Privacy Policy

Who We Are

Holy Grail (grail.moe) is operated by Shukudai Labs Pte. Ltd. (UEN 202639854R), a company incorporated in Singapore. In this policy, "Holy Grail," "we," and "us" mean Shukudai Labs Pte. Ltd. We handle personal data in accordance with Singapore's Personal Data Protection Act 2012 (PDPA).

This policy explains what personal data we collect when you use Holy Grail, how we use and share it, and the choices you have. By creating an account or using Holy Grail, you consent to the collection, use, and disclosure of your personal data as described here.

Personal Data We Collect

• Account data. Your username, email address, and email verification status. Your password is stored only as a secure hash. If you sign in with Google or Apple, we receive your email address and basic profile information from that provider so we can create or link your account; we never receive your password from these providers.
• Practice data. The practice papers and questions you generate, your generation history, and usage counts, so we can show you your history and apply your weekly quota and any credits you hold.
• Purchase data. Payment is handled by our payment processor, Stripe. Your card and bank details go directly to Stripe and are never stored on our servers. We keep records of your purchases, such as your subscription status, pass coverage dates, and credit balance.
• Content you contribute. Notes and papers you upload to the library, which are published with your username, as described in the Public Content section below.
• Messages. Emails you send us, so we can reply and keep a record of the conversation.
• Technical data. Your device's IP address, device type, language settings, and general location information, collected through cookies and similar technologies.

We do not intentionally collect sensitive personal data, such as health information, biometric data, or religious beliefs.

How We Use Personal Data

• To provide and operate Holy Grail: accounts, the library, practice tools, quotas, and credits.
• To process payments and keep accurate purchase records.
• To send service emails, such as verification emails, receipts, and important notices about your account or the Service. These are not marketing and are sent as needed.
• To understand how the Service is used and to improve it.
• To keep the Service secure, prevent fraud and abuse, and enforce our terms.
• To comply with applicable laws and lawful requests.

We rely on the consent you give when you create an account or when we ask for it, on purposes a reasonable person would consider appropriate for providing the Service, and on our legal obligations.

Who We Share Personal Data With

We do not sell personal data. We share it only with:

• Service providers that process data on our behalf: Amazon Web Services (cloud hosting), Stripe (payment processing), Google (optional sign-in, Google Analytics, and Google AdSense advertising), Apple (optional sign-in), and an email delivery provider.
• Professional advisors, such as lawyers, accountants, auditors, and insurers, when necessary for the services they provide, under confidentiality.
• Authorities, where disclosure is required by law or is necessary to protect our rights or the safety of users or the public.
• A buyer or successor, if Holy Grail is involved in a merger, acquisition, or sale of assets. Your personal data would remain protected consistently with this policy, and we would notify you of any change of operator.

We may share aggregated, anonymized statistics that cannot identify you, for example the total downloads of a set of notes.

Cookies, Analytics, and Advertising

We use cookies to keep you signed in and to remember your preferences. We use Google Analytics to understand how visitors use the Service, such as which pages are visited and for how long, and we work with this information in aggregated form.

We show ads through Google AdSense on some pages. Google and its partners use cookies and similar technologies to serve and measure ads, and may personalize ads based on your visits to this and other websites. You can manage ad personalization in Google's Ads Settings or opt out of personalized advertising from participating vendors at aboutads.info. Premium subscribers are not shown ads. You can also manage cookies in your browser settings; blocking them may limit parts of the Service, such as staying signed in.

Public Content and the Leaderboard

Your username, your contribution counts, and your leaderboard placing are publicly visible. Notes and papers you upload are published in the library together with your username. Your email address is never shown publicly. If you would rather not be identifiable, choose a username that is not your real name.

Where Your Data Is Stored

Our servers and databases are hosted with Amazon Web Services in Singapore. Some of our service providers, such as Stripe and Google, may process data outside Singapore. Where personal data leaves Singapore, we take steps to ensure it receives a standard of protection comparable to the PDPA.

Retention and Account Deletion

We keep your personal data for as long as your account is active. You can access and update your account information by logging into your account.

If you ask us to delete your account, we will delete or anonymize your personal data within 30 days, except records we are legally required to keep, such as payment and tax records, which we keep for up to 5 years. Notes and papers you contributed remain in the library so other students can keep using them, but we remove the link to you: your attribution is removed and the contribution becomes anonymous.

Your Rights

• Access: ask for a copy of the personal data we hold about you and how it has been used or disclosed.
• Correction: ask us to correct inaccurate or incomplete personal data.
• Withdraw consent: withdraw any consent you have given at any time.
• Deletion: ask us to delete your account and personal data, as described in the Retention and Account Deletion section above.

To exercise any of these rights, email team@shukud.ai. We respond within 30 days; if we need longer, we will tell you when to expect a response. If you are unsatisfied with our response, you may contact Singapore's Personal Data Protection Commission at pdpc.gov.sg.

Students and Parents

Holy Grail is built for students, and many of our users are under 18. If you are under 13, please ask a parent or guardian to help you create your account and to agree to this policy on your behalf. Parents and guardians can contact us at team@shukud.ai with any question about their child's data, including to request deletion.

Data Protection Officer

We have designated a Data Protection Officer under section 11(3) of the PDPA. You can reach the DPO at team@shukud.ai for any question, request, or complaint about personal data.

Changes and Contact

We may update this policy from time to time. We will update the date at the top of this page, and we will notify you of significant changes, for example by email or a notice on the site. Your continued use of Holy Grail after a change means the updated policy applies.