Privacy Policy
Last updated: 19 August 2026
This Privacy Policy explains how Directorate Z LLC (“Directorate Z,” “we,” “us,” “our”) collects, uses, and protects personal data when you use The Grant — our judgment-training simulation game — available as a mobile app (iOS/Android), a web app at app.playthegrant.com, and our marketing site at playthegrant.com (together, the “Service”).
The Grant is a simulation. All charts in the game are synthetic. We do not collect, hold, or process any real financial account data, trading data, or market positions — none exist in the product.
1. Who we are
Directorate Z LLC is the data controller for personal data processed through the Service.
- Controller: Directorate Z LLC
- Registered address: 2800 E Enterprise Ave #333, Appleton WI 54913, United States
- Contact (privacy and data rights): [email protected]
2. What we collect
We collect only what we need to run the Service:
- Account data. Your email address. If you sign in with Apple or Google, we receive your OAuth identity (the provider’s subject identifier and your email, when provided; Apple may supply a private-relay email). If you create an email/password account, your password is stored only in hashed form — we never store plaintext passwords. Some accounts are OAuth-only and have no password.
- Display handle (optional). A chosen display handle you pick yourself. It is never your real name, and it is not required for anonymous play.
- Gameplay data. Rounds played, decisions/calls, reaction times, and the derived Judgment Graph, scores, and ratings computed from your play.
- Anonymous/device data. Before you sign in, the app keeps a device-scoped anonymous profile and local progress. If you later sign in, that local progress can be migrated into your account.
- Analytics and technical data. Standard usage analytics and device/technical data (see Section 4).
We do not collect real names, financial account information, or payment card data through the game itself. We do not sell personal data.
3. Why we collect it and our legal basis
Where the EU/UK General Data Protection Regulation (“GDPR”) applies, we rely on the following legal bases (GDPR Article 6):
| Purpose | Data used | Legal basis |
|---|---|---|
| Providing the Service: creating and authenticating your account, running gameplay, saving your progress and Judgment Graph, migrating anonymous progress on sign-in | Account data, gameplay data, anonymous/device data | Performance of a contract (Art. 6(1)(b)) |
| Security: verifying OAuth ID tokens, hashing passwords, preventing fraud and abuse, protecting the Service | Account data, technical data | Legitimate interests (Art. 6(1)(f)) — keeping the Service and its users safe; balanced against your rights |
| Product improvement and analytics: understanding how the Service is used so we can improve it | Analytics and technical data | Consent (Art. 6(1)(a)) in the EU/EEA, UK, and other jurisdictions where consent is required for analytics cookies and similar technologies; legitimate interests (Art. 6(1)(f)) only where consent is not required by applicable law |
| Communicating with you about your account (e.g. magic-link sign-in emails) | Email address | Performance of a contract (Art. 6(1)(b)) |
| Complying with legal obligations | Any relevant data | Legal obligation (Art. 6(1)(c)) |
Where we rely on consent, you may withdraw it at any time (Section 8).
4. Cookies and analytics
We use third-party analytics providers, such as Google Analytics, to understand how the Service is used and to improve it. In connection with analytics:
- Analytics services use cookies and similar technologies.
- IP addresses are anonymized in our analytics configuration.
- Analytics identity cookies are scoped to our root domain (
.playthegrant.com), so a visit that spans the marketing site and the app is measured as a single analytics session rather than two. - Because all charts in The Grant are synthetic, no personal financial data exists in the product and none is processed by our analytics.
- We do not sell personal data.
Where required by law (for example, in the EU/EEA and UK), we obtain your consent before setting non-essential cookies or running analytics — analytics does not run for you until and unless you consent — and you can withdraw that consent at any time with effect for the future. You can also control cookies through your browser settings.
We do not use your personal data for automated decision-making that produces legal or similarly significant effects on you.
5. Sharing and processors
We do not sell your personal data. We share personal data only with service providers (“processors”) who process it on our behalf and under our instructions, such as:
- Analytics providers (e.g. providers such as Google Analytics);
- Hosting and infrastructure providers that run the Service;
- Email delivery providers used to send sign-in and account emails;
- Authentication providers (Apple and Google), when you choose to sign in with them.
We may also disclose data where required by law, to protect our rights or the safety of users, or in connection with a corporate transaction (in which case this policy will continue to apply to your data or you will be notified of changes).
6. International transfers
Directorate Z LLC is based in the United States. If you use the Service from the EU, EEA, UK, or elsewhere, your personal data may be transferred to and processed in the United States and in locations where our service providers (such as hosting and analytics providers) operate. Where such transfers involve data from the EU/EEA or UK, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and/or applicable provider transfer frameworks.
7. Data retention
- Account and gameplay data is kept while your account is active. If you request deletion, we erase or anonymize your data, except that we may retain limited data for a short period afterwards where necessary for legal, security, or fraud-prevention reasons — no longer than 30 days after the deletion request, except where a longer period is required by law.
- Analytics data is retained per the analytics provider’s configurable retention window — for Google Analytics, up to 14 months — after which it is aggregated or anonymized.
- Anonymous device data (the pre-sign-in profile and local progress) lives on your device until you sign in (when it can be migrated to your account) or until you clear it or uninstall the app.
8. Your rights
If you are in the EU/EEA, UK, or another jurisdiction with similar laws, you have the right to:
- Access the personal data we hold about you;
- Rectify inaccurate or incomplete data;
- Erase your data (“right to be forgotten”);
- Restrict processing in certain circumstances;
- Data portability — receive your data in a structured, commonly used, machine-readable format;
- Object to processing, including processing based on our legitimate interests;
- Withdraw consent at any time, where processing is based on consent (this does not affect processing before withdrawal);
- Lodge a complaint with a supervisory authority.
To exercise any of these rights, email[email protected]. We will respond within one month (extendable where permitted by law for complex requests) or any shorter period applicable law requires, and we may need to verify your identity before acting on a request. You also have the right to lodge a complaint with your local data protection authority (DPA) — for EU/EEA residents, the supervisory authority in your member state; for the UK, the Information Commissioner’s Office (ICO).
9. Children
The Service is not directed to children under 16 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal data from children under that age. If you believe a child has provided us personal data, contact[email protected] and we will delete it.
10. Security
We use reasonable technical and organizational measures to protect your data, including hashing of passwords and server-side verification of OAuth ID tokens. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
11. Changes to this policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the Service or by email before the changes take effect. The “Last updated” date at the top shows when this policy was last revised.
12. Contact
Questions, concerns, or rights requests:
Directorate Z LLC
2800 E Enterprise Ave #333, Appleton WI 54913, United States
[email protected]
See also our Terms of Service and the standaloneDisclaimer.