Privacy Policy

Last updated: August 28, 2026

GratiFlow helps people practice gratitude together in small, private circles. This policy explains what we collect, why, and your choices. We keep it short and plain.

What we collect

Account info: your email address and the display name you choose.
Your content: the gratitude entries you create: text, photos, videos, and voice notes, plus the circles you belong to, and the comments and reactions you send.
Device / push token: to deliver the notifications you turn on.
Ebook purchase information: the email used at checkout, order amount, payment and delivery status, and a Stripe transaction reference. Stripe processes your payment details; GratiFlow does not receive your full card number.
Ebook website activity: a random first-party experiment identifier, the version of the ebook landing shown, purchase-button and section interactions, campaign tags in the URL, viewport width, page performance measurements, and an optional fixed-choice answer about which part of the message feels least clear. The question has no text field.

We do not collect your precise location, your contacts, advertising identifiers, or analytics about how you use the app. Ebook website measurement does not use fingerprinting, does not store your IP address in our experiment database, and does not track you across other companies' apps or websites. Face ID / biometric unlock is handled by your device and never leaves it.

How we use it

To run the app: your account, your circles, and sharing gratitude with the people you choose.
To complete and deliver ebook purchases, prevent duplicate fulfillment, and support buyers.
To understand whether the ebook landing works, compare a control and one candidate at the same time, detect checkout or delivery problems, and keep or remove a candidate.

We do not sell your data, and we do not use it to track you across other companies' apps or websites for advertising.

Who processes it

We use Supabase (authentication, database, media storage) and Expo (push notification delivery) to run GratiFlow, Cloudflare to serve our website and assign an ebook landing version, Stripe to process ebook payments, and Loops to send the private download link. A language model provider may receive aggregated experiment history without visitor identifiers to propose a bounded landing candidate. These providers act on our behalf. We don't share your data with advertisers or data brokers.

Website experiments and retention

When an ebook landing experiment is active, a first-party cookie keeps the assigned version consistent for up to 35 days. Raw pseudonymous interaction events are kept for 13 months, then deleted. Aggregate decisions and their audit history may be kept longer so we do not repeat unsafe or ineffective tests. Purchase records are kept as needed for delivery, support, fraud prevention, accounting, and legal obligations.

Your browser's Do Not Track setting is respected for ebook experiment measurement. You can also opt out on this browser: .

Your circles are private

GratiFlow has no public feed. Your gratitude is visible only to the members of the private circles you join or create.

Your choices

Access & export: contact us to request a copy of your data.
Delete your account: you can delete your account from within the app (Profile → Delete account), or by contacting us. Your account and profile are permanently removed; gratitude you shared in circles is kept for those members but anonymized (no longer linked to you).
Notifications: turn notifications on or off anytime in your device settings.
Ebook website measurement: use the opt-out control above. The setting is stored only in this browser and does not affect your ability to buy the ebook.

Children

GratiFlow is not directed to children under 13, and we do not knowingly collect data from them.

Changes

We may update this policy; we'll revise the date above and, for material changes, notify you in the app.

Contact

Questions or requests: contato@gratiflow.app