Privacy Policy

Last updated 13 November 2026. These changes apply from 13 December 2026, and to accounts made from 13 November 2026 straight away; until then, the previous version applies to accounts made before. We follow the Australian Privacy Principles, and the EU GDPR for people there.

What's changing on 13 December 2026

What we do after a data breach (Keeping it safe) and if Grumble changes hands (Who else sees your data), how long reported copies are kept (Reports), and why we're allowed to keep more of what we keep (for people in the EU). The Terms of Service change the same day. The app tells everyone.

Who we are

Grumble is run by Aternix (ABN 85 475 523 046), in Victoria, Australia. We decide what happens to your information (in EU terms, we're its controller). To ask our privacy officer anything about your privacy, use our contact page (pick "My privacy or my data") or email admin@aternix.com. Grumble has no office in the EU. If we're ever required to name a representative there, their details will be added here and on the contact page. Grumble isn't offered in the UK (why).

What we never collect

No phone number, no date of birth, no ID documents, no face scans, no real name, and no email address unless you sign up in Australia (see why), or ask for an emailed code instead of the sign-up puzzle, which uses it once without keeping it. We don't store your IP address, location or device details, apart from an Android phone's push token (below). There are no cookies, no advertising and no tracking, in the apps or on this website. We count visits to this website as daily totals, which say nothing about anyone (see how).

What we keep, and why

You can see all of it in the app, under Settings → Your data, with when each piece goes (and a countdown to when your email address is deleted, if you signed up in Australia). Whether you've turned on Show adult content is kept on your device only, never sent to us.

When you delete something, it goes from our servers straight away, files and pictures included. Our backups hold a copy of the above for up to 30 days, so it's gone from them within 30 days too.

Why we're allowed to (for people in the EU)

• To provide Grumble (our agreement with you), for your account, profile, messages, settings, friends and servers, and your logins, two-factor secret, encrypted key backup and push token.
• To keep people safe and Grumble working (our legitimate interests), for reports, our safety team's actions and records, blocked files, stopping floods of requests, your age group and the starting settings it gives you, counting visits to this website as daily totals (below), messages a server brought with it from Discord (below), and the note of the username you signed up with, which we keep for everyone for the reason Australian law requires it from Australians.
• Because the law requires it, for answering valid legal orders and the Australian sign-up rules for people in Australia. A legal order from outside the EU we answer under our legitimate interests.
• Because you chose to, for "Allow age-restricted content on iPhone" and contact details you give us. You can take those back at any time.

Where your data is

On servers we run ourselves, on machines we rent in a data centre in Sydney, Australia (from Vultr, which provides the machines and doesn't look at what's on them). If you're in the EU or elsewhere, using Grumble means your information goes to Australia, whose privacy law differs from yours. We protect it as this policy says, wherever you are. What goes there is everything in the table above, as you use Grumble, over encrypted connections, to us, and it's kept for as long as the table says. The few emails we send (sign-up codes, and our replies about notices sent through our contact page) go out through Resend, an email company in the United States, which keeps a copy of each for 30 days (below). Australia's privacy law is the Privacy Act 1988 and its Australian Privacy Principles, which we follow even though a business our size doesn't have to. If you don't want your information to go to Australia, don't sign up, or delete your account. If you email us, the email goes through our email provider, Google Workspace (Google LLC, United States). The contact page doesn't.

Signing up in Australia

Australian law (section 18 of the online safety industry standard for messaging services) requires chat apps to take a phone number, an email address or another identifier from everyone who signs up in Australia, and keep it for at least two years. It's meant to let services stop people who were suspended from simply signing up again. We ask for an email address, and only from people signing up in Australia.

• How we know you're in Australia. Our server checks your IP address against a list of addresses in the countries and US states whose laws change something in Grumble, which it keeps itself (IP geolocation by DB-IP), then forgets the address. No outside service is asked, and nothing is stored. The same check closes adult content to anyone connecting from South Korea, keeps Grumble closed in places whose laws require what we can't do (the UK, Brazil, Turkey, Mississippi, Tennessee), applies the youngest sign-up age set in Nebraska (18) and Ohio (16), and lets the home page show what applies where you are.
• Confirming it. We email you a 6-digit code, sent for us by our email company, Resend (below). Any address that reaches you works.
• What it's used for. Only to stop people whose accounts are suspended from signing up again with the same address, and to answer lawful requests from police. It's never used to log in, to reset passwords, or to send you news or anything else, and it isn't shown to anyone or kept on your account.
• How long. Two years from when you sign up, even if you delete your account sooner. Then it's deleted.

We share the rule's aim, and Grumble keeps suspended people off too. We'd just rather it didn't mean tying every account to a person.

Encryption

Direct messages, group messages and every voice and video call, screen shares included, are end-to-end encrypted. They're scrambled on your device and only the people in the conversation can unscramble them. We can't read or hear them, or hand them to anyone, apart from a message someone in the conversation reports, which their app sends us. We can see who's in a DM or call and when, and which soundboard sounds are played in a call, but not what anyone writes or says. Files and photos sent in DMs are encrypted on your device too, and arrive exactly as you sent them. We keep only scrambled data, without its name or type, roughly how big it is, and when it was sent. Servers are end-to-end encrypted too. Their messages, files and polls, and the names of channels, roles, events and nicknames, are scrambled on members' devices with keys only members hold. Members' apps hand the keys to newcomers, and change them when someone leaves, so people who leave can't read what's said after. We can still see what an invite shows (a server's name, icon, banner and description), who's a member, who sent what and when, who a message mentions, roles' permissions, custom emoji, stickers and soundboard sounds. Search in DMs and servers happens on your device.

Keeping it safe

Everything between your device and our servers is encrypted on the way. Your password never reaches us. The app proves it knows it without sending it (a method called OPAQUE), and accounts from before keep only a one-way Argon2 hash until they next log in. Two-factor secrets are sealed with a key of their own. Only Aternix can get into the servers, and only our safety team can use the safety tools. If something ever goes wrong, we have a written plan to stop it, work out what was reached, tell the people affected in the app and on this website, and tell the regulators the law asks us to.

If a breach of our systems is likely to put you at risk, we'll tell you in the app as soon as we can, with what happened and what you can do, and tell the regulators the law requires us to, in the time it sets (72 hours in the EU).

Your IP address

Our servers need your IP address to send you anything at all. To stop floods of requests, we briefly use a scrambled, one-way version of it in memory. When you connect, our server also checks it against a list of addresses it keeps itself, to see whether you're somewhere whose law changes something in Grumble (Australia, the UK, South Korea, Brazil, four US states and a few more, as our home page explains); the answer is used for that connection and forgotten. Your IP address is never written down, logged or shared.

Decisions made automatically

Our software makes some decisions on its own, using a little information about you:

• Where you're connecting from (worked out from your IP address, as above) decides whether you can sign up, the youngest age that can, whether you're asked for an email address, and whether adult content is open to you.
• The age group you pick decides your starting settings and keeps under-18s out of adult channels. Picking under 13 ends sign-up.
• New accounts, for their first few minutes, can message only friends, and can send only a few friend requests and join only a few servers. Signing up also has your device work on a maths problem for a second or so, and has you turn a picture of a pug the right way up. Our server draws the picture, and only how far you turned it comes back. No captcha company is involved. If you'd rather not do the pug, you can confirm an email address with a code instead, and we don't keep the address. All of this slows down accounts made in bulk.
• Pictures we can see, such as avatars, banners, server icons, emoji and stickers, are compared as they're uploaded with the fingerprints of illegal files we've removed before, and so are the files in a message someone reports. Files in encrypted messages can't be checked as they're uploaded. Matching ones are refused or removed, and our safety team is told who sent them.
• A search for child sexual abuse material gets a warning and where to find help, not results. Nothing about the search is kept.
• An image reported as an intimate image shared without consent is hidden from everyone at once, until our safety team decides.
• Too many requests in a short time are slowed down or refused.
• Server moderators can have AutoMod block or flag words they choose (in an encrypted server, your app checks your message against them before sending it), and decide how long you must have been on Grumble or in their server before you can talk there.

Nothing automatic suspends or closes an account. People on our safety team decide that. If you think one of these got something wrong for you, tell us through our contact page and a person will look at it.

On your device

The apps never send us whether you've turned on Show adult content, your hidden words, the width of your channel list, when the app last reminded you of our rules (it does every three months), or, for a day, that someone said they were under 13 at sign-up. Those stay on your device. Your login stays on your device so you don't have to sign in every time. None of it is a cookie, and none of it tracks you.

Who else sees your data

Nobody, for money, ever. We run our own servers, and the only outside services that handle your information for us send our emails and, on Android, our notifications. There are only these exceptions:

• Other people on Grumble see what you choose to share with them, which is your profile and the messages you send them or post where they can see. While you're only on the phone app, they also see a little phone by your name instead of the green dot. The app tells our server it's the phone app for that alone, and it's forgotten when you disconnect. You can turn it off under Settings → What you share.
• Public servers. If a server's owner lists it in Discover, everyone on Grumble can see its name, picture, banner, description, search words and how many members it has. If they also turn on Show it in search engines, the same things are on a public web page that search engines like Google can find. Its members and messages are never shown.
• Things you make and share. A theme or cosmetic you share in Discover shows with your name, to everyone on Grumble and on a public page of its own. Our safety team looks at a cosmetic's picture before it's shared. You can take it back or delete it any time.
• Bots and apps in a server can see what's in that server, like any member with the same permissions.
• Server moderators. If a server uses AutoMod alerts, a message it blocks or flags is posted, with your name, in the channel its moderators chose. In an encrypted server the alert says only which rule matched, not what you wrote.
• Emails we send. The sign-up code (if you sign up in Australia, or ask for one instead of turning the pug), and our replies about a notice you sent through our contact page with an email address, are sent for us by Resend (Plus Five Five, Inc., San Francisco, United States), which delivers them through Amazon Web Services. Resend gets your email address and the email, uses them only to deliver it, and keeps a copy for 30 days. Its own suppliers, all in the United States, are listed at resend.com/legal/subprocessors. Its data processing agreement binds it to this, with the EU's standard contractual clauses (and the EU–US Data Privacy Framework, which it's certified under) for people in the EU. The emails have no tracking in them, so we don't know whether you opened them or clicked anything. Nothing else about you goes to Resend.
• Notifications on Android. The Android app's notifications travel through Google's Firebase Cloud Messaging (Google LLC, United States), the way Android apps' notifications usually do. When something arrives for you while Grumble is closed, our server sends Google an empty signal for your phone. It carries no name, no message and nothing about what happened. Your phone then asks our server what it is, and shows it. Google gets your phone's push token and the time of each signal, and nothing else from us. You can turn Grumble's notifications off in Android's settings, and Google gets nothing from us when you're logged out.
• App stores. If you get Grumble from the App Store or Google Play, Apple or Google handle that download under their own privacy policies. They don't see anything inside Grumble. In US states whose law requires it (Texas, and from 2027 Alabama, California, Utah and Louisiana), the Android app from Google Play asks Google Play on your phone for your age band and, if a parent supervises your account, whether they've approved Grumble, and the iPhone app asks Apple for your age range. If the store says you're younger than the age you gave us, we lower it to match. Nothing else from Google Play or Apple is kept, and the apps don't ask anywhere else.
• GIF search, if we turn it on, sends the words you search for to the GIF provider through our server. Nothing about you goes with them.
• Moving from Discord. Your profile and settings come from Discord's data download, read on your device. If you import a server from a Discord template link, or emoji by their links, our server fetches that template or those pictures from Discord at your request, and nothing about you is sent with it. If importing with a bot is ever turned on and you use it, it fetches your server from Discord using a bot you add there, and messages it brings keep their authors' Discord names and pictures (below).
• If Grumble changes hands. If another business takes Grumble over, such as a company Aternix sets up, your information goes with it under this policy, and we'll tell you in the app at least 30 days before. You can delete your account before then.
• The law. We give information to police, courts or regulators only when the law that applies to us requires it (mostly Australia's, and in some cases the EU's or another country's), and only what we have, which is very little. If we find child sexual abuse material or a threat to someone's life, we must report it.

If your messages were imported from Discord

Server import with messages isn't turned on at the moment. Where it's turned on, a server's owner can move the server from Discord to Grumble, and choose to bring its recent messages. If you posted in it, your messages come too, even if you've never used Grumble. That means your Discord display name and profile picture, and the messages and files you posted in the channels they brought, marked "Imported from Discord". Your Discord account id is used only to keep your messages together while the import is unfinished, and isn't kept after that. We keep the messages so the server's members have their history, until the server's moderators delete them, the server is deleted, or Discord asks for what came through its service to be deleted (its developer terms let it), and they're stored in Australia like everything else.

You can have all of them deleted, with your name and picture, or object to us keeping them, without a Grumble account. Use our contact page (pick "My privacy or my data") with a link to one of them, or your Discord name and the server's name. We'll do it within a month.

Reports

When you report something, we keep a copy of what you reported so our safety team can look at it. For an encrypted message, that's the copy you choose to send us, and for one in a server it comes with that message's own key, which lets our safety team open the copy we hold of that one message and check it. The person you report is never told who reported them, and our safety team doesn't see it either. The link between you and a report is deleted 90 days after the report closes. We keep the reported copy until then too, or longer if police or the law require us to hold it, and a record of what our safety team did until two years after the end of that year.

Your choices and rights

• You can see and change your profile and settings in the app at any time.
• You can delete any message you've sent.
• You can delete your account in your account settings. Your messages, files and profile go for good. The few things kept for a set time afterwards, such as the sign-up note, are in the table above.
• You can see everything we hold about you under Settings → Your data, and download a copy of it, messages included, as a file you can take anywhere.
• You can ask us to correct, delete or stop using something, or object to how we use it, through our contact page. We'll answer within a month.
• If you're unhappy with how we've handled your information, you can complain to us, through our contact page or by email. If you leave a way to reach you, we'll confirm we have it within 24 hours, look into it, keep you posted, and tell you what we found within 30 days at the latest.
• You can also complain to the Office of the Australian Information Commissioner, to your country's data protection authority in the EU, or to the privacy regulator where you live.

Young people

You need to be 13 or older to use Grumble, and you tell us your age group when you sign up. If you say you're under 13, you can't make an account. Your device remembers that for a day, and nothing is sent to us. If we learn that someone under 13 has an account, we'll delete it. Anyone can report that from the person's profile or one of their messages.

You can delete anything you've posted, any time, by deleting the message or changing your profile. If there's something you posted that you can't remove, ask us through our contact page and we'll remove it. Deleting takes it off Grumble, but it can't undo copies someone else made, like a screenshot.

This website

No cookies, and nothing loads from anywhere else. Even the font is served from here. The suggestions form keeps only what you type into it, and the contact page only what you type into it (see the table above).

We count visits to this website, to Grumble in a browser (only that it was opened, never where in it), to the developer site, and downloads of the apps, so we know how many people come and from where. What's kept is daily totals: how many visits each page had, from which countries, from which websites (their names only), on phones, tablets or computers, and how many were people and how many were bots. Your country is looked up on our own server from your address, which is then forgotten. To count each person once a day, the server mixes your address and browser into a code using a key it throws away at the end of each day. The codes stay in the server's memory and are never written down, so nobody can tell from the totals who visited, or recognise anyone from one day to the next.

Giving to Grumble

You can give to Grumble on our funding page. Giving is separate from Grumble accounts, and nothing about a gift is connected to yours.

• PayID. Your bank sends us the name on your bank account, the amount and the description you wrote, as with any bank transfer.
• Liberapay. Liberapay, a non-profit in France, takes the payment through Stripe or PayPal, under their own privacy policies. We get the amount, and your name only if you choose to be public.
• Crypto. We get only the payment itself. Anyone can see Bitcoin and stablecoin payments on their networks; nobody else can see Monero payments.

We use what comes with a gift only to record it, to thank you, and to keep the business records Australian tax law requires, for five years. We show your name on the funding page only if you ask us to, and we never sell any of it or use it for anything else.

Do Not Track, and selling

There's no tracking on Grumble or this website, so a browser's Do Not Track signal has nothing to switch off, and we treat everyone as if it were on. Nobody else can collect information about what you do on Grumble or this website, over time or across other sites. We don't sell personal information or share it for advertising, and never will. If you're in Nevada, you can still send us a request not to sell yours, through our contact page, which is our designated address for it.

Changes

When a change to this policy matters, the app tells everyone at least 30 days before it applies, this page says what's changing and when, and the version before it stays here until then.