Effective 27 October 2026
Privacy policy
Who is responsible: Salah Eddine Eddamouh, operating Grumbl, reachable at hello@grumbl.si (full details on the contact page). We are the controller of the personal data described here under the GDPR.
Part A. If you use Grumbl
What we collect
- Account: email address, display name, password (stored as an Argon2 hash), the time you signed up, the time your email was confirmed.
- Scans: the keywords, markets, sources and depth you choose, and the reports produced. Reports are private to your account, with one exception below.
- Credits and payments: your credit balance and purchase history. Card details go to Stripe; we never see the card number.
- Technical: server logs with your IP address and browser type, used for security and debugging and overwritten automatically as new logs come in.
Why, and on what legal basis
- To run your account and scans: performance of our contract with you (Art. 6(1)(b)).
- To send you verification codes, password-reset codes and receipts: the same.
- To keep the service secure and fix bugs: our legitimate interest (Art. 6(1)(f)).
- To send product updates: only if you ticked the box, and you can untick it any time (Art. 6(1)(a)).
Report reuse
If someone runs a scan with exactly the same keywords, markets, sources and depth within 7 days, they get the same report at half the credits. The report contains public posts and AI summaries, never anything about you or your account.
Cookies
Grumbl sets two cookies, both for your login session: pm_refresh (HttpOnly, so scripts cannot read it) and pm_session (a flag that tells the site you are logged in). There are no analytics or advertising cookies and no third-party trackers on this site.
How long we keep it
| Account data | Until you ask us to delete your account; we delete it within 30 days. |
| Scans and reports | Until your account is deleted. |
| Purchase records | As long as tax law requires (up to 10 years). |
| Server logs | Rotated automatically; older entries are overwritten. |
Your rights
You can ask for a copy of your data, correct it, delete it, or object to how we use it. Email hello@grumbl.si with the subject “Grumbl privacy request”; we answer within 30 days. You can also complain to the data-protection authority in your country.
Part B. If you posted something publicly that Grumbl collected
Grumbl collects posts, comments and reviews that were published publicly on Reddit, the App Store, Google Play, YouTube, TikTok and Instagram, to find problems that people want solved. If you wrote one of those posts, this section is the notice that Article 14 of the GDPR asks us to give you. We cannot contact each author individually, because the platforms do not give us a way to and doing so would itself be an intrusion, so we publish the notice here.
What we collect about a post
- The text of the post, comment or review, and its language.
- When it was published and where (subreddit, app, video).
- Public counts: upvotes, likes, star rating.
- A hash of the author’s username, computed with a secret key. It lets us count how many different people describe the same problem. It cannot be turned back into the username, and we do not store the username itself, a profile, or anything from a private account.
Why, and on what legal basis
Our legitimate interest (Art. 6(1)(f)) in helping people build things that others have publicly asked for. The safeguards that we rely on for that balance: we only read what was public; we hash author identities on arrival; reports show quotes with a link to the original, not profiles of people; our terms forbid users from re-identifying or contacting authors; and you can object below.
Who sees a post
Grumbl users who run a scan on that topic see the quote, its date, its source and a link to the original. Posts are processed by the AI providers listed under “Who helps us”, which do not use them to train their models (Anthropic does not train on API data; Google does not use paid-tier Gemini API data to improve its products).
How long we keep a post
For as long as it is useful for reports, unless you object, the platform removes it, or the platform’s rules require shorter storage.
To object or have a post removed
Email hello@grumbl.si with the subject “Grumbl privacy request” and the link to your post. We remove it from Grumbl within 30 days and confirm by email. You do not have to say why.
Who helps us
| Provider | What for | Company |
|---|---|---|
| Hostinger | Hosting of the application and database (United States); outgoing email | Hostinger International Ltd. |
| Apify | Runs the collectors for Reddit, TikTok and Instagram | Apify Technologies s.r.o., Czech Republic |
| Gemini API for extracting and summarising complaints; YouTube Data API for comments; Google Play | Google LLC, United States | |
| Anthropic | Claude API for writing opportunity briefs, when enabled | Anthropic PBC, United States |
| Apple | iTunes Search API for app discovery and App Store reviews | Apple Inc., United States |
| Stripe | Card payments for credit packs, once checkout opens | Stripe Payments Europe Ltd., Ireland |
Several of these providers are in the United States, and the application itself is hosted in the United States. Transfers of personal data there rely on the EU-US Data Privacy Framework where the provider is certified and on the European Commission’s standard contractual clauses otherwise.
YouTube
Grumbl uses YouTube API Services to collect public comments. By using Grumbl you agree to the YouTube Terms of Service. Google’s handling of data is described in the Google Privacy Policy. You can manage what Google holds about you at Google security settings.
Changes
This policy took effect on 27 October 2026. When it changes we update the date here and, for changes that affect account holders, email you first.