Your moments stay on your phone.

The short version

Gratio runs entirely on your device. Your settings and the moments you save are stored on your phone and nowhere else. There is nothing to sign up for, so there is no profile, no email address and no password on our side.

Two things leave your device: a handful of anonymous usage signals, and — if you buy Premium — what is needed to check that purchase. Both are described below. They tell us whether the widget is being used and whether you have Premium; they cannot tell us who you are.

What stays on your device

Everything the app needs lives on your phone: the moments themselves (they ship inside the app, in all five languages), your chosen time and language, your theme and the moments you save with the heart. Widgets read the same data, so they work offline too.

Because it all sits on the device, an iPhone backup — through iCloud or a Mac — includes it. That backup is between you and Apple; we have no access to it.

Notifications are scheduled on the device itself. There is no push server behind them.

Purchases

Gratio Premium is bought through Apple’s App Store. Apple handles the payment and the subscription; we never see your name, your card or your Apple Account details. The only thing the app asks Apple is whether this Apple Account has Premium. Apple’s own privacy policy covers that part.

From version 1.0.2 the app has your purchase checked by RevenueCat. That service keeps track of whether a purchase is valid and whether Premium is still running, so that Premium comes back when you move to another phone. Three things go there: your purchase history with Apple, a random number RevenueCat generates itself that is tied to no account, and the identifier iOS hands out per publisher — Apple calls it the identifierForVendor. That last one is not a hardware number: it is the same for every app from the same publisher on your device, and it disappears once you delete all of them. No advertising identifier goes there, and we have no name or email address to send. That record exists for as long as you have Premium, which is exactly what is needed to restore your purchase. RevenueCat, Inc. processes this on our behalf under a data processing agreement, on servers in the United States. Its privacy policy describes its side.

Five anonymous signals

To know whether Gratio actually helps — mainly, whether the widget is being placed and used — the app sends five events to TelemetryDeck, an analytics service based in Germany that is built for exactly this kind of minimal, anonymous measurement:

• onboarding_completed — the app has been set up (sent once)
• widget_installed — a widget has been placed (which kind, not where)
• moment_completed — a moment has been read to the end (whether it was a question or a statement)
• paywall_converted — someone moved to Premium, and which option
• locale_info — the language of your moments, the language of your phone and your App Store country, once per app version

What is not in these signals: your name, your email address, the text of your moments, a device identifier, an advertising identifier or any identifier we could ever tie to you. TelemetryDeck never receives one: its SDK would hash Apple’s identifier by default, and we deliberately replace that with a number of our own. The first time the app runs it generates that number, keeps it on the phone, and hashes it with a fixed salt before anything is sent — so neither we nor TelemetryDeck can trace it back. That number means nothing outside Gratio, and it disappears when you delete the app. Alongside each signal go the app version, the iOS version and the device model, which is what any crash or usage tool sees. This is not tracking by Apple’s definition — nothing is linked to data from other companies, and nothing is used for advertising.

TelemetryDeck GmbH processes these signals on our behalf under a data processing agreement, on servers in the European Union. Its privacy policy describes its side.

This website

Fonts, images and styles come from this domain, and there are no embedded videos, maps or social buttons. There is one exception: the site measures visits with Clicky, an external analytics service, so we can see whether people reach the site at all and which pages they read.

Clicky records the page, the link you arrived by, your browser and a rough location, and of your IP address it keeps only an anonymised version. With the settings we use it places no tracking cookies — which is why this site still has no cookie banner. It cannot see your name, and the app sends it nothing at all: this concerns the website only. Clicky is run by Roxr Software Ltd., a company in the United States, so these visit statistics are processed there; its privacy policy describes its side.

The site is hosted by Cloudflare. Like any web host, Cloudflare processes technical data such as your IP address to deliver the pages and to keep the site safe. There too we see nothing that identifies you, only visit totals. Cloudflare’s privacy policy describes its side.

If you email support@gratio.app, we keep your message for as long as it takes to help you, and delete it afterwards. Email to that address arrives in our Google Workspace mailbox; Google processes those messages on our instructions. Google’s privacy policy describes its side.

Your rights

Under the GDPR you can ask what data we hold about you, have it corrected or deleted, object to its use or take it with you. In practice we hold nothing that lets us find you, unless you have written to us. Write to support@gratio.app and we will answer within a month. If you feel we have not handled something properly, you can complain to the Belgian Data Protection Authority or the authority in your own country.

Gratio is not aimed at children, and it collects nothing about anyone, of any age.

Who is responsible

Gratio is made by
Monto Bleu BV
Heidebergstraat 14, 3120 Tremelo
Belgium
BE 0543.842.970
Privacy questions: support@gratio.app

If this page changes, the date at the top changes with it. We do not send notices about privacy updates; we have no address to send them to.