Privacy Policy

1. Information we collect

The information we collect depends on how you use Grail.

Account information

When you create or use an account, we may collect your email address, username or display name, profile image, account verification status and login or authentication information.

If you choose to sign in using Apple or Google, we may receive information those services make available to us as part of the authentication process.

Your real or full name is not intended to be displayed to ordinary Grail users unless you choose to include it in information you make public.

Profile and trading information

We collect information you provide when using Grail’s trading features. This may include your trade-binder items, want-list items, card and product details, photographs of items, trading preferences, favourite Pokémon or other preferences, trade offers, trade history, exchange methods, tracking or postage information and agreed meet-up locations.

Location information

Grail uses location information to help show relevant traders and items within your selected area.

During profile setup, Grail may access your device’s precise location to establish your location for discovery purposes. Precise GPS coordinates used for this process are not intended to be retained once the approximate operational location required by Grail has been derived.

Other users are not shown your precise GPS location. Grail may instead display an approximate location on a map and an approximate distance such as “5 km away”.

If you update your location, we do not intend to retain the previous location as a location-history record.

Mapping and location functionality may involve information being processed by services such as Google Maps.

Postal address

You may save a postal address to your Grail profile for postal trades. Your postal address is not publicly displayed.

If you and another trader choose Post as the exchange method, your postal address may be made available to that trader so the trade can be completed. The other trader may use that address only for the relevant trade.

Where reasonably necessary, postal and fulfilment information associated with a completed trade may be retained for a limited period to investigate delivery issues, reports, fraud or disputes.

Messages

We collect and store messages and images exchanged through Grail’s messaging system.

Messages are not public. Authorised members of the Grail team may access them where reasonably necessary to operate the Service, investigate reports or suspected fraud, protect users, provide support, enforce our Terms & Conditions, maintain security or comply with legal obligations.

We do not use private messages as advertising material merely because they have been sent through Grail.

Reports and moderation

If you report a user, listing or trade, or another user makes a report involving you, we may collect and retain information associated with that report. This may include the report reason, users involved, relevant trade, trade history, messages, item photographs, moderation notes, warnings or account restrictions and the outcome of the report.

We use this information to investigate issues, protect users, identify repeat misconduct and maintain the integrity of Grail.

Device and technical information

When you use Grail, we may automatically receive limited technical information required to operate and secure the Service. This may include device and operating-system information, app version, IP address, authentication and security information, notification tokens, diagnostic information and service logs.

We do not currently intend to use third-party advertising pixels or behavioural advertising cookies on the Grail website at launch. If materially different analytics or advertising technology is introduced in future, we will update this policy where required.

2. How we collect information

Most personal information is collected directly from you when you create an account, build your profile, upload items, communicate with another trader, make or receive offers, arrange a trade, contact support or report a problem.

We may also receive limited information from Apple or Google when you use those services to sign in, from your device where you give Grail permission to access location or send notifications, from other Grail users when they interact or trade with you, and from service providers involved in operating the Service.

3. How we use information

We use personal information where reasonably necessary to provide, operate, secure and support Grail.

This includes creating and securing accounts, verifying email addresses, maintaining profiles, operating trade binders and want lists, identifying cards and products, providing search and discovery, calculating approximate distance between traders, facilitating offers and messages, supporting postal and in-person trades, providing notifications, maintaining trade history, investigating reports and fraud, moderating users and content, providing support and protecting Grail from misuse or security threats.

We may also use information where reasonably necessary to comply with legal obligations or establish, exercise or defend legal claims.

Public content may also be used to promote Grail as described below.

4. Information visible to other users

Grail is a social trading platform, so some information you provide is intended to be visible to other users.

Depending on the feature, this may include your username, profile image, trade binder, want list, item photographs, trading preferences, approximate location or distance, activity indicators, trading activity and other profile information you choose to make available.

We do not intend to display your precise GPS coordinates or private postal address to ordinary users.

A postal address is disclosed to the other trader only when required for a postal trade.

5. Public trade-binder links

Grail may allow you to create a link that enables people to view your trade binder without signing into Grail.

Anyone who obtains the link may be able to view the information presented on that page.

Public binder pages are intended to be shared by link rather than used as public search profiles. We may use technical measures intended to discourage search engines from indexing those pages.

However, we cannot guarantee that another person, search engine or third-party website will not copy, share, retain or index information that has been made publicly accessible.

You should treat information displayed through a public trade-binder link as public information.

Deleting your Grail account will remove the associated binder from active public display, subject to reasonable processing time. We cannot remove copies independently saved or republished by other people.

6. Public content and marketing

We may use content you have made public on Grail to promote the Service.

This may include publicly displayed card photographs, binder content, usernames or profile images used on the Grail website, social media or other promotional material.

We will not use your private messages, postal address or other private account information for marketing merely because we hold that information.

Our rights to use user content are also explained in our Terms & Conditions.

7. Who we disclose information to

We do not sell personal information to advertisers or data brokers.

We may disclose information to other users where necessary for the feature you are using. For example, profile and binder information may be visible to other Grail users, and a postal address may be disclosed to the other participant after Post is selected as the exchange method.

We also use third-party service providers to operate Grail. These may include Amazon Web Services for cloud infrastructure and hosting, Google Maps for mapping and location functionality, Firebase and related Google services for app infrastructure, authentication, notifications, diagnostics or security where enabled, and Apple or Google for sign-in where selected by the user.

We may disclose personal information where reasonably necessary to comply with law, respond to a lawful government or court request, investigate suspected fraud or unlawful conduct, protect a person from a serious safety threat, enforce our Terms & Conditions or establish, exercise or defend legal rights.

If Grail or Munchkin Digital is involved in a genuine merger, acquisition, restructure, investment or sale of all or part of the business, relevant information may also be disclosed to professional advisers and potential or actual counterparties where reasonably necessary and subject to appropriate confidentiality arrangements.

8. Where information is stored and processed

Grail’s primary application infrastructure is intended to be hosted using Amazon Web Services in the Sydney, Australia region.

Some technology providers operate internationally, so particular information may also be processed outside Australia.

Google and Firebase services, for example, use international infrastructure and some services may process information in the United States or other countries.

Where required by applicable Australian privacy law, we will take reasonable steps in relation to personal information disclosed to overseas recipients.

9. How long we keep information

We do not intend to retain personal information longer than reasonably necessary.

Precise GPS information used to establish your location is intended to be discarded once the approximate operational location needed by Grail has been derived.

When you replace your profile location, the previous location is not intended to be retained as a location-history record.

Active account and profile information is generally retained while you maintain an account.

Completed trade records, associated messages and relevant moderation information may generally be retained for up to 24 months after a trade closes.

This allows Grail a reasonable period to investigate delayed reports, patterns of fraudulent behaviour, account-safety issues and disputes.

Information may be retained for longer where an investigation, report or dispute remains open, fraud or serious misconduct is being investigated, the information is needed to protect another user, a legal obligation requires retention, or the information is reasonably required for a legal claim.

After the applicable retention period, information will be deleted or de-identified where it is no longer reasonably required.

Backups may take additional time to cycle out of protected backup systems.

10. Account deletion

You can request deletion of your account through Grail’s in-app account-deletion functionality or by contacting admin@tradeongrail.com.

When an account is deleted, its profile and trade binder will be removed from active display.

Deletion does not necessarily result in the immediate destruction of every record associated with the account.

We may retain limited information where reasonably necessary for completed trades, outstanding reports or disputes, fraud prevention, platform safety, enforcement history, security, legal obligations or legal claims.

Where retained information is no longer reasonably required, it will be deleted or de-identified in accordance with our retention practices.

11. Users aged 16 and 17

You must be at least 16 years old to use Grail.

If you are under 18, our Terms require you to have permission from a parent or legal guardian before using the Service.

Grail is not intended for children under 16.

If we become aware that an account belongs to a person under 16, we may disable the account and delete personal information associated with it, except where information needs to be retained for safety, legal or other legitimate reasons.

Because Grail permits users aged 16 and 17, we will take the privacy interests of younger users into account when designing and operating relevant features and will review our practices as applicable Australian requirements develop.

12. Notifications and marketing

Grail may send service communications reasonably necessary to operate your account and trades.

These may include account and security notices, trade offers, messages, trade updates, postal or meet-up information, moderation outcomes and important service announcements.

Some essential service communications may remain enabled while you maintain an active account.

Marketing communications are treated separately.

Where required, we will obtain appropriate consent before sending promotional email or SMS marketing and will provide a way to unsubscribe.

Marketing push notifications may also be disabled through settings made available by Grail or your device without preventing necessary account, security or transactional communications.

13. Security

We take reasonable steps to protect personal information against misuse, interference, loss, unauthorised access, modification and disclosure.

Security measures may include access controls, authentication controls, restricted administrative access, secure cloud infrastructure, encryption and monitoring appropriate to the nature of the information.

No online service can guarantee absolute security.

You are responsible for protecting your account credentials and should contact us promptly if you believe another person has gained unauthorised access to your account.

14. Access and correction

You can update some account information directly through Grail.

You may also ask us to provide access to personal information we hold about you or to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading.

Requests can be sent to admin@tradeongrail.com.

We may need to verify your identity before providing access to personal information.

We will respond within a reasonable period and may refuse access in limited circumstances where permitted or required by law.

Where appropriate, we will explain the basis for that decision.

15. Privacy complaints

If you believe we have mishandled your personal information, please contact us at admin@tradeongrail.com.

Please provide enough information for us to understand the issue and investigate it.

We will review the complaint and respond within a reasonable period.

If your complaint concerns conduct covered by the Privacy Act and you are not satisfied with our response, you may have the right to raise the matter with the Office of the Australian Information Commissioner.

16. Third-party services

Grail may contain links to or integrate with services operated by third parties.

Those organisations are responsible for their own privacy practices. This Privacy Policy does not govern information you provide directly to another organisation outside Grail.

Where you use Apple, Google, a postal provider, card-data provider or another third-party service, you should review that provider’s privacy information where relevant.

17. Changes to this policy

We may update this Privacy Policy as Grail develops, our technology changes or legal requirements change.

The current version will be published on our website with the date of the most recent update.

If we make a material change that significantly affects how we handle existing users’ personal information, we will provide reasonable notice where appropriate.

18. Contact

Munchkin Digital Pty Ltd

ABN 62 697 867 824

ACN 697 867 824

admin@tradeongrail.com