Everything we know about you. It is a short list.

The law calls whoever decides what happens to your data the controller. That is not a job that waits for a registration: somebody is deciding today, which means there is a controller today. Earlier versions of this page said there was none yet. That was wrong, and it turned a real obligation into a blank line.

A controller has to publish a name and a postal address, and this page prints neither yet. That is a real gap and it is not waiting on a registry — it is owed to you now. Ask at support@touchgrass.family and you get both by reply, from a person.

A company is being registered. When it exists it becomes the controller and takes this over, and its name, address and registration number appear here on the day that happens rather than the month after. Nothing about how your data is handled changes when it does — the rows further down this page are the answer either way.

One address carries every request on this page, and it is read by a person rather than a queue:

There is an @touchgrassrwa on X. It posts announcements. It is not where rights requests go, and nobody should ever send a wallet address or a document proving who they are into a public reply or a DM — we never ask for either there, we never message first, and the support page explains why anyone doing so is not us.

A rights request has a legal deadline of one month, and we would rather not use all of it. One thing has a shorter promise on it: a catch you believe was wrongly refused is looked at by a person within 72 hours. That is the same 72 hours the Legendary rules screen commits to, it is the only response deadline this product has, and inventing a second one for everything else would be a number made up on the spot.

• Your position is read only while a catch screen is open. Never in the background — the Android app does not carry the permission, so it could not do it if we changed our minds.
• The GPS trail you send is scored and thrown away. What survives a catch is a handful of numbers about the shape of that walk, and, only if you won something, your four most recent accepted fixes for a week.
• There is no analytics SDK, no advertising identifier, no tracking pixel and no cookie banner, because there is nothing to put in one.
• Nothing is sold to anybody. There would be very little to sell: we do not know your name unless you typed one in.
• Signing in is OAuth through Google, X or Apple. We never see a password and never ask for one.
• Your catches are transfers on a public blockchain. Those cannot be deleted, by us or by anyone. That is the wall Article 17 hits here and it has its own card below rather than a footnote.

Everything in the card above applies to the app as well — same position, same trail, same timezone, same IP, same account. These are the additions, and the first three exist because a phone can prove something a web page cannot.

• Background location. There is no such permission in the manifest, on either platform.
• Your contacts, your calendar, your messages, your other apps.
• Your microphone. The permission for it was declared by a library and cut from the manifest before the build, along with the one for drawing over other apps.
• Your step count. A pedometer permission is declared by the sensors package and never once called.
• Your photos, beyond the single image you choose for an avatar and crop yourself.
• An advertising identifier, on either platform. Nothing here reads one.

The download page lists the whole Android manifest, line by line, including the permissions our own libraries tried to add and the two that were cut before the build. It is the same file this page describes.

Legitimate interest is not a free pass, and it is not a synonym for “we felt like it”. It obliges us to keep the intrusion as small as the job allows, which is why the trail is scored and dropped instead of stored, why the fingerprint is sixteen characters of a one-way hash rather than anything that can be reversed, and why none of it decides a refusal on its own.

Retention here is written as expiry times in a key-value store, not as a sentence in a document. Where a number is missing above, it is missing in the code too. Two rows genuinely need a clock and have only a count — the forensic summaries and the refusal log — and both hold your wallet address next to a place and a time. Saying so here is what makes it hard to leave that way.

And one that is not ours at all. The map tiles come from OpenFreeMap. Your browser or your phone fetches those squares straight from tiles.openfreemap.org, which means they see your IP address and roughly which part of the world you are looking at. That request never passes through us and we cannot see it, which is exactly why it is named here rather than left for somebody to find in a network tab.

There is no analytics provider, no advertising network and no crash reporter. There is a mailbox, and it is in the table above precisely because writing to us is how every right on this page gets used. The two typefaces are compiled into the site at build time and served from our own domain, so Google is not told when you load a page. If any of that changes, this page changes before the code ships, not after.

Leaving the EU. Privy, Vercel, Upstash and Expo are American companies, and nothing in this deployment pins a region, so your data does leave the European Union. The law wants a named safeguard for that — a processing agreement with the Commission’s standard contractual clauses in it, or a provider certified under the EU–US Data Privacy Framework — and it wants you to be able to ask for a copy.

An earlier version of this paragraph said that paperwork had to wait for the company to exist. That was wrong, and it was a convenient thing to be wrong about. Every one of these agreements is a click-through that a person can accept in their own name, so the missing registration never blocked it and cannot be the excuse.

No transfer safeguard is documented yet — not standard contractual clauses, not a Data Privacy Framework certification, provider by provider. That is a gap rather than a position, and it is stated here in its own box rather than in a sentence you would skim past.

Until each one is named, the honest reading is that these transfers run without a documented safeguard. As each agreement is accepted the mechanism is named on this page, and a copy comes to anyone who asks at support@touchgrass.family.

Your wallet is non-custodial. Privy derives the key on your device; we never hold it, cannot sign with it, and cannot move anything out of it. That is the good half of the same fact.

The other half: a catch that pays out is a token transfer signed by our vault on Robinhood Chain, and it lands on a public ledger. Anyone can read it. It will still be readable after the company exists, and after it stops existing. No request to us can remove it — not because we would refuse, but because it was never ours to remove. Nobody has that button, including us.

What is on the chain: a wallet address, a token, an amount and a time. What is not on the chain: your handle, your name, your avatar, your position, or the place you walked to. Those live in our store, and those we can delete on request, completely.

So the right to erasure works on everything we hold and stops at the chain. If that trade is not one you want to make, the honest advice is to not catch anything — the map, the drops and the rules are all readable without an account. There is no version of this where the payout is both real and erasable.

1. 01. Access

   Your profile and every catch on your wallet are already on screen at /app/settings — that part needs no request. Ask on the support page for the rest, including whatever is still sitting in the anti-fraud logs against your wallet or your device hash, and you get it.

2. 02. Rectification

   The profile editor, in the app and on the site. Name, handle, avatar and bio are all editable and all clearable. Nothing there is derived from anything you cannot change.

3. 03. Erasure

   /delete-account, which writes the request rather than firing it: the page opens a mail draft with your wallet address in it, one reply asks you to prove the address is yours, and then the profile, the handle, the catch history and your place on the leaderboard go. There is no self-service button, and the deletion page says so on its own face rather than letting you find out. It cannot touch the chain, and the card below that one explains exactly why. Export your wallet key from /app/settings first: deleting the account does not delete the tokens, and without the key that wallet is gone for good.

4. 04. Restriction

   Ask, and we stop processing what is in dispute while it is in dispute. In practice that means we leave your record alone rather than deleting it, and we do not act on the refusal until a person has looked at it. There is no freeze switch built for this: a profile has no suspended flag on it, and the one mark that can stop a wallet claiming is the anti-farm one described under retention, which is aimed at fleets funded from a single gas payer and is not a tool for holding your account still while we argue about a refusal. So this is a person keeping their hands off a record and writing back to say so. Saying that is more use to you than describing a button that does not exist.

5. 05. Portability

   Ask, and you get JSON: the profile, plus the catch history, in the shape the API already serves it in. Machine-readable, because a PDF of a table is not portability. It is assembled by a person and not exported by a button — there is no export endpoint — so give it a couple of days.

6. 06. Objection

   Aimed at the legitimate-interest rows above. The public feed is the one most people mean, and here is the honest state of it: making your profile private hides your profile page, but it does not currently pull your handle out of the feed, because the feed reads a separate address-to-handle index that does not check the switch. The switch in the editor says it hides your catches entirely, and that label is ahead of the code — the label is the part that misleads, and both it and the feed are being fixed. Until they are, ask and we will unpick it by hand. Objecting to the anti-fraud checks themselves means you cannot claim — we would rather say that plainly than pretend the check is optional.

7. 07. Withdraw consent

   The location permission, in your operating system settings. Turn it off and the sensor stops immediately, on the site and in the app. The map still works at city scale. The catch does not, and cannot.

8. 08. Judged by a machine, argued with a person

   The first decision is a machine's, and pretending otherwise would be flattering: five weighted tells, a threshold, a refusal, nobody in the loop. This is a solely automated decision, and it is permitted because it is necessary for the contract you asked us to perform — Article 22(2)(a). What it costs you when it goes wrong is a payout you had already walked for: the fragment is not sent, and the refusal is written to a log with your wallet address, the drop and the city on it. The fleet mark in the retention table is a second automated refusal and works the same way, including the thirty days it lasts. The three safeguards the Article requires are the answer to both. You can get a person involved, you can tell them what actually happened, and you can contest the outcome — that is what the 72 hours is. Nothing here is profiling for advertising, because there is no advertising.

And the ninth, which is not one of the eight: you can complain to the data protection authority where you live, and you do not have to ask us first or wait for us to answer. The list of every authority in the Union is published at edpb.europa.eu.

This site sets no cookies of its own. Your session travels as two request headers rather than as a cookie, which is also what makes a forged cross-site POST impossible — a browser attaches cookies to a hostile page’s request all by itself, and it will not attach a header that page cannot read.

The site writes nothing to local storage. Privy’s sign-in library keeps your session in the browser so you are not signed out on every reload; that is the login working, not tracking, and signing out clears it.

On the phone, three things sit in the operating system keychain: the Privy session, your 18-or-over and not-a-US-person answer, and a flag saying you have seen the intro screen. The first is what keeps you signed in. The other two never leave the device — no server here knows you answered, which is exactly why the app calls it a declaration and not a gate.

No advertising identifier is read on either platform, and no fingerprinting script runs in the page. The device hash described further up is computed on our server, from headers your browser already sent, and never in your browser.

Touch Grass hands out fragments of Robinhood Chain Stock Tokens. A Stock Token is a token representing a derivative contract with Robinhood Europe UAB that tracks the price of a listed share. It is not a share, it confers no shareholder rights, its value can fall, and it is not covered by any investor compensation or deposit insurance scheme.

You must be 18 or over. It is offered in the European Union and not to US persons. Walking does not earn you money, nothing here is investment advice, and none of this is a reason to go outside. Going outside is the reason to go outside.

We do not knowingly hold data about anyone under 18. If a child has an account here, say so on the support page and it goes, with everything attached to it — except the chain, which is the same wall as everywhere else on this page and applies to everyone equally.

This page is a file in the repository that builds the site, so every change to it is a commit with a date on it. When something material moves — a processor added, a field collected, a retention lengthened — this page is updated before the code ships, and the date under the headline moves with it. The app’s Legal and support card points at this same URL and always will.

Several things on this page are honestly unfinished, and every one of them is admitted in the card it belongs to rather than collected out of the way down here: the controller’s name and postal address are owed and not printed, no transfer safeguard is named for the four American providers, the motion figure is read on browsers that were never asked for it, the forensic summaries and the refusal log are bounded by a count instead of by a clock, the private switch does not yet pull your handle out of the feed, and two of the rights above — restriction and portability — are worked by a person because neither a freeze switch nor an export button has been built. When one of those is fixed, the sentence admitting it disappears from wherever it sits.