Privacy policy
Last updated: 31 October 2026. The German version is legally binding.
In short: Grialis works without an account. Your books, reading progress, notes and room stay on your device. Only if you sign in to the community is a backup without books also kept in your account. There are no ads, no tracking and no usage analytics. Data only leaves your device when you use a feature that needs the internet. Which features those are and what is sent is described below.
1. Controller
Adolf Blisse
Lerchenauer Straße 13
80809 München
Germany
Email: a.blisse@gmail.com
There is no data protection officer because none is required. For privacy questions, write to the address above.
2. Data on your device
The app stores on your device:
- the books you import yourself (EPUB files) and their covers,
- your reading progress, bookmarks, quotes and notes,
- your reading statistics (reading time, streak, coins),
- your room, character, pet and settings,
- a technical log for troubleshooting.
Without signing in, this data is not sent to us or anyone else. If you are signed in to the community, the app backs it up to your account without books and covers (section 4, cloud backup). A backup ZIP file is only created when you create one yourself and is saved where you choose. Uninstalling the app deletes the data on your device.
The app needs internet access. It only accesses your files through the system file picker when you import a book. It does not request location, camera, microphone or contacts.
3. Cloudflare: downloaded content and website
Furniture, clothes and hairstyles
Many furniture items, clothes and hairstyles are not included in the app and are downloaded when you buy or try them on, when they are missing in your room, or when a friend has them in their room. The files are hosted on Cloudflare R2 (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). When downloading, Cloudflare technically receives your IP address, the time and the requested file. No other data is sent.
Legal basis: Art. 6(1)(b) GDPR (providing the content you use) and Art. 6(1)(f) GDPR (legitimate interest in a small app and secure delivery). Cloudflare is certified under the EU-U.S. Data Privacy Framework.
Website grialis.app
The website grialis.app is also hosted by Cloudflare (Cloudflare Pages). When you visit it, Cloudflare technically receives your IP address, the time, the page requested and your browser identifier in order to deliver the site and protect it against attacks. The website sets no cookies, uses no analytics tools and does not load content such as fonts or scripts from other providers. Legal basis is Art. 6(1)(f) GDPR (legitimate interest in delivering the website securely).
If you write to support@grialis.app, the email is forwarded via Cloudflare Email Routing to our mailbox at Google. We only use it to handle your request.
4. Community: friends, room visits and book clubs (optional)
You only use the community features if you sign in. Without signing in, none of this is sent.
Which data
| Data | Purpose | Who sees it |
|---|---|---|
| Email address | Sign-in with a one-time code, account | only the operator |
| Display name, friend code | so friends can find and recognise you | your friends, members of your clubs |
| Confirmation that you are at least 16 and acceptance of the community rules (with time) | age limit and rules | only the operator |
| Current book (title, author, progress), streak, reading time this week | only what you share in the settings | your friends |
| Snapshot of your room (furniture, room style, position of books without titles) and the look of your character and pet | room visits, only if you turn on “Friends may view my room” | your friends |
| Who may enter your room | room visits | your friends only see whether they themselves may enter |
| Friendships, requests, stickers in rooms | friend features | the people involved |
| Book clubs (name, book, goal), membership, progress and reading time in the club book, reactions | book clubs | club members |
| Comments with their position in the book | club discussion with spoiler protection | club members |
| Private messages to friends | messages between friends | only you and that friend. If the friendship ends, the messages are deleted. |
| Cloud backup: reading progress, bookmarks, quotes and notes, library (title, author and file name of your books), reading statistics, room, character, pet, settings and purchases. Without books and covers. | Restoring your progress on a new device. The app backs up automatically, at most once a day, replacing the previous backup. | only you |
| Reports (reason, copy of the reported text or name), blocks, bans | protection against abuse, moderation | only the operator |
Before saving, comments and messages are automatically checked for links and against a list of prohibited words. If they match, the text is not saved. There are no other automated decisions.
Where the data is stored
The community runs on Supabase (Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513) on servers in the European Union. Supabase processes the data on our behalf (data processing agreement under Art. 28 GDPR). Where access from outside the EU is possible, it is based on the EU Standard Contractual Clauses. Supabase sends the sign-in code by email through the mailbox grialisapp@gmail.com at Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Google receives your email address and the content of the email containing the code. Where Google transfers data to the USA, Google LLC is certified under the EU-U.S. Data Privacy Framework.
Legal basis and retention
Legal basis is Art. 6(1)(b) GDPR (use of the community you chose). Reports, blocks and bans are based on Art. 6(1)(f) GDPR (legitimate interest in protecting the community from abuse).
Your community data is kept until you delete your account. You can withdraw what you share at any time in the settings. You can delete the cloud backup at any time in the settings with “Delete cloud backup”. After that, the app no longer backs up automatically until you choose “Back up now” again. Reports are kept for at most six months after they have been handled and then deleted. How to delete your account is described on the page Delete account.
The community is only allowed from age 16.
5. Real weather (optional)
If you choose the weather “Real” in the Ambience panel, you first search for your place. The place name you enter is sent to Photon, a search service by komoot (komoot GmbH, Potsdam, Germany) using OpenStreetMap data. A search only happens when you tap “Search”.
The app then requests the current weather from the Norwegian Meteorological Institute (Meteorologisk institutt, Henrik Mohns plass 1, 0371 Oslo, Norway). The coordinates of your chosen place are sent, rounded to 0.1 degrees (about 10 km). Both services technically receive your IP address, and the app identifies itself in the request with its name and the operator’s contact address. Norway is part of the European Economic Area, where the same data protection law applies.
Legal basis is Art. 6(1)(b) GDPR (the feature you turned on). Without the “Real” setting, no request is made. Weather data: MET Norway, licence CC BY 4.0. Place data: © OpenStreetMap contributors, ODbL.
6. Searching for printed books
If you add a printed book and search for its title, your search term is sent to Open Library (Internet Archive, 300 Funston Ave., San Francisco, CA 94118, USA), and covers are loaded from there. Open Library technically receives your IP address. If Open Library finds nothing or does not respond, the search term is sent to Google Books (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), and covers are then loaded from there. Google also receives your IP address. Legal basis is Art. 6(1)(b) GDPR. The transfer to the USA happens because you start the search yourself (Art. 49(1)(b) GDPR).
7. Looking up words
If you select a word in the reader and tap “Look up”, that word is sent to Wiktionary (Wikimedia Foundation, Inc., 1 Montgomery Street, Suite 1600, San Francisco, CA 94104, USA). For longer selections, a DuckDuckGo search opens in your browser instead. The privacy policies of these services apply. Legal basis is Art. 6(1)(b) GDPR; you trigger the transfer to the USA yourself (Art. 49(1)(b) GDPR).
8. In-app purchases
You buy coins and bundles through Google Play or the App Store. Payment is handled by Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) or Apple (Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland). We do not receive payment details, only the confirmation of which product was bought. It is stored on your device and, if you are signed in to the community, also in your cloud backup (section 4). Legal basis is Art. 6(1)(b) GDPR.
9. Feedback by email
If you write to us via “Send feedback by email”, your mail app opens with a prepared text: app version, device model, operating system, screen size, performance values and the last lines of the log (these may contain your books’ file names, but no book contents). You see the text before sending and can change or delete anything. We only use your email to handle your request and delete it when it is no longer needed. Legal basis is Art. 6(1)(f) GDPR (handling your request).
10. No ads, no tracking
Grialis shows no ads, uses no analytics or tracking tools and creates no profiles.
11. Your rights
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Write to a.blisse@gmail.com. You can change or delete much of your data in the app yourself.
You can also complain to a data protection supervisory authority, for example the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany.
12. Changes
If features of the app change, we update this policy. The current version is always on this page.