GridSort

Privacy Policy

Last updated: August 23, 2026

This policy explains what data the GridSort browser extension and its website (www.hypercavs.com/grid-sort) collect, why, and the choices you have. The short version: sorting happens in your browser; we only store your login identity and subscription status.

1. What we collect

Data	Why we need it
Google account email & user ID (via Google Sign-In)	To identify your account, enforce plan limits (Free vs Pro), and sync your subscription across devices. We receive your email and ID from Supabase Auth after you complete Google sign-in — we never see your Google password.
Subscription status (plan, renewal date, Stripe customer/subscription IDs)	To know whether you're Pro and let you manage or cancel your subscription.
Extension settings (enable/disable, download folder preference)	Stored locally in your browser (chrome.storage). Never sent to us.
Instagram page content you browse (posts, likes/comments counts, media URLs on profile pages you open)	Processed locally in your browser to sort, badge, export and download. This data stays on your device unless you explicitly export it to CSV yourself.

2. What we do NOT collect

• We do not read your Instagram DMs, stories, or private content;
• We do not track your browsing history outside of Instagram profile pages you actively use with GridSort;
• We do not collect credentials for Instagram — you stay logged into Instagram directly with Instagram itself;
• We do not sell, rent or share your personal data with advertisers or data brokers.

3. Third-party processors

Provider	Purpose	Data involved
Google	Sign-in ("Continue with Google")	Your Google identity (name/email), handled by Google's OAuth flow
Supabase	Authentication + storing your account record and plan status	Email, user ID, subscription status
Stripe	Payments & subscription management	Email, payment details (handled by Stripe under PCI-DSS; we never see full card numbers)

4. Data storage & retention

• Account/subscription records are stored on Supabase infrastructure (US region) and kept while your account is active.
• You can request deletion at any time via the contact below; we will delete your account record within 30 days. Payment records Stripe holds are governed by Stripe's own policies and legal obligations.
• Exported CSVs and downloaded media are saved by you locally; we have no access to them.

5. Your rights (GDPR / CCPA and similar)

• Access / portability: ask us for a copy of the data tied to your email;
• Correction: fix inaccurate data;
• Deletion: delete your account and associated records;
• Opt-out of sale: we never sell personal data, so there is nothing to opt out of;
• Withdraw consent: uninstall the Extension and sign out to stop all processing that depends on your session.

6. Children's privacy

The Extension is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we'll delete it.

7. Security

Data in transit is encrypted (HTTPS/TLS). Access to our production database is restricted to the operators of the Service and protected by scoped API keys. No system is perfectly secure; please use unique passwords for linked accounts.

8. Changes to this policy

If we change how we handle personal data, we'll update this page and the "Last updated" date. Material changes will be highlighted in the Extension or on this site before taking effect.

9. Contact