Privacy policy

Who this policy covers

This policy describes how StandFast Studios (“we”) handles information connected with the GridYear desktop app for Windows, your GridYear account, this website, and customer support. For privacy questions or requests, open a support ticket from your account or contact info@standfaststudios.com.

Your calendars stay on your PC

GridYear is a calendar app that runs on your computer. When you add an Outlook, Google or iCloud account, GridYear connects from your PC directly to that service. Your calendar data never passes through, and is never stored on, our servers. We cannot see your events, your calendars, or your sign-in details.

GridYear keeps a copy of your calendars and events, your settings, and your reminders in its app data folder on your PC, so it can show them quickly and offline. Calendars you create “On this PC” exist only there. Sign-in tokens for Outlook and Google, and iCloud app-specific passwords, are stored only in Windows Credential Manager on your PC, never in files and never sent to us.

Google Calendar

If you choose to add a Google account, GridYear asks Google for permission to:

• See your email address (openid, email), to label the account in GridYear’s sidebar.
• See, edit, share and permanently delete the calendars you can access (https://www.googleapis.com/auth/calendar), so GridYear can list your calendars, show their events, and create, change or delete events when you ask it to.

GridYear uses this Google user data only to show your calendars and events inside the app and to make the changes you make in the app, such as adding, editing or deleting an event. The data goes only between your PC and Google. It is stored only on your PC, as described above. We do not receive it, store it, sell it, share it with anyone, use it for advertising, or use it to develop, improve or train generalized or non-personalized AI or machine learning models. No person at StandFast Studios reads it.

GridYear’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect Google at any time by removing the account in GridYear (Settings → Accounts), which deletes its calendar copy and token from your PC, and by revoking GridYear’s access at myaccount.google.com/connections.

Outlook and iCloud

For an Outlook.com or Microsoft 365 account, GridYear asks Microsoft for permission to sign you in, read your basic profile (to label the account), keep you signed in, and read and write your calendars (openid, email, offline_access, User.Read, Calendars.ReadWrite). You can revoke it at account.live.com/consent/Manage, or for work accounts through your organization.

For iCloud, GridYear connects to Apple’s calendar server with your Apple ID and an app-specific password that you create at account.apple.com. You can revoke that password there at any time.

The same rules apply as for Google: this data travels only between your PC and Microsoft or Apple, is used only to show and change your calendars in GridYear, and is never sent to us, sold, shared, or used for advertising or AI training.

License checks from the app

When you activate a license, and every few days afterward when you are online, GridYear contacts our license server. It sends your license key, a random installation identifier created when you first open the app, the app version, and your operating system. We store, for each activated computer, a label such as “GridYear · Windows · a1b2c3” made from those details, plus when it was activated and last checked in. The app does not send your computer’s name, your user name, any hardware identifier, or any calendar data. Your IP address reaches the server with each request; it is used to limit abuse and may appear in server logs. During the free trial, GridYear does not contact the license server; the trial is tracked on your computer.

Updates

GridYear checks GitHub for updates shortly after it starts and every few hours, and downloads updates from GitHub. These requests include your IP address and the app version, and are handled under GitHub’s privacy statement.

Your account

Your GridYear account is created when you buy or receive a license. It holds your email address, your name if you gave one at checkout or one was given with a gift license, your license keys (stored encrypted), the computers using them, your orders, and your support tickets. It never holds your calendar data or your calendar sign-ins. You sign in with a one-time link sent to your email; links expire after 15 minutes. While you are signed in, we keep a record of the session, including the IP address and browser it was created from, so sign-ins can be secured and ended. We also keep a log of changes to licenses and orders, such as activations, refunds, and actions taken by our staff.

Purchases and payments

Payments are processed by Stripe. When you buy GridYear, you enter your payment details on Stripe’s checkout page; Stripe handles them under its privacy policy, and we never receive or store your full card number. Stripe also collects your billing address where it’s needed to calculate tax. We receive and keep your email address, name, the amount and tax charged, the payment status, any refund, and Stripe’s reference numbers. We use these to issue your license, provide invoices, process refunds, handle payment disputes, and keep the business and tax records the law requires.

Email

We send emails about your account: your license key, sign-in links, and support replies. They are delivered by Brevo, which processes your email address and the message content for delivery under its privacy policy. Brevo may record delivery and whether an email was opened or a link was clicked. Stripe may also email you a receipt or invoice for your payment. We do not send marketing email.

Support

When you open a support ticket, we keep the topic, your messages, our replies, and which license it relates to, as part of your account. Please leave out private information that is not needed for your request, and never send passwords, sign-in codes or full card details.

Website visits and cookies

Serving and securing this website involves processing technical request information such as IP addresses, requested URLs, browser information, and request times, which may be kept briefly in server logs. The download page asks GitHub for the latest release, and installers are downloaded from GitHub. This website sets one cookie, only when you sign in, to keep you signed in; it is necessary for your account to work. Stripe’s checkout page sets its own cookies on Stripe’s website. We do not use advertising cookies, trackers, or analytics scripts.

Who receives information

We use the information above to provide GridYear, your licenses, your account, and support; to protect the service from fraud and abuse; and to meet legal obligations. Where a legal basis is required, these uses rely on performing our contract with you, our legitimate interests in security and support, or legal obligations. Stripe (payments), Brevo (email), GitHub (downloads and updates), and our hosting and network providers handle information only for these purposes. Information may also be disclosed when legally required. We do not sell your personal information or use it for targeted advertising.

Retention and security

Calendar data and app data stay on your PC until you remove the account in GridYear or uninstall the app; removing the app may not remove all app data, and sign-in tokens can be removed by removing each account first. Account, license, and computer records are kept while your account exists. Order, invoice, and refund records are kept as long as tax and accounting laws require, which can be several years. Sign-in sessions end after 30 days. Our database is backed up nightly, and backups are kept for 14 days. License keys and sign-in secrets are stored encrypted or hashed, and admin access requires a second factor. No system can guarantee absolute security. Our service providers may process information outside your country under their applicable safeguards.

Your choices and rights

You choose which calendar accounts GridYear connects to and can remove them at any time. You can see your licenses, computers, orders, and tickets in your account, and remove computers there. Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of your personal information, to object to or restrict processing, and to complain to your local data protection authority. To make a request, open a support ticket or email us from your account’s address. If you ask us to delete your account, we delete it except for records we must keep by law, such as invoices, and its licenses stop working. For information held by Google, Microsoft, Apple, Stripe, Brevo, or GitHub, you can also contact them directly.

Children

GridYear and this website are not directed at children under 13, and we do not knowingly collect their personal information.

Changes

We will update this policy when our practices change and show the revision date here. Material changes will be communicated as required by law.