Safety & legal

Privacy Policy

In short, we keep as little as we can, we never sell or share it for profit, and there are no trackers. The details are below.

This is the previous version of our Privacy Policy. It applies to accounts made before 13 November 2026 until 13 December 2026. The current version applies to everyone from then, and to new accounts already.

Last updated 12 November 2026. We follow the Australian Privacy Principles, and the EU GDPR for people there.

Who we are

Grumble is run by Aternix (ABN 85 475 523 046), in Victoria, Australia. We decide what happens to your information (in EU terms, we're its controller). To ask our privacy officer anything about your privacy, use our contact page (pick "My privacy or my data") or email admin@aternix.com. Grumble has no office in the EU. If we're ever required to name a representative there, their details will be added here and on the contact page. Grumble isn't offered in the UK (why).

What we never collect

No phone number, no date of birth, no ID documents, no face scans, no real name, and no email address unless you sign up in Australia (see why). We don't store your IP address, location or device details. There are no cookies, no advertising and no tracking, in the apps or on this website. We count visits to this website as daily totals, which say nothing about anyone (see how).

What we keep, and why

You can see all of it in the app, under Settings → Your data, with when each piece goes (and a countdown to when your email address is deleted, if you signed up in Australia). Whether you've turned on Show adult content is kept on your device only, never sent to us.

What	Why	For how long
Your username, and what lets your app prove it knows your password without sending it (an OPAQUE record, so the password itself never reaches us). An account made before 16 October 2026 has a one-way hash of its password instead, until it next logs in	So you can sign in	Until you delete your account
A copy of your encrypted-DM keys, locked on your device with your password before it's sent, so we can't open it	So logging in on a new device brings your DMs along	Until you change your password without it, or delete your account
The age group you picked at sign-up (13 to 15, 16 or 17, or 18 or over) and when, and for under-16s whether they've turned on “My parent or carer is OK with adults contacting me”	To give each age group the starting settings Australian law requires, and keep under-18s out of adult channels	Until you delete your account
For adults, whether you've turned on “Allow age-restricted content on iPhone” (off unless you turn it on)	Apple only lets the iPhone app open age-restricted channels if you turn them on outside the app, so your iPhone has to be able to see this. Everywhere else, “Show adult content” stays on your device and we never learn it	Until you turn it off or delete your account
If you use the Android app, your phone's push token (an address Google gives the app so notifications can reach it)	So a notification can reach your phone while Grumble is closed. What it's about waits on our server for 15 minutes at most, for your phone to collect	Until you log out on that phone, or it hasn't opened Grumble for 60 days
Your profile, meaning your display name, avatar, banner, bio and whatever else you choose to fill in	So others can see who you are on Grumble	Until you change it or delete your account
Messages and files you send in servers, and the names you give channels, roles, events and yourself there, as encrypted data only	So they reach the server's members. We can't read them. We can see who's in a server, who sent each message and when, who it mentions, reactions, and what an invite shows (the server's name, icon, banner, description and member count).	Until you, a moderator or we delete them, or you delete your account
Direct messages, as encrypted data only	So they reach the people you send them to. We can't read them. We can see who's in a DM, when each message was sent, and any stickers and reactions in it.	Until deleted, or you delete your account
Your settings, friends, blocks, servers and read positions	So Grumble works the way you set it up, on every device	Until you delete your account
Your logins, as a random id per device and roughly when it was last used (nothing about the device)	So you can sign out other devices	Until you sign out or delete your account
Your two-factor secret, if you turn it on	To check your codes	Until you turn it off
A note of the username you signed up with, and when	Australian law (the online safety industry standard) requires every messaging service to keep the identifier people sign up with for two years	Two years from sign-up, even if you delete your account sooner
The email address you confirmed, only if you signed up in Australia	The same law makes chat services take an email address, phone number or other identifier from people signing up in Australia (more below)	Two years from sign-up, even if you delete your account sooner. Then it's deleted.
Reports and complaints you make, and what we did about them	To handle them, tell you the outcome, and keep the records the law requires	The link to you goes 90 days after a report closes. The record of what we did is kept until two years after the end of that year.
Suggestions you send through this website's form, with a contact if you leave one	To read and act on them	Until we've dealt with them
Notices you send through our contact page, with what you wrote, where it is, and any name, email address or Grumble username you chose to give	To deal with them, and to tell you they arrived and what we decided	Your contact details go 90 days after the notice closes, and the record of what we did is kept until two years after the end of that year
If you try to upload a file that's on the list of known illegal files, your account, where the file was going, and its fingerprints (the file itself is refused and not kept)	So our safety team can act, as Australian law requires of us	The record of what we did is kept until two years after the end of that year
If our safety team acts on your message, account or server, what we did, why, and (for a message) its text	To tell you, and let you ask us to look again	Until you delete your account, and at most two years after the end of that year

When you delete something, it goes from our servers straight away, files and pictures included. Our backups hold a copy of the above for up to 30 days, so it's gone from them within 30 days too.

Why we're allowed to (for people in the EU)

To provide Grumble (our agreement with you), for your account, profile, messages, settings, friends and servers.
To keep people safe and Grumble working (our legitimate interests), for reports, our safety team's actions and records, blocked files, stopping floods of requests, counting visits to this website as daily totals (below), messages a server brought with it from Discord (below), and the note of the username you signed up with, which we keep for everyone for the reason Australian law requires it from Australians.
Because the law requires it, for answering valid legal orders and the Australian sign-up rules for people in Australia.
Because you chose to, for "Allow age-restricted content on iPhone" and contact details you give us. You can take those back at any time.

Where your data is

On servers we run ourselves, on machines we rent in a data centre in Sydney, Australia (from Vultr, which provides the machines and doesn't look at what's on them). If you're in the EU or elsewhere, using Grumble means your information goes to Australia, whose privacy law differs from yours. We protect it as this policy says, wherever you are. What goes there is everything in the table above, as you use Grumble, over encrypted connections, to us, and it's kept for as long as the table says. The few emails we send (sign-up codes, and our replies about notices sent through our contact page) go out through Resend, an email company in the United States, which keeps a copy of each for 30 days (below). Australia's privacy law is the Privacy Act 1988 and its Australian Privacy Principles, which we follow even though a business our size doesn't have to. If you don't want your information to go to Australia, don't sign up, or delete your account. If you email us, the email goes through our email provider, Google Workspace. The contact page doesn't.

Signing up in Australia

Australian law (section 18 of the online safety industry standard for messaging services) requires chat apps to take a phone number, an email address or another identifier from everyone who signs up in Australia, and keep it for at least two years. It's meant to let services stop people who were suspended from simply signing up again. We ask for an email address, and only from people signing up in Australia.

How we know you're in Australia. Our server checks your IP address against a list of addresses in the countries and US states whose laws change something in Grumble, which it keeps itself (IP geolocation by DB-IP), then forgets the address. No outside service is asked, and nothing is stored. The same check closes adult content to anyone connecting from South Korea, keeps Grumble closed in places whose laws require what we can't do (the UK, Brazil, Turkey, Mississippi, Tennessee), applies the youngest sign-up age set in Nebraska (18) and Ohio (16), and lets the home page show what applies where you are.
Confirming it. We email you a 6-digit code, sent for us by our email company, Resend (below). Any address that reaches you works.
What it's used for. Only to stop people whose accounts are suspended from signing up again with the same address, and to answer lawful requests from police. It's never used to log in, to reset passwords, or to send you news or anything else, and it isn't shown to anyone or kept on your account.
How long. Two years from when you sign up, even if you delete your account sooner. Then it's deleted.

We share the rule's aim, and Grumble keeps suspended people off too. We'd just rather it didn't mean tying every account to a person.

Encryption

Direct messages, group messages and every voice and video call, screen shares included, are end-to-end encrypted. They're scrambled on your device and only the people in the conversation can unscramble them. We can't read or hear them, and we can't hand them to anyone. We can see who's in a DM or call and when, and which soundboard sounds are played in a call, but not what anyone writes or says. Files and photos sent in DMs are encrypted on your device too, and arrive exactly as you sent them. We keep only scrambled data, without its name or type, roughly how big it is, and when it was sent. Servers are end-to-end encrypted too. Their messages, files and polls, and the names of channels, roles, events and nicknames, are scrambled on members' devices with keys only members hold. Members' apps hand the keys to newcomers, and change them when someone leaves, so people who leave can't read what's said after. We can still see what an invite shows (a server's name, icon, banner and description), who's a member, who sent what and when, who a message mentions, roles' permissions, custom emoji, stickers and soundboard sounds. Search in DMs and servers happens on your device.

Keeping it safe

Everything between your device and our servers is encrypted on the way. Your password never reaches us. The app proves it knows it without sending it (a method called OPAQUE), and accounts from before keep only a one-way Argon2 hash until they next log in. Two-factor secrets are sealed with a key of their own. Only Aternix can get into the servers, and only our safety team can use the safety tools. If something ever goes wrong, we have a written plan to stop it, work out what was reached, tell the people affected in the app and on this website, and tell the regulators the law asks us to.

Your IP address

Our servers need your IP address to send you anything at all. To stop floods of requests, we briefly use a scrambled, one-way version of it in memory. When you connect, our server also checks it against a list of addresses it keeps itself, to see whether you're somewhere whose law changes something in Grumble (Australia, the UK, South Korea, Brazil, four US states and a few more, as our home page explains); the answer is used for that connection and forgotten. Your IP address is never written down, logged or shared.

Decisions made automatically

Our software makes some decisions on its own, using a little information about you:

Where you're connecting from (worked out from your IP address, as above) decides whether you can sign up, the youngest age that can, whether you're asked for an email address, and whether adult content is open to you.
The age group you pick decides your starting settings and keeps under-18s out of adult channels. Picking under 13 ends sign-up.
New accounts, for their first few minutes, can message only friends, and can send only a few friend requests and join only a few servers. Signing up also has your device work on a maths problem for a second or so, and has you turn a picture of a pug the right way up. Our server draws the picture, and only how far you turned it comes back. No captcha company is involved. If you'd rather not do the pug, you can confirm an email address with a code instead, and we don't keep the address. All of this slows down accounts made in bulk.
Files are compared as they're uploaded with the fingerprints of illegal files we've removed before or that recognised lists give us. Matching ones are refused, and our safety team is told who tried.
A search for child sexual abuse material gets a warning and where to find help, not results. Nothing about the search is kept.
An image reported as an intimate image shared without consent is hidden from everyone at once, until our safety team decides.
Too many requests in a short time are slowed down or refused.
Server moderators can have AutoMod block or flag words they choose (in an encrypted server, your app checks your message against them before sending it), and decide how long you must have been on Grumble or in their server before you can talk there.

Nothing automatic suspends or closes an account. People on our safety team decide that. If you think one of these got something wrong for you, tell us through our contact page and a person will look at it.

On your device

The apps never send us whether you've turned on Show adult content, your hidden words, the width of your channel list, when the app last reminded you of our rules (it does every three months), or, for a day, that someone said they were under 13 at sign-up. Those stay on your device. Your login stays on your device so you don't have to sign in every time. None of it is a cookie, and none of it tracks you.

Who else sees your data

Nobody, for money, ever. We run our own servers, and the only outside services that handle your information for us send our emails and, on Android, our notifications. There are only these exceptions:

Other people on Grumble see what you choose to share with them, which is your profile and the messages you send them or post where they can see. While you're only on the phone app, they also see a little phone by your name instead of the green dot. The app tells our server it's the phone app for that alone, and it's forgotten when you disconnect. You can turn it off under Settings → What you share.
Public servers. If a server's owner lists it in Discover, everyone on Grumble can see its name, picture, banner, description, search words and how many members it has. If they also turn on Show it in search engines, the same things are on a public web page that search engines like Google can find. Its members and messages are never shown.
Things you make and share. A theme or cosmetic you share in Discover shows with your name, to everyone on Grumble and on a public page of its own. Our safety team looks at a cosmetic's picture before it's shared. You can take it back or delete it any time.
Bots and apps in a server can see what's in that server, like any member with the same permissions.
Server moderators. If a server uses AutoMod alerts, a message it blocks or flags is posted, with your name, in the channel its moderators chose. In an encrypted server the alert says only which rule matched, not what you wrote.
Emails we send. The sign-up code (if you sign up in Australia, or ask for one instead of turning the pug), and our replies about a notice you sent through our contact page with an email address, are sent for us by Resend (Plus Five Five, Inc., San Francisco, United States), which delivers them through Amazon Web Services. Resend gets your email address and the email, uses them only to deliver it, and keeps a copy for 30 days. Its own suppliers, all in the United States, are listed at resend.com/legal/subprocessors. Its data processing agreement binds it to this, with the EU's standard contractual clauses (and the EU–US Data Privacy Framework, which it's certified under) for people in the EU. The emails have no tracking in them, so we don't know whether you opened them or clicked anything. Nothing else about you goes to Resend.
Notifications on Android. The Android app's notifications travel through Google's Firebase Cloud Messaging (Google LLC, United States), the way Android apps' notifications usually do. When something arrives for you while Grumble is closed, our server sends Google an empty signal for your phone. It carries no name, no message and nothing about what happened. Your phone then asks our server what it is, and shows it. Google gets your phone's push token and the time of each signal, and nothing else from us. You can turn Grumble's notifications off in Android's settings, and Google gets nothing from us when you're logged out.
App stores. If you get Grumble from the App Store or Google Play, Apple or Google handle that download under their own privacy policies. They don't see anything inside Grumble. In US states whose law requires it (Texas, and from 2027 Alabama, California, Utah and Louisiana), the Android app from Google Play asks Google Play on your phone for your age band and, if a parent supervises your account, whether they've approved Grumble, and the iPhone app asks Apple for your age range. If the store says you're younger than the age you gave us, we lower it to match. Nothing else from Google Play or Apple is kept, and the apps don't ask anywhere else.
GIF search, if we turn it on, sends the words you search for to the GIF provider through our server. Nothing about you goes with them.
Moving from Discord. Your profile and settings come from Discord's data download, read on your device. If you import a server from a Discord template link, or emoji by their links, our server fetches that template or those pictures from Discord at your request, and nothing about you is sent with it. If importing with a bot is ever turned on and you use it, it fetches your server from Discord using a bot you add there, and messages it brings keep their authors' Discord names and pictures (below).
The law. We give information to police, courts or regulators only when the law that applies to us requires it (mostly Australia's, and in some cases the EU's or another country's), and only what we have, which is very little. If we find child sexual abuse material or a threat to someone's life, we must report it.

If your messages were imported from Discord

Where server import is turned on, a server's owner can move the server from Discord to Grumble, and choose to bring its recent messages. If you posted in it, your messages come too, even if you've never used Grumble. That means your Discord display name and profile picture, and the messages and files you posted in the channels they brought, marked "Imported from Discord". Your Discord account id is used only to keep your messages together while the import is unfinished, and isn't kept after that. We keep the messages so the server's members have their history, until the server's moderators delete them, the server is deleted, or Discord asks for what came through its service to be deleted (its developer terms let it), and they're stored in Australia like everything else.

You can have all of them deleted, with your name and picture, or object to us keeping them, without a Grumble account. Use our contact page (pick "My privacy or my data") with a link to one of them, or your Discord name and the server's name. We'll do it within a month.

Reports

When you report something, we keep a copy of what you reported so our safety team can look at it. For an encrypted message, that's the copy you choose to send us, and for one in a server it comes with that message's own key, which lets our safety team open the copy we hold of that one message and check it. The person you report is never told who reported them, and our safety team doesn't see it either. The link between you and a report is deleted 90 days after the report closes.

Your choices and rights

You can see and change your profile and settings in the app at any time.
You can delete any message you've sent.
You can delete your account in your account settings. Everything goes for good, apart from the sign-up note the law makes us keep.
You can see everything we hold about you under Settings → Your data, and download a copy of it, messages included, as a file you can take anywhere.
You can ask us to correct, delete or stop using something, or object to how we use it, through our contact page. We'll answer within a month.
If you're unhappy with how we've handled your information, you can complain to us, through our contact page or by email. If you leave a way to reach you, we'll confirm we have it straight away (within 30 days at the latest), look into it, keep you posted, and tell you what we found.
You can also complain to the Office of the Australian Information Commissioner, to your country's data protection authority in the EU, or to the privacy regulator where you live.

Young people

If you're under 18, here's the short version. We don't track you, show you ads or sell anything about you. We don't know where you are. Your DMs are private, and not even we can read them. If someone makes you uncomfortable, block them and report it. You can see everything we keep about you in Settings → Your data, and delete your account any time.

You need to be 13 or older to use Grumble, and you tell us your age group when you sign up. If you say you're under 13, you can't make an account. Your device remembers that for a day, and nothing is sent to us. If we learn that someone under 13 has an account, we'll delete it. Anyone can report that from the person's profile or one of their messages.

You can delete anything you've posted, any time, by deleting the message or changing your profile. If there's something you posted that you can't remove, ask us through our contact page and we'll remove it. Deleting takes it off Grumble, but it can't undo copies someone else made, like a screenshot.

This website

No cookies, and nothing loads from anywhere else. Even the font is served from here. The suggestions form keeps only what you type into it, and the contact page only what you type into it (see the table above).

We count visits to this website, to Grumble in a browser (only that it was opened, never where in it), to the developer site, and downloads of the apps, so we know how many people come and from where. What's kept is daily totals: how many visits each page had, from which countries, from which websites (their names only), on phones, tablets or computers, and how many were people and how many were bots. Your country is looked up on our own server from your address, which is then forgotten. To count each person once a day, the server mixes your address and browser into a code using a key it throws away at the end of each day. The codes stay in the server's memory and are never written down, so nobody can tell from the totals who visited, or recognise anyone from one day to the next.

Giving to Grumble

You can give to Grumble on our funding page. Giving is separate from Grumble accounts, and nothing about a gift is connected to yours.

PayID. Your bank sends us the name on your bank account, the amount and the description you wrote, as with any bank transfer.
Liberapay. Liberapay, a non-profit in France, takes the payment through Stripe or PayPal, under their own privacy policies. We get the amount, and your name only if you choose to be public.
Crypto. We get only the payment itself. Anyone can see Bitcoin and stablecoin payments on their networks; nobody else can see Monero payments.

We use what comes with a gift only to record it, to thank you, and to keep the business records Australian tax law requires, for five years. We show your name on the funding page only if you ask us to, and we never sell any of it or use it for anything else.

Do Not Track, and selling

There's no tracking on Grumble or this website, so a browser's Do Not Track signal has nothing to switch off, and we treat everyone as if it were on. Nobody else can collect information about what you do on Grumble or this website, over time or across other sites. We don't sell personal information or share it for advertising, and never will. If you're in Nevada, you can still send us a request not to sell yours, through our contact page, which is our designated address for it.

Changes

If we change this policy in a way that matters, we'll tell you in the app first.