Privacy Policy

Last updated: 19 September 2026

This notice explains how grid.radio ("we", "us") handles personal information when you use this website, the OpenGD77 web CPS, and the developer API. It is written to meet the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

Who we are

grid.radio is a UK-based, independently run amateur-radio project. It is the data controller for the information described here. You can contact us about privacy at [email protected].

Our principles

• We will never sell or share your personal data.
• We run no advertising and no advertising or cross-site tracking technologies.
• We use no third-party analytics or tracking scripts. Analytics and error logging are handled entirely by our own internal systems.
• Information is collected only for operating the service, error logging and aggregate analytical purposes. It is not used to track you across other websites or to build advertising profiles.

What we collect

Account information

• Username, email address, and your password (stored only as a one-way bcrypt hash — we cannot read it).
• Optional profile details you choose to give: callsign, name, grid locator, QTH and country.
• If you enable the QRZ.com integration, your QRZ credentials are stored encrypted at rest.

Service and diagnostic information

• Technical request data such as IP address, approximate country, browser and operating system, device type, screen/viewport size, language, timezone and referrer.
• Activity and error records generated while using the tools — for example radio model, firmware version, whether an action succeeded, and (on failure) a diagnostic message and stack trace.
• Server logs kept for security, abuse prevention and troubleshooting.

Cookies and local storage on your device

We use cookies and similar technologies (local storage / IndexedDB) for two purposes:

• Strictly necessary: a session cookie so you stay signed in, storage for your preferences and, where applicable, cached reference data (for example DMR ID databases), and technical fault/error diagnostics that keep the service working, reliable and secure. These are required for the service to work and are not used for tracking.
• Usage analytics (optional): first-party storage used to record anonymous page views and feature usage so we can understand how the service is used. This is only set after you give consent.

Diagnostic and error information (for example success/failure of an operation) is retained to keep the service reliable and secure and is not used for advertising or to track you. We do not use cookies or device storage for advertising or cross-site tracking. Our sites show a cookie banner on first visit where you can accept, reject non-essential storage, or choose each category, and you can change or withdraw your choice at any time using the Cookie settings link in the site footer or menu. Your consent choice itself is stored in a strictly necessary first-party cookie and local storage so we can remember it.

Why we use it, and our lawful basis

Purpose	Lawful basis (UK GDPR)
Creating and running your account; providing the CPS and API	Performance of a contract (Article 6(1)(b))
Error logging, security, abuse prevention and troubleshooting	Legitimate interests (Article 6(1)(f)) — keeping the service working and secure
Aggregate, internal analytics about how the service is used	Consent (Article 6(1)(a)) for storing/reading information on your device under PECR; withdrawal is available at any time via Cookie settings
Sending you update/news emails or account notifications	Consent (Article 6(1)(a)); under PECR these are opt-in and off by default

We do not process special category data, and we do not make automated decisions or profile you.

Marketing and notifications

Update and notification emails are off by default and are only sent if you opt in. Every such email includes an unsubscribe link, and you can change both preferences at any time in your account settings. Unsubscribing is immediate.

Who can see it

Your data is processed internally by grid.radio. We do not sell it, rent it, or share it for anyone else's marketing. We do not use third-party analytics, advertising or social trackers.

International transfers

Some infrastructure providers may process data outside the UK. Where that happens, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or on an adequacy finding.

How long we keep it

• Account data: while your account is active, and then deleted when you delete your account or ask us to.
• Page-view analytics: up to 90 days.
• Activity and error event records: up to 730 days (2 years).
• Server and security logs: kept for a short period for security and abuse prevention, then removed.

How we protect it

The site is served over HTTPS. Passwords are stored only as bcrypt hashes, and sensitive credentials (such as QRZ logins) are encrypted at rest with AES-256-GCM. Access to administrative systems is restricted and authenticated.

Your rights

Under UK GDPR you have the right to:

• be informed about how we use your data (this notice);
• access a copy of your personal data;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to processing;
• data portability;
• withdraw consent at any time (for update emails, or for analytics storage via the Cookie settings link).

To exercise any of these, contact [email protected]. You can also delete your account from your account settings.

If you are unhappy with how we have handled your data, you have the right to complain to the UK's Information Commissioner's Office (ICO): ico.org.uk, telephone 0303 123 1113.

Children

The service is not directed at children, and we do not knowingly collect data from children.

Changes to this notice

We may update this notice from time to time. Material changes will be reflected by the "last updated" date above.

Contact

Questions about this notice or your data: [email protected].