Grain has no accounts, analytics, ads, or tracking cookies. The player does not send what you listen to, which theme you pick, or how long you stay.
Settings and your unlock live only in this browser's local storage. That includes the theme, tone, volume, timer, Background mode, and, if you activate one, the license key and the activation id Polar returns. Nothing there is sent while audio is playing.
When you buy Grain Unlock ($19, once), Polar is the seller of record. Polar takes payment, collects any sales tax, and gives you a license key. Polar shares the buyer's email with the seller, and that email is used only for support. Grain never sees your card.
Activating a key sends the key, the public organization id, and a short label such as "Grain web, Safari" to Polar's customer-portal license API. The request does not include a precise device id, an IP address in the metadata, or anything about the session you played. There is no API secret in the page.
A browser that already has a valid key checks it again about once every 30 days, when the page is opened and the network is available. If Polar cannot be reached, the unlock stays. If Polar says the key is no longer valid, the unlock turns off.
Without a license, every theme plays and then fades out at five minutes. Play starts another session. The cap is enforced in the browser. Reloading the page starts the clock over. That is a limit of a browser-only player, not a tracking feature.
After Grain Unlock, a service worker can cache the player so it opens without a network. The cache holds the app shell. It does not phone home.