Privacy Policy

1. Scope and contact

This policy explains how Gritwood City handles personal information in its website, beta access process, and available member features.

Gritwood City is currently operated by Michael E. Harris, who can be contacted at mharris@gritwoodcity.com. Gritwood City Inc. is planned and has not yet been formed.

The policy covers our handling of information. Independent filmmakers, other members, and external websites may handle information under their own practices after receiving it from you.

2. Information we collect

We collect information you provide and information generated when you use available features. You do not have to use every feature.

Other participants may supply information about you in invitations, messages, reports, or project arrangements. Do not upload government identification, Social Security numbers, financial account credentials, or unrelated sensitive documents through ordinary profile, application, or message fields. We do not ask for a date of birth, and no feature verifies a person's identity, background, or credentials.

3. Why we use information

We use information to evaluate beta access requests; create and secure accounts; present profiles and projects; deliver applications and messages; coordinate casting and schedules; provide requested notifications; support users; investigate abuse; keep administrative records; troubleshoot the service; and meet legal obligations.

We use policy acceptance records to establish which document versions were presented and accepted. We use referral information to understand how people find the beta. A request for beta access is not permission for unrelated marketing.

4. Who can see information

Your chosen audience. In the current beta, no member profile, headshot, application, or message is published to a public page. Profiles are created as drafts, publication is not self-service, and the database has no public-read path to them. The public pages that show actors and productions today display demonstration content, not real member submissions, and say so.

Public visibility of real casting listings is a separate feature that is not switched on. If it is enabled, a project and its roles become readable by visitors and search engines while the listing is open, and we will describe that before it applies to your listing. Do not assume that a beta label makes anything confidential; check the visibility description before submitting material.

Relevant participants. Filmmakers receive the applications and materials you submit for their opportunities, including the headshots attached to those applications. People in a conversation receive its messages. Scheduling participants receive information needed to coordinate the relevant appointment. These features are not intended to expose one applicant's private submissions or timetable to unrelated applicants.

Authorized administration. Authorized operators and reviewers may access information needed for support, access decisions, moderation, security, and administration. Administrative privileges are restricted by role, and administrative actions are written to an append-only audit record. Private messages are not described as end-to-end encrypted and may be accessed for legitimate support, safety, or legal purposes.

Service providers. Providers supporting hosting, authentication, databases, media storage, security, and email process information to deliver those services for us. The beta uses Supabase for authentication, database, and private media storage; Resend for outbound application and notification email; Cloudflare in front of the site for DNS, TLS, and request handling; Hostinger for the server that runs the application; and Google Workspace for the gritwoodcity.com mailboxes that receive correspondence. Each provider receives what its function requires, and connection and request information necessarily reaches the providers in that path. This list describes the current deployment and will be updated when it changes.

Legal and safety purposes. We may disclose information when required by law or reasonably necessary to address fraud, threats, security incidents, legal claims, or protection of rights and safety, subject to applicable law.

Business transition. If platform operations or assets transfer to a formed company or another operator, information may transfer as part of that change, subject to applicable law, appropriate notice, and any required consent. This policy does not authorize unrelated use of the transferred information.

5. Calendar downloads, notifications, and external links

A calendar download may include your name, appointment time, project information, physical location, or meeting link. If you import or share that file, the recipient and calendar provider receive that information. Gritwood City cannot automatically recall the file, erase a recipient's copy, or update it after a schedule changes. Review the destination calendar's sharing settings.

Email notifications are also copies outside the platform. Deleting platform information does not erase a delivered email. Linked or embedded media, external meeting services, and other third-party destinations may collect information according to their own policies. Loading third-party content may disclose your IP address and browser information to that provider.

6. Cookies, local storage, and preferences

The service uses browser storage and similar mechanisms for authentication, session security, and interface preferences. Signing in sets session cookies managed by our authentication provider. A small cookie records only that a session exists, so the page can render signed-in navigation without a flash of the wrong state. Browser local storage holds interface preferences, including a leftover prototype key that selects the site's colour treatment and a remembered role view; the site removes those keys when you sign out.

Blocking essential storage may prevent sign-in or other features from working. An interface preference is not proof that you are authenticated and does not grant access to private information — access is decided on the server.

The current deployment does not sell personal information, use it for targeted advertising, or load advertising or analytics trackers. No analytics script is served. If optional analytics or other nonessential tracking is introduced, we will describe it and provide any required choices before it operates. This statement must match the actual deployment; it is not permission to run undisclosed tracking.

7. AI and reuse of creative work

We do not authorize use of your headshots, voice, auditions, scripts, or private messages to train general-purpose AI models or create synthetic performances merely because you submit them to Gritwood City. We do not sell those materials as training data. A future AI feature involving personal or creative material must explain the processing and obtain any necessary permissions before use.

8. Retention and deletion

We retain information for the purposes described above and as needed for legal obligations, security, and disputes. Retention depends on the information and its use; account activity is not a reason to keep every record forever. We keep a written internal retention schedule that records the purpose for each category and what triggers its review.

Beta requests are kept while under consideration or on an active waitlist and for a reasonable period needed to manage that process. Requests from people who never join are subject to periodic review for deletion or de-identification when no longer needed. Account and collaboration records are retained while needed to provide the service and handle relevant obligations. Scheduling details, especially precise locations and meeting links, should not be retained longer than their operational or documented legal purpose requires.

After a verified deletion request, we remove or de-identify information that we no longer need and explain material exceptions. Limited records may remain to document consent, prevent abuse, preserve relevant audit history, resolve disputes, or satisfy law. The administrative audit record is append-only by design: it documents what was done to an account, including by us, and is not erased on request. Shared records may also be relevant to another participant. Backups may retain copies until their ordinary replacement cycle; they are not intended for routine use after deletion.

We do not promise instant deletion from all systems or copies held by independent recipients, and we do not operate automated deletion tooling that guarantees a fixed deadline. Contact us for an explanation of retention affecting your request.

9. Your choices and requests

Use available profile and notification settings to manage information and optional notices. You may request access to your personal information, correction, account closure, or deletion by emailing legal@gritwoodcity.com from your account address. You may also ask for a copy in a practical format. Requests are handled by a person reading that mailbox, not by an automated self-service tool. We may need proportionate information to verify that the request comes from you; do not send identification documents unless we specifically explain why they are necessary and provide an appropriate method.

We will evaluate requests and respond within applicable legal time limits. Some requests may be limited by legal obligations, another person's rights, security, or information outside our control. We will explain a refusal where required. You may ask us to review a decision and contact the relevant regulator. Additional rights may apply depending on where you live and which laws apply; this policy does not limit them.

Optional promotional messages, if offered, will provide an opt-out. Essential account, security, and requested service messages may still be necessary. We do not treat acceptance of this Privacy Policy as blanket consent to marketing or every possible future use of information.

10. Security and location of processing

We use technical and organizational safeguards appropriate to the service, including authentication, row-level access rules in the database, restricted administrative privileges, and a private media bucket that is not publicly readable. Traffic to the site is served over TLS. We do not claim that stored content is end-to-end encrypted, and no internet service can guarantee absolute security. Notify us of suspected unauthorized access without publicly posting sensitive evidence.

Gritwood City is operated from the United States. Information may be processed in the United States and in locations used by our providers. Applicable protections depend on the processing and relevant law; visiting the site does not waive legal privacy rights.

11. Age restriction

The beta is for adults aged 18 or older. We ask for a confirmation of age eligibility and do not knowingly invite minors to register. If you believe a minor has submitted personal information, contact us so we can investigate and take appropriate action. Do not submit a minor's headshot or profile through an adult account.

12. Updates

We will post updates with a new version and effective date. For material changes, we will provide appropriate notice and obtain consent where required before making a new use that requires it. A change of operator will be identified clearly.

13. Contact

Privacy, data and account-rights requests: legal@gritwoodcity.com. Safety concerns: safety@gritwoodcity.com. Ordinary account and product help: support@gritwoodcity.com. The operator, Michael E. Harris, can be reached at mharris@gritwoodcity.com.

Each of these addresses is an existing monitored mailbox. Requests are read and answered by a person; none of them is an automated intake system.