Privacy Policy

About this policy

Graceup is a gratitude journal with an optional public community. The service operator and controller of personal data processed through our service is Elite Experience SRL, registered in Romania with the Bucharest Trade Registry under no. J2026001200007, tax identification number (CUI) 53231839, with its registered office at București Sectorul 3, Bulevardul 1 Decembrie 1918, Nr. 2, Bl. MY9, Scara 1, Etaj 2, Ap. 9, Romania. Contact us about privacy or your data at [email protected]. Updated 4 November 2026.

Your private journal

Your journal is stored locally on your iPhone, iPad or Android device. On iOS, when iCloud Drive is available, your journal entries, attached photos and legacy videos, saved and written affirmations, affirmation choices, profile and journal preferences also sync to your private iCloud container so they can be restored on your devices. This is available on Free and Pro. Apple processes this storage through your iCloud account. Face ID settings, reminder permissions, purchase credentials and community access credentials are not included in this synced journal. A separate random link secret is stored next to it so your devices can share one purchase identifier. Private entries are not sent to our community service. You can disable iCloud Drive access for the app in device Settings; local journaling remains available. On Android, optional Google Drive sync connects the Google account you choose in Settings > Backup & export. It uploads journal entries, attached photos and legacy videos, profile and journal preferences to private app-data storage in that account. It is available on Free and Pro. Google processes this storage through your Google account. Community and purchase credentials, biometric lock and notification permissions are excluded. A separate random link secret is stored there so your devices can share one purchase identifier. You can pause Drive sync in Backup & export. Exported backups are separate copies.

Application analytics

We use PostHog in its European region to measure application use. Our Cloudflare service forwards metadata about sessions, screens, onboarding, journal creation and deletion, Explore interactions, affirmation use (which affirmations and categories are viewed, saved, shared or written to), purchase outcomes and error categories. Journal measurement includes hashed entry identifiers, change timestamps and whether entries still exist, including private entries. These records use the app’s random identity and contain platform, app version and session identifiers. Copies of the same entry count once across devices; usage identities may differ between devices. Analytics never includes entry text, the words of affirmations you write, questions, photographs, videos, names, profile photographs or raw error messages. Offline metadata is retained locally and retried. Historical entries and retained deletion records may be counted after an update; unmeasured historical usage cannot be reconstructed. Deleting an entry updates its presence; Delete all data submits deletion of the installation’s analytics identity and associated events. Deletion is queued and retried independently of journal deletion; we retain the anonymous identifier and request timestamp until it is accepted. PostHog processes this deletion asynchronously. We do not enable session replay. Ad measurement is described below.

Camera, photos and reminders

The camera is used only when you choose to take a photo and grant camera permission. The microphone is used only when you record a voice note and grant microphone permission. Voice notes are stored with your journal and are sent to our community service only when you share that moment with a group. The system photo picker gives the app access to the photos you select, not your entire photo library. Selected photos are stored with your journal and are sent to our community service only when you share that entry publicly or with a group. Your profile photo is not displayed in the public community. It is sent to our service only when you use it in groups, and only members of your groups can see it. Daily reminders use local notifications with your permission. Face ID, Android biometrics or your device credential are checked by the operating system; we do not receive biometric templates. On iOS, affirmation reminders also use local notifications with your permission; their words are chosen on your device. Saving an affirmation picture asks iOS for permission to add it to your Photos library; the app cannot read your library this way. You can change camera, microphone, notification and biometric permissions in device Settings.

Anonymous community identity

There is no email or password login. When the app reports analytics or you use the community, we create a random identifier and store an access credential in the iOS Keychain or encrypted Android storage protected by Android Keystore. Our server stores a hash of that credential. Anonymous means your name is not displayed publicly; your activity is still linked to this identifier. In groups you create or join, the other members of that group see the name and profile photo you choose and your current streak, as a number of days. Reinstalling the iOS app may preserve Keychain credentials. On Android, uninstalling the app or clearing its storage removes the local community credential; it is not included in Google Drive journal sync. Losing the credential may prevent recovery of your community identity.

Choosing Public Feed sends the entry text, attached photos and selected country to our Cloudflare service. Public posts and private messages are screened by rule-based filters on our server. Flagged text awaits moderator approval before publication. Photos are published when the accompanying text passes these filters, including photo-only posts. Photos are not automatically checked for visual content; moderators investigate reported photos. Moderation does not send submissions to third-party AI services. We also store private messages, legacy comments, reactions, blocks, submission dates and moderation status. Reports include the reported text, reason, details and identifiers needed to investigate. Approved public posts and their country are visible to other community members. Sharing with one of your groups sends the entry text, attached photos and voice note to our Cloudflare service and shows them, with your group name and profile photo, only to members of that group. A voice note is never sent with a public moment: it is removed from our server when the moment becomes public or is deleted. Moments shared only with groups appear there without the public filters; members can report them. We store each group’s name, type, photo, invite code and member list. Anyone with a group’s invite code or link can join it, up to 50 members, so share invitations only with people you trust. When you leave a group, its members no longer see your moments there. A private message is delivered only to the user who posted it, with the sender’s selected country and no name or profile photo. The recipient cannot reply. Messages are stored on our server, are not end-to-end encrypted, and moderators can access them for safety review. Old public comments are no longer displayed and are not converted into private messages. Moderators can access submissions, photos, voice notes and reports. Do not include personal information you do not want to disclose.

Country and network information

The app detects an approximate country from your internet connection through our Cloudflare service, with api.country.is as a fallback. The fallback provider receives your IP address when used. We save the country with your community identity and use it to complete missing country information on your earlier shared moments, messages and reactions. Only recognized country names are stored; if the text you enter is not a country, we use your saved or detected country instead. You can correct the country in My profile. We do not request GPS location. Cloudflare processes network and request information to deliver and protect the service. To limit abuse when you create a community identity or redeem an access code, we store a hash of the connecting network (your IP address, or its /64 block for IPv6), never the address itself and never as your public identity. These rate-limit records are deleted within about an hour after their time window ends.

Suggestions page

graceup.app/sugestii lets anyone suggest ideas for Graceup, vote for them and comment on them without an account. Your browser keeps a random code so you can vote once per suggestion and delete your own suggestions and comments; we store only a hash of that code, never your IP address. We store the text of suggestions and comments, the votes and, if you choose one, the name shown with them. Without a name you appear as “Anonim” followed by a number derived from that hash, so your suggestions and comments can be told apart from other people’s; the number does not identify you outside this page. Suggestions, comments, chosen names and these numbers are public. A reply marked Graceup is written by us. To limit abuse we count requests per network using a keyed hash of the network address that expires within a day. Suggestions and comments stay until you or we delete them, and deleting a suggestion also deletes its comments; email [email protected] to have a suggestion, comment or name removed if you no longer have the same browser.

Why we use data

We use your submissions and anonymous credential to provide the community you request. We process reports, blocks and limited technical information to protect members, moderate content and prevent abuse. These purposes rely on providing the service and our legitimate interests in operating a safe community. Optional device permissions can be withdrawn in device Settings. We do not sell your journal or use it for advertising.

Providers and purchases

Cloudflare hosts the community API, database, media storage and rule-based content filters. The database and photo bucket are configured in the EU; delivery and security processing may involve Cloudflare infrastructure elsewhere. Microsoft Azure AI Translator translates public moments when our own translation capacity is used up, on its servers in the European Union, and does not store the text. Country lookup is provided by country.is. Apple handles App Store payments on iOS; Google handles Google Play payments on Android. We use RevenueCat to display subscription offers, validate purchases, restore subscriptions and determine access to Pro. RevenueCat processes a private app user identifier, purchase and subscription records, and technical information such as device type, operating system and last app activity. Our server links this private identifier to your anonymous community identity to verify access to paid photo sharing. Devices that use the same journal can share one purchase identifier through a random link secret kept in your private iCloud or Google Drive app storage; our server stores only a hash of that secret and removes unused links after 30 days. The purchase identifier is not displayed publicly. Our app does not send your journal entries, photos, videos, profile name or profile photo to RevenueCat. We do not receive your card details. RevenueCat processes service data on our behalf, including on infrastructure in the United States. More information: https://www.revenuecat.com/privacy. If you email support, your email provider and our mail provider also process that message. If you send feedback from the app, we store its text, the email address you choose to add for a reply, the app version, device model, operating system version, whether you have Premium and the country of your network. It is not linked to your community identity. We forward it to our support inbox, through Cloudflare Email Routing to Google Gmail.

Ad measurement

When you install Graceup on iOS, we use AppsFlyer to learn which ad, if any, led to the install. AppsFlyer receives technical information such as device type, operating system, app version, IP address, Apple’s identifier for vendors (IDFV), a random AppsFlyer ID, install and open times and 2 milestones: finishing onboarding and writing your first moment. RevenueCat sends AppsFlyer the purchase, free trial and renewal events tied to that AppsFlyer ID. If you allow tracking in Apple’s prompt, AppsFlyer also receives your device’s advertising identifier (IDFA) and may share the attribution result with the ad networks we use, Meta and TikTok, so they can measure and improve our ads. If you do not allow it, the IDFA is not collected and attribution relies on Apple’s privacy-preserving SKAdNetwork reports. AppsFlyer never receives your journal entries, photos, voice notes, the affirmations you write, names or your profile. You can change your choice at any time in iOS Settings > Privacy & Security > Tracking. AppsFlyer processes this data on our behalf, including in the United States. More information: https://www.appsflyer.com/legal/privacy-policy.

When you install Graceup on Android, AppsFlyer receives the same technical information, with the Google Play install referrer in place of Apple’s IDFV, plus the same 2 milestones and the RevenueCat events. Android has no tracking prompt: unless you have deleted your device’s advertising ID, AppsFlyer also receives it and may share the attribution result with Meta and TikTok, so they can measure and improve our ads. You can delete your advertising ID at any time in Android Settings > Privacy > Ads (on some phones Settings > Google > Ads).

Retention and deletion

Local data stays until you delete it. Community content, pending or rejected submissions, reports and moderation records stay until deleted. A shared moment that is never finished (for example, when its first upload is interrupted) is deleted automatically after about 24 hours. A moment that was already shared is never deleted this way, even if a later edit is not finished. A record that you reacted to a moment is kept for 30 days, even if you remove the reaction, so the author is not notified repeatedly. Devices that have already shown a public photo may keep a private cached copy for up to 1 hour after it is removed. Settings > Delete all data removes the identity, its posts and photos, group memberships, group name and profile photo, groups left without members, private messages, legacy comments, reactions, blocks, related reports and moderation records from active storage, then clears local app data. If this device has used iCloud or Google Drive sync, deletion also erases the synced journal, its photos and the purchase link secret. This happens right away when the cloud is reachable, or the next time this device syncs with the same Apple or Google account. Your other devices that use the same journal delete their own community identities the next time they sync. Keep the original Apple or Google account signed in until the cloud copy is erased. Minimal deletion markers prevent older device copies from restoring deleted entries. Apple and Google may retain recovery copies according to their service policies. Deletion can be retried after an interruption. Cloudflare database recovery copies may retain deleted records for up to 7 days on our current plan. Exported backups, device backups and copies saved by other people are outside this deletion. Support correspondence is retained while needed to handle the request and any applicable obligations. Feedback sent from the app is deleted automatically after one year. It is not linked to your community identity, so Delete all data does not remove it; email us to have it deleted sooner. The in-app deletion action does not automatically delete purchase records held by Apple, Google or RevenueCat and does not cancel an App Store or Google Play subscription. Contact [email protected] to request deletion of subscription-related data we control; we may need information to locate the relevant purchase record. Some records may need to be retained to meet legal obligations.

Your choices and rights

You can keep entries private, export your journal, edit your selected country, report content, block members and delete your data in Settings. Depending on applicable law, you may request access, correction, deletion, portability, restriction or object to processing by emailing us. We may need information to establish control of an anonymous identity; do not email your access credential. You may complain to your local data protection authority, including ANSPDCP in Romania. The app is not directed at children under 16.

Changes

Material changes to data use will be explained in the app before they take effect. Contact [email protected] for questions or deletion assistance.

This website

graceup.app uses our own first-party analytics, EliteData, to understand how the site is used. It records the pages you visit, the page you came from, how far you scroll, clicks on buttons such as the App Store and Google Play links and an approximate location (country, region and city) derived from your IP address. It stores nothing on your device: no cookies and no local storage. To count visits without tracking you over time, it combines your IP address and browser type with a secret value that changes every day into a one-way code, so the same visitor looks new the next day. Your IP address is also used to estimate that location and to filter out bots. We do not use advertising cookies and we do not sell this data.

Links to the App Store and Google Play take you to Apple and Google, whose own privacy policies apply. Emails you send to [email protected] are used only to answer you.