Privacy Policy

Last updated October 25, 2026  ·  Grist is operated by Shotdrum Studios, LLC.

1. Who we are

Grist is a homebrewing app for iPhone, iPad, Mac, Apple Watch, and the web, published by Shotdrum Studios, LLC ("we", "us"). This policy covers the Grist apps, the Grist web app at web.gristbrew.app, and the Grist backend service. Questions go to hello@gristbrew.app.

2. What we collect

Account information

Grist accounts are managed with Amazon Cognito. Depending on how you sign in, we receive:

• Email address — always. It is the canonical identifier for your account. If you use Sign in with Apple and choose "Hide My Email," we only ever see Apple's private relay address, never your real one.
• Name — if Apple or Google passes it to us at sign-up, and only if you allowed it. You can also enter your name yourself in Settings, where it becomes part of your brewery profile and syncs with the rest of your data.
• A stable internal user ID that we generate. Everything else is filed under that ID.

If you sign in with more than one method using the same verified email address, we link them to a single account so you don't end up with duplicates.

We never see or store passwords. Email sign-in uses a one-time code; Apple and Google sign-in are handled by those providers.

Your brewing data

This is the content you create in Grist: batches, recipes, ingredients and inventory, brew logs and readings, competitions, competition entries, scoresheets and results, your Master Homebrewer Program (MHP) profile and progress, and your brewery details. It also includes any photos you attach to a recipe or batch, and your brewery logo if you upload one. We store all of it so your devices can stay in sync and so you can get to it from any browser.

Purchases and subscriptions

We record whether your account has an active Grist Pro entitlement, and the identifiers needed to keep that status accurate — an App Store transaction identifier for in-app purchases, or a Stripe customer and subscription identifier for web purchases. We never receive or store your card number. Payment details go directly to Apple or to Stripe.

Diagnostics

The Grist apps send diagnostics to Sentry so we can find and fix problems. Everything Sentry receives is filed under your account's internal user ID, so we can tell whether a bug is hitting one person or everyone, along with the app version, the device model and OS version, and the IP address it was sent from. Sentry derives an approximate region from that IP address — typically a country or state — which helps us tell whether a problem is specific to one network or region. Grist never requests your device's location and does not use location services. Sentry receives:

• Crash and error reports: the error and a stack trace. These may incidentally contain fragments of your data where it was involved in the error.
• Performance data: how long screens, syncs, and network requests take (including the address each request went to, such as Grist's servers or a service you connected), and where the app spends its time.
• App logs and counters: operational messages such as whether a sync succeeded, and counts of events such as a feature being opened or a form being abandoned. These record that something happened, not what you entered.
• Session replays, on iPhone and iPad: a low-frame-rate reconstruction of the screens you move through and where you tap, about one frame per second, so we can see what led up to a bug. All text and images are masked before a replay leaves your device, so it shows the layout of each screen but not your recipes, notes, photos, or other words on screen.

Feedback you send us

When you use Send Feedback in the app, your message, any attachments you add, and the name and email address if you choose to fill them in go to Sentry, together with your account's internal user ID, so we can read and reply to it. Nothing is sent unless you submit the form.

Usage analytics

The Grist apps for iPhone, iPad, and Mac send product analytics to PostHog so we can see which features get used and where the app breaks. This is filed under your account's internal user ID, not your email address. PostHog receives:

• the screens you open, and when the app is installed, opened, or sent to the background
• a note when you complete certain actions, such as creating a competition, saving an entry or scoresheet, importing a scoresheet, finishing a packaging run, buying a subscription, sending feedback, or asking Sight a question. These record that the action happened, not what you entered.
• how long Sight answers and scoresheet imports take, and the error message if one fails. Never your question, the scoresheet, or the generated answer.
• how many records each sync sent and received, and whether it succeeded
• crash reports
• the app version, device model, and OS version
• whether your account is one of our own internal or test accounts
• the IP address the data was sent from, and the approximate region PostHog derives from it

The Grist web app at web.gristbrew.app sends PostHog a smaller set, filed under your account's internal user ID once you sign in, and under a random identifier kept in your browser's local storage before then:

• the pages you open, recorded as the kind of page (for example "a batch"), never the full web address or anything in it
• a note when you complete certain actions, such as asking Sight a question, saving or importing a scoresheet, creating or importing a competition, saving a competition entry, adding an inventory item, opening the tap display, starting checkout, or buying a subscription. These record that the action happened, not what you entered.
• whether your account is on Grist Free or Grist Pro, and how Pro was obtained
• whether your account is one of our own internal or test accounts
• your browser, operating system, device type, and screen size
• the IP address the data was sent from, and the approximate region PostHog derives from it

The web app does not record your screen or capture your clicks automatically, and it does not send the page you came from or any campaign tags in the address. It sets no analytics cookies.

PostHog does not receive your email address, your name, or your brewing data, from the apps or the web app, and it does not record your screen. The Apple Watch app does not send usage analytics.

Services you connect on purpose

Some features only work if you connect an outside account. These are entirely opt-in and are covered in section 6.

Cohort comparison, if you opt in

If you turn on cohort contribution, we copy data about your scored competition entries into a separate analytics store. This is off by default. Section 5 explains what is copied and who can see it.

What we don't collect

No advertising identifiers. No marketing or advertising SDKs, and no analytics beyond the diagnostics and usage analytics described above. No location tracking — we never request your device's location. No photo-library access — we only receive the specific images you choose to attach. No contacts or health data. No cross-app or cross-site tracking of any kind.

3. How we use your information

• To run the service — authenticate you, sync your data between devices, and serve the features you use.
• To provide Grist Pro — check entitlement and keep subscription status current.
• To run cohort comparison, only if you opt in — build the summaries other brewers see, and let us query the pseudonymized analytics store to check and improve the feature (section 5).
• To keep Grist working — diagnose crashes, fix bugs, and prevent abuse (including rate limits on expensive features).
• To answer your feedback — read what you send through Send Feedback and reply if you included an email address.
• To improve Grist — use the usage analytics in section 2 to see which features people use and where they get stuck.
• To contact you — account and transactional messages such as sign-in codes, receipts, and important service notices.

We do not use your brewing data for advertising, and we do not sell or rent it. We do not use your data to train machine-learning models, and our AI provider does not train on it either (see section 4).

4. AI features (Sight, scoresheet import, and complaint tagging)

Grist's AI features are Sight, scoresheet import, and the tagging of judge comments for cohort comparison. All three are powered by Anthropic's Claude API.

Sight. When you ask Sight a question or open an AI-generated insight:

• Your device sends the request to our backend — not to Anthropic directly.
• Our backend assembles the relevant facts from your own stored brewing data, computes what it can deterministically, and sends that grounded context plus your question to Anthropic.
• Anthropic returns an answer, which we stream back to your device. We don't keep the generated answer beyond what's needed to deliver it.

Scoresheet import. When you upload a judged scoresheet PDF (a Grist Pro feature):

• Your device sends the PDF to our backend, which sends it to Anthropic, both its text and images of its pages, so the scores, comments and checkbox marks can be read.
• A scoresheet usually includes details about the judges who filled it in, such as their names, BJCP IDs and ranks. Some sheets also print contact details. We remove email addresses from the results before they come back to you.
• We don't store the PDF. You review what was read before anything is saved, and only the scoresheet details you confirm become part of your brewing data.

Complaint tagging. This only happens if you contribute to cohort comparison and have AI features turned on. Our backend sends the judge comments on your scoresheets to Anthropic, which picks tags such as "thin body" from a fixed list. We keep only the tags, not the comment text, and we don't log it. Section 5 has the details.

Anthropic processes this data as our service provider under its commercial API terms. Anthropic does not use your data to train its models — not the questions you ask Sight, not the brewing data we send as context, not the scoresheets you upload, not the judge comments we tag, and not the answers it generates. Neither do we. Only the data needed for the specific question is sent; Sight does not ship your whole account.

Grist asks for your permission before the first time any of these features sends your data, and you can turn AI features off at any time in Settings → AI Features (or from the Account page on the web). While they are off, nothing is sent.

AI output can be wrong. Don't rely on it for anything with a safety, health, or food-safety consequence.

5. Comparing your beer with other brewers (optional)

Cohort comparison is a Grist Pro feature. It shows how award-winning beers in a style differ from beers that drew the same judge complaint, for example "winners in this style tend to mash a few degrees higher." It is off by default, and you can only view comparisons if you also contribute. Contributing does not require Grist Pro. Whether you turn it on or off has no effect on any other part of Grist.

What we copy when you opt in

If you turn on cohort contribution, we copy data about your scored competition entries into a separate analytics store, kept apart from your account data. For each scored entry, this includes:

• your score, and whether the entry placed or won best of show
• the BJCP style it was judged in
• the year of the competition (not the date)
• the complaint tags described below
• recipe and process details where you have them, such as gravity, bitterness, mash and fermentation temperatures, hop and grain proportions, and water profile

We do not copy your name, email, or account ID. We do not copy recipe, batch, or competition names, judge names, exact dates, or any text that you or a judge wrote.

Opting in includes your past entries as well as new ones. The analytics store is rebuilt from scratch every night. If you opt out or delete your account, the next nightly rebuild leaves your data out, so it is usually gone from the store within about a day. If a nightly run fails, the previous day's data stays until the next successful run. Any summaries already shown to other brewers are rebuilt without you at the same time.

A scrambled ID instead of your account ID

The analytics store identifies each contributor by a keyed hash. This is a scrambled value computed from your account ID with a secret key that is held in AWS Key Management Service. The same account always gets the same value, so the store can tell your entries apart from other brewers', but the value is not your account ID. It works as a pseudonym: it is persistent and specific to your account, and it is not anonymous.

Only the two Grist services that need the key can use it. The people who run Grist can query the analytics store, but they see contributors only by their hash. Normal operator access cannot compute the hash for a given account.

There are limits to that, and we want to be clear about them. Whoever controls the AWS account has administrator powers and could change the key's access rules on purpose to let themselves compute the hash. That is a break-glass step, not normal access. AWS audit logs would record it, and we do not do it. So we are not saying computing the hash is impossible, only that normal access does not allow it.

Judge comments and AI

Complaint tags, such as "thin body" or "low hop aroma", come from two places:

• The flaws checked on your scoresheet. These are always used.
• Your scoresheet comments, only if you have also turned on AI features (section 4). In that case we send the comment text to Anthropic, our AI provider, to choose tags from a fixed list. The comment text is not stored in the analytics store and is not logged. We keep the tags plus a keyed fingerprint of the text. The fingerprint tells the nightly rebuild whether a comment has changed, so we don't have to keep the comment itself.

If you don't use AI features, your comments are never read for this purpose. If you turn AI features off later, the tags that came from comments are removed, usually at the next nightly rebuild.

Other brewers only see groups of at least three

You never see another brewer's recipe, and they never see yours. What you see are summaries across a group of brewers. We only show a comparison when each side of it has at least three other brewers, not counting you. Each brewer counts once, however many entries they have. We round the values and show medians and ranges rather than averages or extremes. We never show how many brewers are in a group.

The risks that remain

These protections reduce the risk of identifying you. They do not remove it. We think you should know the remaining risks before you opt in:

• Matching by content. The analytics store and your synced brewing data both exist. Someone with access to both could match an entry in one to an entry in the other by its contents, such as the style, year, score, and recipe details. This is easier in a style with few contributors. Grist also keeps a list of which accounts have opted in. The key protects the hash, but it does not prevent this kind of matching.
• Small groups. In a group of only three brewers, a median we show can be one brewer's rounded value. A percentage can also give away how many of the three did something. For example, "65%" of three brewers means two of them.
• Changes from night to night. Someone who saved the summaries every night and compared them could notice when a new brewer joined a group, and could learn something about that brewer's values.

If you are not comfortable with these risks, please don't opt in. You can opt out at any time.

6. Who we share data with

We share data only with the service providers that make Grist work, and only what each one needs. We do not sell personal information, and we do not share it for cross-context behavioral advertising.

Optional integrations you choose to connect

• Brewfather and Brewer's Friend — if you connect one, Grist uses your credentials to import your recipes and batches from that service. Disconnect at any time in Settings.
• Google Sheets — if you use MHP sheet sync, Grist reads the specific spreadsheet you point it at, and nothing else in your Drive. Access is read-only: we never write to, modify, or delete your spreadsheet.

Each of these services has its own privacy policy governing what it does with your data on its side.

Other disclosures

We may disclose information if legally required (a subpoena, court order, or similar), to protect our rights or someone's safety, or as part of a merger or acquisition — in which case we'll notify you before your data becomes subject to a different privacy policy.

7. How we protect your data

• All traffic between your devices and our servers is encrypted with TLS.
• Data at rest is encrypted by our cloud provider.
• Every account's synced data lives in its own partition, and every request is authenticated against a signed token scoped to your account. The cohort analytics store is the one place where data from many accounts sits together. It holds only brewers who opted in, keyed by the hash described in section 5.
• Access to production systems is limited to those who need it to operate the service.

No system is perfectly secure, and we can't guarantee absolute security. If a breach affects your data, we'll notify you as required by law.

8. Retention and deleting your account

You can delete your Grist account yourself, at any time, from Settings in the Grist app or the web app. No email, no support ticket, no waiting on us.

When you delete your account:

• Your account and all of your synced brewing data are removed from our live systems immediately.
• If you contributed to cohort comparison, your entries and comment tags drop out of the analytics store at the next nightly rebuild, usually within about a day. Results of our own queries against that store are deleted automatically after one day.
• Residual copies in encrypted backups are purged within 30 days.
• Diagnostics associated with your account (crash reports, performance data, logs, and session replays) and feedback you sent are deleted on Sentry's retention schedule (90 days).
• We ask PostHog to delete your usage analytics: your analytics profile and every event filed under it. If that request fails, we retry it daily until it succeeds. PostHog carries out the deletion on its side, which can take a few days to finish.
• We retain purchase and tax records where the law requires it. These contain a transaction identifier and amount — not your brewing data.

Deleting your Grist account does not cancel a subscription bought through Apple. Manage that in your Apple ID subscription settings. Subscriptions bought on the web are cancelled as part of deletion.

Data stored locally on your device is removed when you delete the app. While your account is active, we keep your data until you delete it — we don't expire accounts for inactivity without telling you first.

9. Your rights

Wherever you live, you can:

• Access and export your brewing data. Email us and we'll provide a machine-readable copy of everything on your account.
• Correct anything inaccurate — you can edit your data directly.
• Delete your account and data yourself (section 8).
• Withdraw consent for cohort contribution or AI features at any time in Settings. If you stop contributing, your data leaves the analytics store at the next nightly rebuild. If you turn off AI features, your comment-derived tags leave it (sections 4 and 5).

If you're in the EEA or UK, you also have rights to restrict or object to processing and to data portability under the GDPR. Our lawful bases are performance of our contract with you (running the service), our legitimate interests (security, debugging, abuse prevention, and usage analytics), and your consent (cohort contribution and AI features). If you're in California, the CCPA/CPRA gives you rights to know, delete, correct, and opt out of sale or sharing — we don't sell or share personal information, so there is nothing to opt out of. We will not discriminate against you for exercising any of these rights.

To exercise a right that isn't self-serve, email hello@gristbrew.app. We respond within 30 days.

10. Age requirements

Grist is not directed to children. You must be at least 13 years old to create an account, and because Grist is a homebrewing app, you must be of legal drinking age where you live (21 in the United States) to use it. We don't knowingly collect information from children under 13; if we learn we have, we delete it. If you believe a child has given us information, email hello@gristbrew.app.

11. Where your data lives

Grist's servers are in the United States. If you use Grist from outside the US, your data is transferred to and processed in the US, which may have different data-protection laws than your country. By using Grist you consent to that transfer.

12. Changes to this policy

We'll update this page when our practices change, and revise the "last updated" date above. For material changes — anything that meaningfully expands how we use your data — we'll notify you in the app or by email before the change takes effect.

13. Contact

Shotdrum Studios, LLC
hello@gristbrew.app

See also the Terms of Service.