Grailology

Privacy Policy

Effective date: July 8, 2026

This Privacy Policy describes how Grailology, LLC ("Grailology," "we," "us") collects, uses, and shares information when you use grailology.com and the community grading quiz (the "Services"). The short version: we collect the minimum we need — an email address to verify graders and your quiz responses to calibrate an open grading standard — and we don't sell your personal information or run advertising trackers.

1. Information we collect

• Email address — when you verify to participate in the quiz.
• Quiz responses — the grades and defect judgments you submit, and a self-reported grading-experience level.
• Marketing consent — whether you opted in to receive updates and aggregated results by email.
• Support messages — if you contact us, the name, email, and message you provide.
• Technical data — IP address and basic request metadata, used for security, anti-abuse, and rate limiting; and an essential session cookie that keeps you signed in. Bot protection is provided by Cloudflare Turnstile, which may process technical signals from your browser.

We do not collect payment information — nothing is sold on this site today.

2. Grailology accounts

If you create a Grailology account (google, discord, or github sign-in, or email-code), we store your verified email address, an optional public handle and display name, your marketing-consent preference, which sign-in providers are linked to your account, and any standard-calibration submissions and quiz activity you've saved under that account.

• API keys — if you create one to use the MCP/API, we store it hashed and never in plaintext. Authenticated MCP/API requests are logged with your key's id (not your IP address) for usage tracking and rate limiting.
• Standard-calibration submissions — cards you score and submit are attributed to your account and used to calibrate the open grading standard, the same way quiz responses are (see §3, How we use information, below).
• Self-serve deletion — you can permanently delete your account from the account page at any time; this removes your account, linked sign-in identities, API keys, submissions, and quiz history immediately.

The anonymous calculator on /score is unaffected by any of this — its usage telemetry is never tied to an account (see §1, Technical data); account attribution applies only to signed-in submissions and MCP/API requests.

3. How we use information

• To operate the quiz: sending verification codes, keeping one voice per grader, and showing you your own grading history.
• To build the open grading standard: analyzing and aggregating quiz responses to calibrate grading algorithms, and publishing aggregated or anonymized statistics and datasets. Published outputs never include your email address.
• To send you updates and results — only if you opted in; every email includes a way to opt out.
• To respond to support requests.
• For security: preventing spam, abuse, and fraud.

4. Cookies

We use a single essential session cookie to keep you signed in to the quiz. We do not use advertising or cross-site tracking cookies.

5. How we share information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share information only with service providers that run the Services on our behalf:

• Cloudflare — website hosting, storage, and bot protection (Turnstile).
• Resend — transactional email delivery (verification codes, opted-in updates).

We may also disclose information if required by law, or in connection with a corporate transaction (in which case this policy continues to apply to previously collected data).

6. Data retention

We keep personal information for as long as needed for the purposes above. Verification codes expire within minutes and are deleted after use. Aggregated, de-identified statistics may be retained indefinitely.

7. Your choices & rights

• Email updates: opt out anytime via the link in any email or by contacting us.
• Access or deletion: email us or use the support page to request a copy or deletion of your personal information. If you have a Grailology account, you can also delete it yourself from the account page — see §2, Grailology accounts. Deleting your email removes your identity from the system; already-published aggregated statistics cannot be un-aggregated.
• California residents: the CCPA gives you rights to know, delete, and correct personal information, and to be free from discrimination for exercising those rights. We do not sell or share personal information as defined by the CCPA. To exercise rights, contact us at the address below; we will verify requests via the email address on the account.

8. Children

The Services are not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 provided us personal information, contact us and we will delete it.

9. Security

We use reasonable technical and organizational measures appropriate to the data we handle — verification codes and API keys are stored hashed, sessions are signed, and access to production data is limited. No system is perfectly secure.

10. Changes to this policy

We may update this policy from time to time. The current version will always be posted here with its effective date, and material changes will be reasonably highlighted.

11. Contact

Grailology, LLC · 1401 21st St, Ste R, Sacramento, CA 95811 · hello@grailology.com · support page