its own Shopify process, and we have not yet confirmed that for your data.

Some records may be kept where the law or the running of the store requires it: orders, manufacturing and production records, tax and accounting records, fraud-prevention and dispute records, and a record that your deletion was requested. They are kept as history and are not used as an active profile for you.

Information Grandful had already sent to its analytics and attribution services before you deleted your account is not rewritten by Grandful. When you sign out, Grandful stops using your signed-in analytics identifier. Review content shown from Loox is held by Loox, and we will work with them on requests about it.

The Grandful website will also carry a deletion request page for people without the app.

Changes to this policy

When we change this policy, the date at the top of this page changes. If a change is important, we will tell you in the app.