Privacy Policy
Last updated 21 September 2026
GrainsMap is run by Fernando Paulino, Portugal. This policy says exactly what the site stores, why, and how to get rid of it.
What we store, and why
| Data | When | Why | Kept |
|---|---|---|---|
| Email address, name, profile picture | Only if you sign in with Google | To have an account at all | Until you delete the account |
| Your Google account identifier | Only if you sign in | To recognise you next time without relying on your email address | Until you delete the account |
| Session record | While signed in | To keep you signed in, and to let you sign out everywhere | 30 days, or until you sign out |
| Your preferences and watchlist | When you set them | To show you what you asked for | Until you delete them |
| Your subscription: plan, status, renewal date, and Paddle's customer and subscription identifiers | Only if you subscribe | To know which prices to show you | Until you delete the account |
| Paddle's billing notifications about your subscription | Only if you subscribe | An audit trail of what changed and when. They carry identifiers and amounts, not your card or address. | 13 months |
| A random visit token | Every visit | To count visitors without identifying them | Only a running total is kept; the token disappears when you close the tab |
What we deliberately do not store
- No IP addresses. Not in the visit counter, not against sessions.
- No user agents or device fingerprints.
- No browsing history. Which ports you look at is not recorded.
- No analytics or advertising trackers. No Google Analytics, no advertising pixel, no third-party script watching you.
- No password. Sign-in is Google's; we never see credentials.
What we ask Google for
Only openid, email and profile - your email
address, your name and your picture. Nothing else. GrainsMap cannot read your
Gmail, your Drive, your contacts or your calendar, and has never asked to.
Who else sees it
- Google, because you chose to sign in with them.
- Oracle Cloud (our host, Germany) and Cloudflare, which carry the traffic.
- Paddle, if you subscribe. Paddle.com is our reseller and the merchant of record: it takes the payment, calculates tax, issues the invoice and holds your billing details under its own privacy notice. We receive your subscription status, never your card number.
Your data is not sold, rented or shared with advertisers. There is no one else.
Your rights
Under the GDPR you may access, correct, export or erase your data, and object to its processing. Two of those are buttons rather than requests:
- Export - your account page returns everything we hold, as JSON.
- Erasure - deleting your account signs you out everywhere immediately and permanently removes the record after 30 days. The delay exists so an accidental deletion can be undone by asking; within it, contact us and it is reversed.
To correct something, or to complain, email privacy@grainsmap.com. You may also complain to the Portuguese supervisory authority, CNPD.
Legal basis
Account data is processed to perform the contract you enter by creating an account, and subscription data to perform the subscription. The visit count rests on our legitimate interest in knowing how many people use the site, and is built so that it cannot identify anyone.
Where it lives
On a server in Germany, inside the EU. Backups are encrypted and stay in the EU.
Changes
If this policy changes in a way that affects you, the date above changes and signed-in users are told before it takes effect.