Privacy Policy

About this policy

Graceup is a gratitude journal with an optional public community. The service operator and controller of personal data processed through our service is Elite Experience SRL, registered in Romania with the Bucharest Trade Registry under no. J2026001200007, tax identification number (CUI) 53231839, with its registered office at București Sectorul 3, Bulevardul 1 Decembrie 1918, Nr. 2, Bl. MY9, Scara 1, Etaj 2, Ap. 9, Romania. Contact us about privacy or your data at hello@graceup.app. Updated 20 October 2026.

Your private journal

Your journal is stored locally on your iPhone, iPad or Android device. On iOS, when iCloud Drive is available, your journal entries, attached photos and legacy videos, saved and written affirmations, affirmation choices, profile and journal preferences also sync to your private iCloud container so they can be restored on your devices. This is available on Free and Pro. Apple processes this storage through your iCloud account. Face ID settings, reminder permissions, purchase credentials and community access credentials are not included in this synced journal. A separate random link secret is stored next to it so your devices can share one purchase identifier. Private entries are not sent to our community service. You can disable iCloud Drive access for the app in device Settings; local journaling remains available. On Android, optional Google Drive sync connects the Google account you choose in Settings > Backup & export. It uploads journal entries, attached photos and legacy videos, profile and journal preferences to private app-data storage in that account. It is available on Free and Pro. Google processes this storage through your Google account. Community and purchase credentials, biometric lock and notification permissions are excluded. A separate random link secret is stored there so your devices can share one purchase identifier. You can pause Drive sync in Backup & export. Exported backups are separate copies.

Application analytics

We use PostHog in its European region to measure application use. Our Cloudflare service forwards metadata about sessions, screens, onboarding, journal creation and deletion, Explore interactions, affirmation use (which affirmations and categories are viewed, saved, shared or written to), purchase outcomes and error categories. Journal measurement includes hashed entry identifiers, change timestamps and whether entries still exist, including private entries. These records use the app’s random identity and contain platform, app version and session identifiers. Copies of the same entry count once across devices; usage identities may differ between devices. Analytics never includes entry text, the words of affirmations you write, questions, photographs, videos, names, profile photographs or raw error messages. Offline metadata is retained locally and retried. Historical entries and retained deletion records may be counted after an update; unmeasured historical usage cannot be reconstructed. Deleting an entry updates its presence; Delete all data submits deletion of the installation’s analytics identity and associated events. Deletion is queued and retried independently of journal deletion; we retain the anonymous identifier and request timestamp until it is accepted. PostHog processes this deletion asynchronously. We do not enable session replay or advertising tracking.

Camera, photos and reminders

The camera is used only when you choose to take a photo and grant camera permission. The system photo picker gives the app access to the photos you select, not your entire photo library. Selected photos are stored with your journal and are sent to our community service only when you share that entry publicly or with a group. Your profile photo is not displayed in the public community. It is sent to our service only when you use it in groups, and only members of your groups can see it. Daily reminders use local notifications with your permission. Face ID, Android biometrics or your device credential are checked by the operating system; we do not receive biometric templates. On iOS, affirmation reminders also use local notifications with your permission; their words are chosen on your device. Saving an affirmation picture asks iOS for permission to add it to your Photos library; the app cannot read your library this way. You can change camera, notification and biometric permissions in device Settings.

Anonymous community identity

There is no email or password login. When the app reports analytics or you use the community, we create a random identifier and store an access credential in the iOS Keychain or encrypted Android storage protected by Android Keystore. Our server stores a hash of that credential. Anonymous means your name is not displayed publicly; your activity is still linked to this identifier. In groups you create or join, the other members of that group see the name and profile photo you choose and your current streak, as a number of days. Reinstalling the iOS app may preserve Keychain credentials. On Android, uninstalling the app or clearing its storage removes the local community credential; it is not included in Google Drive journal sync. Losing the credential may prevent recovery of your community identity.

Choosing Public Feed sends the entry text, attached photos and selected country to our Cloudflare service. Public posts and private messages are screened by rule-based filters on our server. Flagged text awaits moderator approval before publication. Photos are published when the accompanying text passes these filters, including photo-only posts. Photos are not automatically checked for visual content; moderators investigate reported photos. We do not send submissions to third-party AI services. We also store private messages, legacy comments, reactions, blocks, submission dates and moderation status. Reports include the reported text, reason, details and identifiers needed to investigate. Approved public posts and their country are visible to other community members. Sharing with one of your groups sends the entry text and attached photos to our Cloudflare service and shows them, with your group name and profile photo, only to members of that group. Moments shared only with groups appear there without the public filters; members can report them. We store each group’s name, type, photo, invite code and member list. Anyone with a group’s invite code or link can join it, up to 50 members, so share invitations only with people you trust. When you leave a group, its members no longer see your moments there. A private message is delivered only to the user who posted it, with the sender’s selected country and no name or profile photo. The recipient cannot reply. Messages are stored on our server, are not end-to-end encrypted, and moderators can access them for safety review. Old public comments are no longer displayed and are not converted into private messages. Moderators can access submissions, photos and reports. Do not include personal information you do not want to disclose.

Country and network information

The app detects an approximate country from your internet connection through our Cloudflare service, with api.country.is as a fallback. The fallback provider receives your IP address when used. We save the country with your community identity and use it to complete missing country information on your earlier shared moments, messages and reactions. Only recognized country names are stored; if the text you enter is not a country, we use your saved or detected country instead. You can correct the country in My profile. We do not request GPS location. Cloudflare processes network and request information to deliver and protect the service. To limit abuse when you create a community identity or redeem an access code, we store a hash of the connecting network (your IP address, or its /64 block for IPv6), never the address itself and never as your public identity. These rate-limit records are deleted within about an hour after their time window ends.

Why we use data

We use your submissions and anonymous credential to provide the community you request. We process reports, blocks and limited technical information to protect members, moderate content and prevent abuse. These purposes rely on providing the service and our legitimate interests in operating a safe community. Optional device permissions can be withdrawn in device Settings. We do not sell your journal or use it for advertising.

Providers and purchases

Cloudflare hosts the community API, database, media storage and rule-based content filters. The database and photo bucket are configured in the EU; delivery and security processing may involve Cloudflare infrastructure elsewhere. Country lookup is provided by country.is. Apple handles App Store payments on iOS; Google handles Google Play payments on Android. We use RevenueCat to display subscription offers, validate purchases, restore subscriptions and determine access to Pro. RevenueCat processes a private app user identifier, purchase and subscription records, and technical information such as device type, operating system and last app activity. Our server links this private identifier to your anonymous community identity to verify access to paid photo sharing. Devices that use the same journal can share one purchase identifier through a random link secret kept in your private iCloud or Google Drive app storage; our server stores only a hash of that secret and removes unused links after 30 days. The purchase identifier is not displayed publicly. Our app does not send your journal entries, photos, videos, profile name or profile photo to RevenueCat. We do not receive your card details. RevenueCat processes service data on our behalf, including on infrastructure in the United States. More information: https://www.revenuecat.com/privacy. If you email support, your email provider and our mail provider also process that message.

Retention and deletion

Local data stays until you delete it. Community content, pending or rejected submissions, reports and moderation records stay until deleted. A shared moment that is never finished (for example, when its first upload is interrupted) is deleted automatically after about 24 hours. A moment that was already shared is never deleted this way, even if a later edit is not finished. A record that you reacted to a moment is kept for 30 days, even if you remove the reaction, so the author is not notified repeatedly. Devices that have already shown a public photo may keep a private cached copy for up to 1 hour after it is removed. Settings > Delete all data removes the identity, its posts and photos, group memberships, group name and profile photo, groups left without members, private messages, legacy comments, reactions, blocks, related reports and moderation records from active storage, then clears local app data. If this device has used iCloud or Google Drive sync, deletion also erases the synced journal, its photos and the purchase link secret. This happens right away when the cloud is reachable, or the next time this device syncs with the same Apple or Google account. Your other devices that use the same journal delete their own community identities the next time they sync. Keep the original Apple or Google account signed in until the cloud copy is erased. Minimal deletion markers prevent older device copies from restoring deleted entries. Apple and Google may retain recovery copies according to their service policies. Deletion can be retried after an interruption. Cloudflare database recovery copies may retain deleted records for up to 7 days on our current plan. Exported backups, device backups and copies saved by other people are outside this deletion. Support correspondence is retained while needed to handle the request and any applicable obligations. The in-app deletion action does not automatically delete purchase records held by Apple, Google or RevenueCat and does not cancel an App Store or Google Play subscription. Contact hello@graceup.app to request deletion of subscription-related data we control; we may need information to locate the relevant purchase record. Some records may need to be retained to meet legal obligations.

Your choices and rights

You can keep entries private, export your journal, edit your selected country, report content, block members and delete your data in Settings. Depending on applicable law, you may request access, correction, deletion, portability, restriction or object to processing by emailing us. We may need information to establish control of an anonymous identity; do not email your access credential. You may complain to your local data protection authority, including ANSPDCP in Romania. The app is not directed at children under 16.

Changes

Material changes to data use will be explained in the app before they take effect. Contact hello@graceup.app for questions or deletion assistance.

This website

graceup.app uses our own first-party analytics, EliteData, to understand how the site is used. It records the pages you visit, the page you came from, how far you scroll, clicks on buttons such as the App Store and Google Play links and an approximate location (country, region and city) derived from your IP address. It stores nothing on your device: no cookies and no local storage. To count visits without tracking you over time, it combines your IP address and browser type with a secret value that changes every day into a one-way code, so the same visitor looks new the next day. Your IP address is also used to estimate that location and to filter out bots. We do not use advertising cookies and we do not sell this data.

Links to the App Store and Google Play take you to Apple and Google, whose own privacy policies apply. Emails you send to hello@graceup.app are used only to answer you.