Privacy Policy

1. Who operates ApexGrind

ApexGrind is an independent, fan-made platform for recording Apex Legends kills, badges, cosmetics and progress. For privacy questions, contact hallo@apexgrind.co.

ApexGrind does not connect to EA accounts, import game statistics automatically, or ask for EA passwords. Players enter and manage their own records.

2. Information processed

• Account and access: email address, username, password hash, verification state, and account-request or invitation status.
• Profile: display name or gamertag, platforms, account level, favorite legend, rank, uploaded or linked avatar and banner, biography, social links, accent color, and chosen profile sections.
• Player records: manually entered kills and other legend statistics, milestone targets, activity history, goals, badges, cosmetics, pack counts and related notes.
• Preferences: platform, date format, time zone, and the locally saved tracker sort preference.
• Security and operation: sign-in session data and application request logs. The application logger records request method, path, status and request ID; it is configured to redact cookie headers. The application does not log passwords or request bodies.

Passwords are stored as Argon2id hashes, not as readable passwords. Do not submit information you do not want associated with your account.

3. Public player profiles

Active player accounts are discoverable from the recent-player list and have a public profile page. Only the sections selected in profile settings are shown there. Your email address, password, session data and internal account identifiers are not included in public profile responses. The administrator profile may also be featured on the landing page.

Profile images or links hosted on another website are loaded from that website. Its operator may receive your visitors’ browser and network information. Use the upload option or review the external host’s privacy terms before linking an image.

4. Why we use information

• To create and secure accounts, review access requests and deliver one-time access and password reset emails.
• To save the statistics and profile content you choose to record and display selected sections on public profile pages.
• To maintain the service, protect accounts, prevent abuse and respond to support requests.

5. Service providers

• Replit: application hosting and the configured database and object-storage services.
• Google Gmail: the connected Gmail service sends the founder account’s verification email.
• Google Fonts: the site loads a font stylesheet and font files from fonts.googleapis.com and fonts.gstatic.com. This remote request can expose a visitor’s IP address and browser information to Google.
• PrivateEmail SMTP: sends player invitation and password reset emails through the configured mail.privateemail.com host.

These providers process data needed to provide their services. If you choose an external avatar, banner or social link, that third party processes visits according to its own terms.

6. Retention and deletion

Account and player-record data remain in the service while the account is active. A player can export their record from Settings and request permanent account deletion there. Deletion requires the current password and confirmation in a dialog; it removes the account, associated player records, pending account-request/setup records, active sessions, and saved profile images owned by that account.

The sole administrator account is protected from self-service deletion. Contact hallo@apexgrind.co to arrange an administrator transfer before deletion. Deletion from the app cannot immediately remove copies already cached by a visitor’s browser or copies retained in provider backups.

Session cookies are configured to expire after 14 days. Invitation, setup and password reset links expire; password reset links are single-use and expire after 30 minutes.

7. Your rights

Subject to applicable law, you can request access, correction, erasure, restriction or objection, and data portability. You can correct profile and record details in the app, export your data from Settings, or contact the operator at hallo@apexgrind.co. You may also complain to your local data protection authority.

8. International processing and security

Provider infrastructure and support may involve processing outside the European Economic Area. Applicable transfer safeguards depend on the providers and locations involved.

The service uses HTTPS when hosted, hashed passwords, session cookies marked HttpOnly and SameSite=Lax, and access checks for private uploads. No security measure can guarantee absolute security.