Privacy
There is no account and nothing is sold. This page names every company that touches what you type, and says what each one does with it.
Who we are
El Grande is made by Octave ehf., trading as Octave Studios, in Reykjavík, Iceland. Octave ehf. decides what happens to everything below and answers for it. Write to hello@elgrande.app.
No sign-up, no ads
No account, no password, no email, no ad network, nothing sold on. What the app gives itself instead, the first time it opens, is two anonymous ids: a random one for the phone, and an anonymous account at Supabase, the hosted database we run on. Neither is tied to your Apple Account. The name you give yourself is saved with the anonymous account, and the names at the table go with each game's record, so we can see who plays with whom.
How the app is used
The app records how it is played so we can make it better: when it opens and goes to the background, which topic you pick, when a game starts, finishes or is abandoned and how it went, how each answer was ruled and how long the player took, when a challenge is thrown or won, when a room is made or joined, when an invite goes out or an invite link opens the app, whether a room code you typed worked, when you save your name, and whether a right answer showed its picture. Every one of them carries the app version and the build.
A game starting or ending also carries the names at the table (in a room, its code too) and how it went: the mode, how many players, how many answers were given, how many yellow cards, how many challenges were spent, how long it ran, whether it was played across phones, and for a solo run the points. A ruling carries the verdict, how long the player took to answer, which turn of the round it was, and how many were still standing.
These are tied to the two anonymous ids above. The account id is the same one rooms use, so they connect to the name you gave yourself. The topic is recorded, and if you wrote the category yourself then that is your own words. They never carry the answers people typed, your contacts, or a phone number. They are not used for advertising, not used to follow you across other apps, and not sold or shared.
Calling an answer
Answers are ruled on by a Google model. When someone answers, the app sends the topic, the typed answer and the answers already given that round to our server, and our server hands them to Google, which runs Gemini and, on the harder calls, a Google Search to check the facts. Sometimes our server can settle it from work the model already did for that round, and then nothing leaves. A category you write yourself and the note you type when you challenge a call go the same way as an answer.
No name, no account and no device identity rides along with it. Google processes it to answer the request and hands back a verdict.
The picture on the card
To find the picture that belongs with an answer, our server sends the answer itself as a search term to public catalogues: Wikipedia and Wikimedia Commons, TMDB, Spotify, iTunes, Deezer, TheAudioDB, TheSportsDB, RAWG, logo.dev, Unsplash, TheCocktailDB, TheMealDB, iNaturalist, the Art Institute of Chicago and NASA. A flag is the one exception: the country is matched against a list we keep here, so the address at FlagCDN is built rather than searched for.
Your phone then loads the picture straight from whichever site had it, so that site sees your phone’s network address. They get the word, not you.
Playing across phones
A room lives as a row in that same database. It holds its code, the topic, the display name and colour of everyone at the table, who is still in, and the state of the round, which includes every answer typed in that room. Whoever is hosting writes that row, and the other phones read it back.
Your seat is tied to the anonymous account, which is what puts you back in it when you drop out and come back. There is no email or phone number behind it. Your last display name is kept against that account so you do not have to retype it, and when you leave a room your seat is marked as left rather than removed, so the record of who played together stays.
A room that nothing happens in for a day is marked over. The row stays.
When it crashes
Crashes and errors go to Sentry, on its European servers, so we can find out what broke. A report carries the fault itself, the phone model, the iOS version and the build, a tag for the topic and for the room code you were in, and the trail of the moments listed above that led up to it. It is tied to the same anonymous account id, and to the name you gave yourself. Never an email.
A copy comes back to us within the minute: a row in our database, which is in the United States, and a ticket in our private code repository at GitHub carrying the fault, the device, those tags, the anonymous id, the last of the trail and your recent moments in the app. An automated assistant from Anthropic reads the ticket to sort it and draft a fix, the same way it does a report you send by hand.
The app takes no screenshots, records no session replay, does not record what you tapped, and strips the part of a web address that would carry an answer or a room code. A small share of ordinary, working sessions is sampled for speed measurements.
Sharing an invite
Invite friends can send the room link through WhatsApp, Messages, Messenger, Instagram or Snapchat. Each one opens that app on your phone with the invite ready, and you send it from there. For Snapchat the app carries Snap’s own sharing code, which runs only when you tap Snapchat and hands a picture of the invite to the Snapchat app. What happens after that is covered by that company’s own privacy policy. We get nothing back from any of them.
Reporting a topic
If a topic someone wrote looks offensive or like spam, tap Report topic. We store the topic’s words, the room code, the reason you picked and the anonymous id the app gave your phone, so we can review it and stop the same person flooding us with reports. Only we can read it, from our own admin page.
Contacts
If you choose to invite friends from your contacts, the app reads your address book on your phone to show names and numbers, and only after you say yes. Nothing from it is uploaded, stored, or matched on our server. The invite goes out through your own Messages app, to the person you picked, and you see the text before it sends. Turn contacts off in Settings at any time.
Reporting a problem from TestFlight
If you send feedback from Apple’s TestFlight, Apple passes us what you wrote, the screenshot, your iPhone model, your iOS version and the email address on your Apple Account. We keep the report and the screenshot, and open a ticket in our own code repository at GitHub, which is private. Your email address stays out of that ticket, though the moments listed above can be attached to it so we can see what broke. An automated assistant from Anthropic reads the ticket to sort it and draft a fix.
Mail to hello@elgrande.app comes straight to us. If it describes something broken we may copy the details into a ticket by hand, without your address.
The waiting list
An email left on elgrande.app is stored with the date so we can tell you when the app is out. Nothing else about you is stored with it. It is not shared or sold.
Our server’s own logs
The judge runs on Vercel, which hosts this site and the app’s server. Calls to it leave a short log there. Our own line records the timing and a scrambled id for the topic, and on one path the answer itself. The request that fetches a picture carries the answer and the topic in the address, so those two land in the host’s own record of requests as well, along with the network address every call came from. No name, no account.
That address is also read to stop anyone scripting the judge. It is held in the server’s memory and never written to a database.
Why we are allowed to hold any of it
To run the game you asked to play, and to make it better and fix what breaks. Nothing here feeds advertising or profiling.
Where it sits, and for how long
Our database is hosted by Supabase in the United States, and the servers that run the judge are Vercel’s. Google, GitHub, Anthropic and Apple are United States companies too, so what is described above is handled there under each company’s own data terms. Sentry is the one that is not: crashes land in Europe, though the copy we keep of them comes back to the database in the United States.
Nothing is deleted on a schedule. Room rows, seats, the record of how the app was used, reports and waiting-list emails stay until somebody removes them by hand. We would rather write that down than promise a clean-up that does not run.
Getting it deleted
Write to hello@elgrande.app and we delete what is stored for you. There is no button that does it: someone here runs it against the database by hand, so tell us enough to find you. For a room, the code and roughly when you played. For anything else, what it was. We write back when it is gone.
You can also ask what we hold and ask us to correct it. If you are in the EU or the EEA and you think we have this wrong, you can complain to Persónuvernd, the Icelandic Data Protection Authority.
Children
El Grande is not made for children, and we do not knowingly keep anything from anyone under 13.
When this changes
The date at the top changes with the words. If a change matters, it gets its own line rather than a quiet edit.
Questions
hello@elgrande.app. If something is broken, start at support. The terms are on the terms page.