What Grilled Cheese collects, why we collect it, who else sees it, and what you can do about it. Effective 17 October 2026.
Grilled Cheese is operated by 186282 Inc., trading as Village Compute. Questions go to [email protected].
The short version
-
Your account holds one email address, and a phone number if you choose to add one. Your identities hold your public presence.
-
We do not sell your personal information, and we do not track you across other apps and websites.
-
If an identity federates, its public posts and profile go to other servers we do not control. That is what federation is, and you can turn it off.
-
Conversations are private and travel over encrypted connections, but by default they are not end-to-end encrypted, so our servers can read them. Secure Conversations, which you can turn on in Settings, are end-to-end encrypted, and we cannot read those. See Direct messages.
What we collect
You give us
- Account information
-
Your date of birth, which we ask for on the first screen and which is described under Confirming your age below. An email address. A phone number, if you add one, used to sign in, to recover your account, and for security. A password, stored hashed and never in readable form. Two-factor authentication settings, if you turn them on. Where you enter your name or postal address, we store it encrypted.
- Identity information
-
For each identity: handle, display name, avatar, banner, bio, profile links, and an optional birthday (month and day only, never the year).
- Content
-
Posts, replies, photos, video, polls, and any place you choose to attach to them.
- Payment information
-
If you subscribe to Premium, we store which plan you bought, where you bought it, the price and currency, the store or processor’s identifier for the purchase, and the dates the subscription runs between. We never receive your card number.
- Support correspondence
-
What you write to us, and what we write back.
We collect as you use it
- Activity
-
Who you follow, what you like, repost, bookmark, and report. This is the social graph and the interactions that make the feeds work.
- Searches
-
When you run a live search, the kind that keeps running and shows new posts as they arrive, we keep a record of it on your account. That record holds the term you searched for, when the search started, when it ended, and which plan your account was on at the time. It is what lets the app offer your recent searches back to you as suggestions. You can remove a single term or clear the whole history in the app, and How long we keep it explains what clearing does. Separately from that, we count how often each term is searched across Grilled Cheese. Those counts are never attached to an account.
- Device and log data
-
Your IP address, the type of device and app you use, app and operating-system version, and timestamps. We use these to keep sessions working, to show you your signed-in devices, and to detect abuse. When you allow notifications, the app also sends your device’s time zone, so that notifications can follow your local time.
- Diagnostics
-
Crash reports and error traces, with personal identifiers such as your email, phone number, and session tokens removed before they leave your device, so we can fix what breaks.
- Location from your device
-
Only if you grant it, and only for the features that use it: attaching a place to a post, and finding posts near you. It is off by default, used only in the foreground and one reading at a time, never in the background. When you attach a place you choose how precise it is (exact, neighbourhood, or city) and can delay it so it reads "I was here", not "I am here". You can revoke the permission at any time, in Grilled Cheese’s settings or your device’s.
- Approximate location from your IP address
-
Separately from the above, and without any permission to grant, your IP address indicates roughly where you are connecting from, at about the level of a city or region. We may use that to keep the service safe: to spot an account being used from somewhere it has never been used before, to find networks that abuse is coming from, and to enforce a suspension against someone making new accounts. We may also use it to choose sensible defaults where you have not given us a device reading. It is never attached to a post, and it is not precise enough to be.
- Age
-
The age range your app store shares with us, and the related answers described under Confirming your age.
We do not collect
We cannot read messages in Secure Conversations, which are end-to-end encrypted. We do not read your device’s address book, and the app never asks for your contacts. We do not track you across other apps and websites, there is no advertising or cross-app tracking technology in Grilled Cheese, and we do not sell your personal information.
We do not guess where a post was made. The place attached to a post comes only from the device reading you chose to attach, never from your IP address, so a post carries a location only when you put one on it. Photos are stripped of their embedded location (GPS) metadata on your device, before they are uploaded, unless you turn on Keep location data on photos yourself.
Using your IP address to work out roughly where you are is not the same as tracking you across other apps and websites, which we do not do.
Why we use it, and on what basis
| Purpose | What it uses | Legal basis (UK/EU) |
|---|---|---|
Running the service: delivering posts, feeds, notifications |
Account, identity, content, activity |
Performance of a contract |
Keeping accounts secure: sessions, 2FA, abuse detection |
Account, device and log data, approximate location from IP |
Legitimate interests; legal obligation |
Keeping the service safe: automated and human moderation |
Content, activity, reports |
Legitimate interests; legal obligation |
Confirming you are old enough to use Grilled Cheese |
Date of birth |
Legal obligation; legitimate interests |
Deciding whether you can see recommended feeds |
App-store age range, date of birth |
Legal obligation; legitimate interests |
Holding notifications overnight and during school hours |
App-store age range, date of birth, device time zone |
Legal obligation; legitimate interests |
Deciding whether you can see adult content |
Date of birth, app-store age range |
Legal obligation; legitimate interests |
Extra protections where age-assurance laws apply |
App-store age range, age-law region, parental-consent status, activity |
Legal obligation; legitimate interests |
Reporting how many accounts fall in each age group, as counts only |
Date of birth, app-store age range, age-law region |
Legal obligation; legitimate interests |
Fixing what breaks |
Diagnostics, device data |
Legitimate interests |
Confirming your age
Your date of birth
The first screen asks for your date of birth, before you have an account, and law requires us to ask. The year is always required. The month and day are required only when the year alone cannot settle whether you are 18, which is to say when you turn 18 this year; otherwise they are optional.
We keep what you give us, attached to your account, along with the date you gave it. We do not keep only a yes-or-no: the date itself is stored, which is what lets us re-check the answer rather than trust a flag, and it is included in the data export you can generate for yourself. When you give the full date, we also keep it encrypted. The month and day stay readable alongside it, so that we can recognise your birthday without reading the year.
This is separate from the birthday on an identity profile, which is a public, optional, month-and-day-only field, described above. One is an age check on your account and is never published; the other is something you choose to show people.
Your app store’s age range
The app asks your app store for an age signal: Apple’s Declared Age Range on iPhone, iPad and Mac, and Google Play’s Age Signals on Android. Whether the store shares it is up to you and the store’s own settings, and Apple asks you first. The store tells us only an age range, such as "18 or over" or "13 to 15". It never gives us your date of birth, and we never receive an ID document or a photo from it.
We keep one record of it per account, and a newer answer replaces the older one. The record holds:
-
which store answered;
-
the age range, and the age group we place it in;
-
when we received it;
-
whether the store says you are in a region where age-assurance laws apply. That answer comes from the region of your app store account, not from where you physically are, so it does not change when you travel. If you use Grilled Cheese on more than one device, a "yes" from any of them counts, and it stays until no device has said "yes" for 30 days;
-
the status of a parent’s consent, where the store reports one. Google Play reports it for supervised accounts. Apple does not report one.
A record from one device applies to your account everywhere you sign in, including on the web.
What we use them for
- Recommended feeds
-
Some feeds, such as For You, choose and order posts for you instead of showing them in time order. California’s SB 976 and New York’s SAFE for Kids Act allow feeds like these only for people determined to be adults. We show them to you only once your app store has told us you are 18 or over. Until then, and always if the date of birth you entered is under 18, those feeds show posts in time order instead.
- Notification timing
-
Unless your app store has told us you are 18 or over, we hold push notifications between midnight and 6 a.m., and between 8 a.m. and 3 p.m. on weekdays from September through May, and send them when that time ends. The times are your local time, taken from your device’s time zone. Security and sign-in notices are never held, and every notification is still in the app as soon as it happens.
- Adult content
-
Whether you can see posts labelled as adult content is decided by the date of birth you entered. If your app store says you are under 18, you cannot see that content, whatever date you entered. Outside the regions described next, a store answer of 18 or over does not by itself open adult content.
- Where age-assurance laws apply
-
If your app store says you are in such a region, stricter rules apply. Recommended feeds and adult content need an answer of 18 or over from your app store, whatever else we know. Adults you do not follow cannot start a new conversation with you unless your app store has told us you are 18 or over; conversations that already exist are not affected. If the store reports that a parent’s consent is pending or was refused, we treat the account as a minor’s: feeds in time order, notifications held, and no adult content.
- A yearly count
-
Once a year we count how many active accounts fall in each age group, by date of birth, app-store answer and region, to meet our legal obligations. The report holds only counts. It never names or identifies an account.
We do not use your date of birth or your app store’s answers for advertising, and we do not share them with anyone else.
How long we keep them
Your date of birth and your app store’s record are kept while your account exists. Each new answer from your app store replaces the one before. They are not copied into the history we keep of other changes to your account, so when your account is purged, 30 days after you delete it, they are deleted with it.
Automated content checks
To catch content that breaks the rules, such as material that sexually exploits a minor, incites violence, harasses, or is spam, posts are checked automatically when they are created. This check sends the post’s text and any images to a third-party AI classification service, which returns safety signals. It does not receive your account details. Automated actions can be appealed, and a human reviews reports. See the Terms & Conditions for what is and is not allowed.
Who else sees it
Other users. Your public profile and public posts. Which parts of your profile are public is under Settings → Privacy.
Other servers, through federation. If an identity federates, its public posts and profile are transmitted to ActivityPub and ATProto servers run by other people. Those servers keep their own copies under their own policies. We send a deletion request when you delete something, and most honour it, but we cannot compel any of them. Settings → Sharing across networks controls how far each identity reaches, including turning federation off entirely.
Service providers. We use the following third parties, who act on our instructions and may only use the data to provide their service to us:
| Provider | What they do for us |
|---|---|
Cloudflare, Inc. |
Cloud hosting and infrastructure; storage of media and files you upload; content delivery; and delivery of transactional email (sign-in codes, password resets, data-export links). |
Sentry (Functional Software, Inc.) |
Crash and error diagnostics, from the scrubbed reports described above. |
AI content-classification provider |
The automated content check described above (post text and images only). |
SMS provider |
Delivering one-time codes when you add or verify a phone number. |
Apple Inc. / Google LLC |
Taking payment for a Premium subscription bought in the app, and telling us whether it is active. They hold the payment details; we get the purchase identifier and its status. |
Stripe, Inc. |
Taking payment for a Premium subscription bought on the web, and card processing for it. Stripe holds the card details; we get the customer and subscription identifiers and the status. |
Legal. We disclose information where the law requires it, or where it is necessary to protect someone’s safety. Where we may lawfully tell you about such a request, we will.
A business transfer. If Village Compute is acquired or merged, information may transfer as part of it. We will tell you before your information becomes subject to a different policy.
Direct messages
Grilled Cheese has two kinds of conversation. Ordinary Conversations are the default. Secure Conversations are end-to-end encrypted, and are off until you turn them on.
Conversations
Conversations are private: only the people in a conversation can see it in the app. Messages travel between your device and our servers over encrypted connections.
They are not end-to-end encrypted. We store the messages on our servers, so that a conversation follows your account and is there on every device you sign in on. That means our servers can read them.
A conversation with someone on another network, through federation, is always an ordinary conversation. It also passes through the other person’s server, and the people who run that server can read it too.
Secure Conversations
Secure Conversations are end-to-end encrypted, using the Messaging Layer Security standard (RFC 9420). They are a beta, and they are off by default. You turn them on under Settings → Privacy → Secure Conversations, and both people have to have turned them on. They are available only between Grilled Cheese accounts.
For a secure conversation we carry ciphertext and the metadata needed to route it: who is in the conversation, when messages moved, and how large they are. We cannot read the contents.
The keys live on your devices, and that has consequences worth knowing:
-
A secure conversation belongs to the device it was started on. It does not follow your account to your other devices, and it is not backed up.
-
We cannot recover your message history. A new phone cannot open the secure conversations you already had.
-
A message sent before a device had its keys cannot be decrypted on it afterwards.
-
Messages in a secure conversation are removed after 30 days, from your device and from our servers.
Cookies and storage on your device
Both Grilled Cheese apps keep small amounts of information on your device. On the web that means cookies; in the mobile app it means the operating system’s secure store and its app preferences. They do the same jobs, so they are listed together.
None of it is advertising, and none of it is shared with anyone else. There are no third-party cookies, no advertising or measurement SDKs, and no advertising identifier is read on any platform.
On the web
Every cookie below is set by Grilled Cheese itself, and all of them are necessary for the site to work or hold a preference you set.
| Name | What it is for | How long |
|---|---|---|
|
Keeps you signed in. It carries the session itself, so it is |
Until you sign out |
|
Holds a half-finished sign-in while you enter a second factor. |
Minutes, then replaced or discarded |
|
Remembers a device you told us to trust, so it can skip the second factor. |
Until you forget the device |
|
The light or dark choice you made, so the first paint matches it. |
Until you change it |
|
The language you chose. |
Until you change it |
|
Access to a preview build during private testing. |
The testing period |
In the mobile app
There are no cookies. The equivalents are:
- The operating system’s secure store
-
Your session, and, so the app can offer them back to you, your email address and phone number. On iOS this is the Keychain and on Android the Keystore, both encrypted by the system. Also the token for a device you told us to trust for two-factor sign-in.
- App preferences
-
The device-local settings described under Settings: appearance, text size, feed mode, whether links open in the app, and the like. These never leave the device.
- Caches
-
Downloaded photos and video, so they do not have to be fetched twice. Clearable at any time under Settings → Storage.
Signing out clears the session; deleting the app clears all of it.
Why you are not asked to accept anything
The law that governs cookies is about storing or reading anything on your device, not about the word "cookie", so it covers the mobile equivalents too. It requires consent for storage that is not necessary, and exempts storage that is: signing you in, keeping you safe, and holding a preference you asked for.
Everything listed above is in the exempt category, which is why Grilled Cheese does not show a cookie banner. If that ever stops being true, we will ask before it does, rather than adding a banner afterwards.
How long we keep it
-
Account and identity information: while your account exists.
-
Content: until you delete it, or until you delete the identity or the account it belongs to.
-
Deleting your account: your account and its identities are deactivated immediately and permanently purged after 30 days. A handle is then retired and never reissued.
-
Search history: while your account exists, unless you clear it first. When you remove a term, clear the whole history, or delete your account, we delete the link between those search records and your account. That is permanent and we cannot put it back, so those searches can never be shown to you again. The records themselves are kept, with nothing left to connect them to you, and we use them to understand how Grilled Cheese is used. The counts of how often each term is searched are never attached to an account in the first place, and we keep those as well.
-
Age information: your date of birth and your app store’s age record, while your account exists. A newer answer from the store replaces the older one, and both are deleted when your account is purged.
-
Inactive accounts: an account left unused is deactivated after 12 months.
-
Data-export files: the export we generate for you is available for 7 days and then deleted. Each download link is valid for 15 minutes.
-
Log and device data: a limited period for security and abuse investigation.
-
Conversations: until you delete them. Deleting a conversation removes it from your account. The other people in it keep their copies until they delete them too.
-
Secure Conversations: removed from your device and from our servers after 30 days.
-
Deleted content: removed from the service on deletion. Backups age out on a rolling schedule.
-
Purchase records: kept for as long as tax and accounting law requires, which is longer than the subscription lasts and outlives the deletion of the account it belonged to. What is kept is the record of the transaction, not your card details, which we never had.
-
Moderation records: kept while needed to enforce standing. A strike expires after one year, and we keep the minimum needed after an account is deleted to enforce a suspension.
Your rights
Wherever you live, you can:
-
see and export your data. Settings → Account generates a downloadable export.
-
correct what is wrong.
-
delete an identity, or your whole account, from Settings → Account.
-
clear your search history, one term at a time or all of it at once, in the app.
-
turn federation off for an identity, under Settings → Sharing across networks.
-
control what is public, under Settings → Privacy.
If you are in the UK or EU you also have rights to restrict or object to processing, to data portability, and to complain to your data protection authority. If you are in California you have the rights described by the CCPA, including the right not to be discriminated against for exercising them, and we do not sell personal information.
To exercise any of these, use the app where it offers the control, or write to [email protected]. We respond within 30 days.
International transfers
Grilled Cheese is operated from the United States, and your information is processed there. Where we transfer personal data out of the UK or EEA we rely on the UK/EU standard contractual clauses.
Children
Grilled Cheese is for adults. You must be at least 18 to create an account, and we do not knowingly collect information from anyone younger. If you believe a minor has given us personal information, write to [email protected] and we will delete it.
Changes
We will post any change here and update the effective date. Where a change is material we will give notice in the app or by email before it takes effect. As Grilled Cheese adds features, including ones held back at launch, we will describe the data they involve here before they become available to you.
Contact
186282 Inc., trading as Village Compute
[email protected]