Cookie Policy

At a glance

• We set a few cookies to run the site. They keep you signed in, keep forms and payments safe, and remember settings. We set these without asking, because the site cannot work without them.
• We count visits with Google Analytics. It does not run if you opt out, if your browser sends Global Privacy Control, or if you are signed in to an account that opted out. In the European Economic Area, the United Kingdom and Switzerland it runs only after you press Accept.
• One cookie, gd_attr, remembers the link or ad that brought you here. Section 6 says exactly what it holds and where it goes. In the European Economic Area, the United Kingdom and Switzerland it is set only after you press Accept.
• No advertising partner's cookies or pixels run on Grailday today. Google Analytics counts visits, with Google's advertising features turned off.
• We do not sell your personal information. We use no session replay, no social-media plug-ins and no tracking pixels in our emails.
• To opt out, use Do Not Sell or Share My Personal Information, or turn on Global Privacy Control in your browser. Section 12 explains both.
• Every cookie and browser-storage entry we know of is listed in section 5. The tables come from the site's own list, so they match what the site sets.

1. About this policy

1.1 Who we are. This policy covers Grailday at grailday.com (our "site"). Grailday, 30 N Gould St #54815, Sheridan, WY 82801, USA. "We" and "us" mean Grailday.

1.2 What it covers. Every page of the site: packs, the Market, your Vault, your Balance, shipping, your account, the sign-in box, the checkout box and the policy pages. It covers cookies and the similar technologies that section 2 explains.

1.3 What it does not cover. Other companies' own sites and pages that you reach from ours, such as your bank's page or the payment processor's own payment page. Section 14 says more.

1.4 Our staff. Our staff use an internal console that players never see. It sets its own sign-in cookies for staff, and it keeps a few saved drafts in a staff member's browser storage. Players never receive any of this, so it is not in the lists below.

1.5 How this policy fits with the Privacy Policy. This policy explains the technologies. The Privacy Policy explains what we do with personal information, including information we get through these technologies, and how to ask us for a copy, a correction or a deletion. If the two ever differ about personal information, the Privacy Policy controls. If they differ about which cookies we use, this policy controls.

1.6 No consent by use. We do not treat your use of the site as your agreement to anything beyond the cookies the site needs. Where you have a choice, section 12 shows how to use it.

2. What these words mean

• Cookie. A small text file that a website asks your browser to save. Your browser sends it back to that website each time you load one of its pages.
• Session cookie. A cookie your browser erases when you close it.
• Persistent cookie. A cookie that stays after you close your browser, until its end date or until you delete it.
• First-party cookie. A cookie set on the website you are visiting. Ours are first-party.
• Third-party cookie. A cookie set on another company's domain, usually by something that company put on the page. Some of our providers' scripts set cookies under our own domain. Your browser shows those as ours, so we list them in their own table (section 5.2) and say who sets them.
• Browser storage. Two places a page can keep small settings in your browser. localStorage stays until you clear it. sessionStorage ends when you close the tab. Unlike cookies, they are not sent to our servers with every page. Our page scripts read them in your browser.
• Pixel or beacon. A tiny image or script that tells a server a page or an email was opened.
• Campaign tags and ad click IDs. Extra parts of a web address that say which link or ad you used. Campaign tags start with utm_ (for example utm_source). Ad click IDs are long codes that ad platforms add to a link (for example gclid, fbclid, ttclid, msclkid, gbraid and wbraid).
• Similar technologies. When we say "cookies and similar technologies," we mean all of the above.
• The European regions. When this policy says "the European Economic Area, the United Kingdom and Switzerland," it also means Guernsey, Jersey and the Isle of Man. Where a rule in this policy depends on where you are and we cannot tell where you are, we apply the rule for these regions.

3. Why we use them

• To keep you signed in and keep your account safe.
• To stop other websites from sending forms or payments in your name.
• To spot fraud and bots, especially around card payments.
• To send you back to the right page after you add money.
• To remember settings, such as a banner you closed or whether you want sound.
• To count visits and see which pages people use.
• To learn which of our links and ads bring people here.
• To measure how fast our pages load.

4. The kinds we use, and what you can switch off

Our payment processor's fraud checks run for every visitor, including visitors in the European regions, and no prompt comes first. We treat them as needed because they protect card payments. If you do not want them, you can block the processor's script in your browser. Section 12.9 says what happens then.

The menu's copy of your signed-in state and Balance is in the second row, not the first. It spares the menu a flicker. The site works without it.

5. The full list

Every cookie and browser-storage entry we know of is below. The tables come from the site's own list of cookies and storage entries, the same list the Privacy Policy reads, so they match what the site sets. Each row gives the name, what it does and how long it lasts. A cookie that lasts until you close your browser is a session cookie. The others are persistent, and the row gives their length.

We send every cookie in 5.1 only over an encrypted connection. None of our own cookies follows you to other websites. Scripts on the page cannot read our cookies, except the three our own scripts need: the safety value that goes with a payment, the creator link and your answer on the cookie prompt.

5.1 Cookies we set

We set these ourselves. The tables group them by what they do: cookies the site needs, cookies that remember a choice, and the cookie that remembers where you came from. The cookie that holds your answer on the cookie prompt is set only if you are in the European regions, or if we cannot tell where you are.

Cookies the site needs

Cookies that remember a choice

The cookie that remembers where you came from

5.2 Cookies set by our providers under our domain

Some of our providers' scripts set cookies under our own domain, so your browser shows them as ours. They are Google Analytics' cookies (they count visits), our payment processor's cookies (fraud and security) and our sign-in provider's cookies (they keep your sign-in with the provider). We do not read them. Section 9 says more about the payment processor and the sign-in provider. The sign-in provider chooses how long its cookies last.

Analytics

Cookies from our providers

5.3 Browser storage

These stay in your browser. Our page scripts read them there. They are not sent to our servers with every page.

One row describes its entries by what they do, not by their exact key name: the setting that remembers a pack has already opened in this browser. If you want the exact name, ask us through the contact form.

Our sign-in provider also keeps entries of its own in your browser's storage while you sign in. It chooses their names, and we do not read them.

5.4 Technology that sets no cookie

The visit counter in section 8 sets no cookie and writes nothing to browser storage. It is listed here so you do not look for it in the tables.

When a signed-out visitor opens a page of ours by its address (not from a tagged link, another website or a referral link), our servers and our network provider set no cookie, except on the contact form and the choices page, which each set one safety cookie. Checked on October 16, 2026 against the public pages, including the home page, the pack list, the Market and the sign-in page. The cookie prompt writes its cookie only when you press Accept or Reject. The payment processor's script and Google Analytics set theirs once the page has loaded.

Our network provider also sends your browser a standard header that says where to send a short error report if a connection to our site fails. Your browser keeps that instruction. It sends nothing when a connection works.

5.5 This list can change

Our providers can change their cookies without any change on our side. We update this list in the same release as any change we make. If you find a cookie or a storage entry on grailday.com that is not here, tell us through the contact form and we will check it.

Today we know of no cookie or storage entry set by our own code that this list leaves out. Our sign-in provider's entries are the one place where the list may be less exact (section 9.2).

See them yourself. In most desktop browsers, press F12, open the Application tab (Chrome and Edge) or the Storage tab (Firefox), and look under Cookies, Local Storage and Session Storage. In Safari, turn on the Develop menu first.

6. The cookie that remembers where you came from

6.1 What it is. gd_attr is a cookie only we read. It lets us see which of our links and ads bring people to Grailday.

6.2 When we set it. We set it when you open a page of ours from a link or ad that carries campaign tags or an ad click ID. We also set it on your first visit if you arrive from another website.

6.3 What is in it. For your first such visit and your latest one:

• the campaign tags in the link (source, medium, campaign, term and content);
• any ad click ID in the link;
• the first page you opened on our site;
• the name of the website you came from, and only its name, not the page address; and
• the time.

It holds nothing about what you do after that, and no name, email address or other detail about you.

6.4 What happens at sign-up. When you sign up, we copy what the cookie holds into your account record. We also save the IP address and the browser details (the "user agent") of the browser you signed up with, and whether you had opted out. Inside our own systems we note five moments against that record, with the amount where one applies: sign-up, adding money, your first pack, a sell-back and a shipment. We use the record to learn which links and ads lead to sign-ups and later actions. We keep the IP address and browser details from sign-up for 13 months, then remove them. We keep the rest of the record with your account records, while your account is open and for 5 years after it closes.

6.5 Where it goes. Today we send this record to no advertising company. Google Analytics sees the campaign tags and Google's own ad click IDs in the address of the page you open (section 7.2). It does not receive the record itself.

6.6 Opting out. Opting out stops Google Analytics. It does not stop this cookie from being set, and the record in 6.4 is still made. The opt-out is saved next to the record.

In the European Economic Area, the United Kingdom and Switzerland, we neither set this cookie nor use it at sign-up unless you have pressed Accept. If you press Reject after you pressed Accept, we stop using it, but your browser keeps the cookie until it ends or you delete it.

6.7 Blocking it. You can block or delete this cookie in your browser. Nothing on the site stops working.

7. Analytics

7.1 What we use. We use Google Analytics to count visits, to see which pages people use and to learn which of our ads and links bring people here. It sets the _ga and _ga_* cookies.

7.2 What Google receives. When a page with the tag loads, Google receives:

• the page you opened, as an address without its query part, except for campaign tags and Google's own ad click IDs;
• the page you came from (for a page on our site, only our site's address; for another website, its address without the query part);
• the link or ad that brought you;
• your browser and device details;
• your approximate location, worked out from your IP address; and
• a random ID kept in its cookies.

When you buy a pack, it also receives the pack's name and price, the amount you paid and a reference number for the order. It does not receive your name, your email address or your account ID. The tag has Google's advertising features turned off.

7.3 How Google uses it. Google uses what it collects as its own policy describes: How Google uses information from sites or apps that use our services.

7.4 When it does not run. Google Analytics is not added to the page:

• for a browser that sends Global Privacy Control;
• for a browser where you opted out on the choices page;
• while you are signed in to an account that opted out, in any browser;
• on the sign-in pages, on the privacy choices page, on the pages where you set limits, take a break or close your account, on the ID check pages and on the shipping pages;
• on staff pages and on pages a script requests for data;
• on a page you reach with the Back or Forward button, and on the return from signing in with Google; and
• on a reload and on a page that refreshes itself, except the page that follows a pack purchase, which reports the purchase.

It does run on other pages, including the account page, your Vault, the Balance pages and pack pages.

7.5 Where you are. In the European Economic Area, the United Kingdom and Switzerland, or when we cannot tell where you are, Google Analytics loads only after you press Accept. If you press Reject, it stays off and we delete any Google Analytics cookies your browser holds.

7.6 How long Google keeps it. Google Analytics keeps event-level data for 2 months, and then Google deletes it. Reports that add up many visits name no one and can stay longer.

7.7 Opting out. Use the choices page, send Global Privacy Control, or install Google's opt-out add-on for your browser. Section 12 explains each.

8. The visit counter

The service that runs our site adds a small visit counter to our pages. It measures how many visits a page gets and how fast pages load. It sets no cookie and writes nothing to your browser's storage. It reads page-timing numbers from your browser, the address of the page and the address of the page you came from. Your IP address reaches the provider with the request; the provider says it discards the address and does not store it.

It runs for every visitor, including visitors who opted out, because it stores nothing in your browser and we do not use it to follow individuals.

9. Payments, fraud checks and sign-in

9.1 Payments. Card payments go through our payment processor. We never see or store your full card number. The processor's script loads on nearly every player page, once the page has finished loading. It runs for every visitor, including visitors in the European regions, because it protects card payments (section 4). It does not load on staff pages or a few technical pages. On a reload, on the return from signing in with Google and on pages that refresh themselves, it waits until you open the card form. It collects signals about your device and how you use our pages, such as your browser, your screen and your mouse movement, to spot fraud and bots. It sets cookies under our own domain (section 5.2). Its hidden frame may also keep a cookie on the processor's own domain, which we cannot see.

The card form can also offer digital wallets and the processor's one-click service. If you use one of them, that service's own cookie notice applies. If you pay on the processor's own page, that page's own cookie notice applies too. To see it, ask us through the contact form and we will send it.

9.2 Sign-in. Our sign-in provider's code loads when you reach for a Log in or Sign up button, or when you come back from signing in with Google. It keeps your sign-in with the provider in your browser (section 5). We do not use those entries. When you finish signing in, our page sends the provider's sign-in proof to our servers in the request itself, and we check it. We do not take it from the cookies. When you choose Google to sign in, you leave our site for Google's and the provider's pages, and their cookie notices apply there. To see the provider's own notice, ask us through the contact form and we will send it.

9.3 Bot checks. The sign-in box can run an invisible check to tell people from bots. It runs inside the box, on the sign-in page, and a security service that works with our sign-in provider runs it. If it keeps anything in your browser, that service controls it and its notice applies (section 14). The contact form and the referral box run an invisible check of their own. Our spam-protection provider's script loads on those two pages only, and its frame runs the check inside the form. If the script or the frame keeps anything in your browser, that provider controls it and its notice applies (section 14).

10. What we do not use

• Social-media plug-ins. No buttons, feeds or embedded posts that load from another company's servers.
• Session replay. No tool that records your clicks, scrolls or typing. The payment processor's fraud script watches mouse movement on our pages to spot fraud (section 9). It is not a replay tool.
• Chat widgets. We have a contact form and nothing else.
• Tracking in email. We send emails about your account only. They carry no open-tracking pixel and no click-tracking links. The pictures in them load from our own site. A shipping email links to the carrier's own tracking page.
• Mobile apps and advertising IDs. We have no mobile app. You can add the site to your phone's home screen; that adds a shortcut to the site, not an app, and the site keeps no offline copy of itself on your device.
• Device fingerprinting for advertising. We do not use it.
• Linking your devices through an ad network. We know two devices are yours only when you sign in to the same account on both. An opt-out saved on your account follows you to every browser where you sign in. The payment processor's fraud signals use traits of your device, as section 9 says.
• Other companies' fonts or pictures. We serve our own fonts and pictures from our own site. The only scripts on our pages from other companies are the ones this policy names: the payment processor's and the services its card form offers (section 9.1), Google Analytics (section 7), the visit counter (section 8), the spam-protection provider's script and frame on the contact form and the referral box (section 9.3) and the sign-in provider's, with the bot check and the other services its sign-in box itself uses. Our pages are set up to load scripts and frames only from us and from those.

11. Advertising

11.1 Today. No advertising partner's cookies, pixels or scripts run on Grailday. We do not show you ads on other websites based on what you do here. Google Analytics, with Google's advertising features turned off, helps us see which of our own ads bring people here (section 7). If this changes, section 15 says how we tell you.

11.2 Industry tools. Even though no advertising partner runs on our site, you may want to limit interest-based advertising across the web in general. These tools are run by the advertising industry, not by us. Your Ad Choices from the Digital Advertising Alliance lets you turn off interest-based ads from the companies that take part, on the web (WebChoices) and in mobile apps (AppChoices). The Network Advertising Initiative lists further ways, including Global Privacy Control.

12. Your choices

12.1 No banner in front of you. We do not put a cookie banner in front of every visitor. We set the cookies the site needs without asking. Google Analytics, the optional cookie that counts visits, is off for anyone who opts out or sends Global Privacy Control. Visitors in the European Economic Area, the United Kingdom and Switzerland get the prompt in 12.5.

12.2 One opt-out. On Do Not Sell or Share My Personal Information you can opt out. It is a single decision, so the pieces cannot drift apart:

• Google Analytics does not run in that browser (a tab that was already open keeps counting until it loads another page);
• if we ever add advertising partners, their cookies and pixels will not run in that browser, and our servers will send them nothing about you; and
• if you are signed in when you choose, the choice is saved on your account and applies in every browser where you are signed in.

The choice is kept in gd_optout for a year. It does not change the cookies the site needs, the visit counter in section 8, the payment processor's fraud checks, or gd_attr (section 6.6).

12.3 Global Privacy Control. If your browser sends the Global Privacy Control signal, we treat it as an opt-out for that browser, with nothing more to do. If you are signed in when it arrives, we also save the opt-out on your account. Your account stays opted out until you opt back in on the choices page while signed in. You turn the signal on in your browser or with an extension. See globalprivacycontrol.org.

12.4 Do Not Track. Browsers' Do Not Track signal has no agreed standard, so we do not act on it. We honor Global Privacy Control instead. Google Analytics counts your visits to this site, with Google's advertising features turned off (section 7). Apart from it and the fraud checks our payment processor runs, no other company collects information about your activity over time and across other websites through Grailday.

12.5 The regional prompt. If you are in the European Economic Area, the United Kingdom or Switzerland, or we cannot tell where you are, a small prompt asks you to Accept or Reject. It never blocks the page, and the two buttons look the same. Until you press Accept, Google Analytics stays off and we do not set gd_attr. If you press Accept, we may set the Google Analytics cookies and gd_attr. The prompt does not cover the cookies the site needs, including the payment processor's fraud checks (section 4).

Your answer is saved in gd_consent for 6 months, and then we ask again. "Cookie settings" in the footer opens the prompt again whenever you want to change your answer, on any page that shows the prompt. The prompt does not appear if you have opted out, on pages where Google Analytics never runs (section 7.4), or on a pack's opening page, so nothing comes between you and the opening.

When you answer, we count it: which button, which version of the prompt, the country your request came from and when. We do not keep your IP address, your device details or your account with that count. We keep these counts for as long as we need them, and they name no one.

12.6 Where the controls are. The footer shows "Do Not Sell or Share My Personal Information" to visitors connecting from the one US state whose law calls for that link. Visitors in the European Economic Area, the United Kingdom and Switzerland see "Cookie settings" there, on pages that show the prompt. Everyone can always reach the choices page from the Privacy Policy and from this page.

12.7 Your browser. Every browser lets you block or delete cookies and stored settings:

• Chrome
• Firefox
• Safari on Mac, Safari on iPhone and iPad
• Microsoft Edge

12.8 Google's own tools. The Google Analytics opt-out add-on stops Google Analytics from sending information about your visits, on any site that uses it, in the browser where you install it. Google's ad settings control whether Google personalizes the ads it shows you.

12.9 If you block cookies. If you block the sign-in cookie, you cannot sign in, so you cannot add money or buy. If you block the cookie on the contact form or on the choices page, that page turns your message back. If you block the cookies that remember where to send you after a payment, you return from the payment page to the Balance page instead of the page you were on. If you block the payment processor's script, the card payment moves to the processor's own page. If you block browser storage, the menu may show your Balance a moment late, your sound and home-page settings reset, and a pack you have already seen open may play again.

12.10 Choices belong to one browser. Your opt-out and your answer on the cookie prompt are stored in cookies, so they apply to the browser and device where you made them. If you clear your cookies or use a private window, gd_optout and gd_consent are gone, and the opt-out ends for that browser and the prompt asks again. If you were signed in when you opted out, the opt-out is also saved on your account, and it applies again as soon as you sign in. Global Privacy Control is sent by the browser every time, so clearing cookies does not end it.

12.11 Changing your mind. Press "Opt back in" on the choices page. If your browser still sends Global Privacy Control, you stay opted out until you turn the signal off. Open "Cookie settings" in the footer to change your answer on the prompt.

13. Where you live

13.1 European Economic Area, United Kingdom and Switzerland. The law there asks for your consent before we use cookies the site does not need. That is why the prompt in 12.5 exists. To ask about your information, use the contact form and choose "Privacy request."

13.2 United States. Many US privacy laws let you refuse the sale of your personal information, its "sharing" and its use for targeted advertising. Grailday does not sell your personal information. Today we do not share it so that other companies can show you ads on other sites. Section 12 shows how to opt out, and we honor Global Privacy Control.

13.3 Where your information goes. We run Grailday from the United States. The companies named in this policy may handle information in the United States and in other countries. The law in the European Economic Area, the United Kingdom and Switzerland limits transfers of information out of those places. If you want to know which safeguard covers a provider, ask us through the contact form.

14. Other companies' cookies

The companies named in this policy set some cookies themselves. We do not control them, and we cannot read them. Each company's own policy governs its cookies. We choose our providers with care and list what we know, but a provider can change its cookies without telling us. If our network provider ever shows you a security check, it may set a cookie for that check, and we do not control it.

Links on our site and in our emails can lead to other companies' pages, such as the payment processor's payment page, a carrier's tracking page or Google's sign-in. Those pages set their own cookies, and their own notices apply. A card's certificate number on our pages is plain text. It does not link to another company's site.

15. Changes to this policy

When we add or change a cookie or a similar technology, we update this page and the date at the top in the same release, so the page is right from the first day the technology runs. That includes a new kind of technology, such as advertising cookies. For a material change, such as adding advertising cookies, we also put a notice on the site for at least 14 days before the change starts.

16. Questions

Send a message through the contact form and choose "Privacy request." Grailday, 30 N Gould St #54815, Sheridan, WY 82801, USA.