How Gratia looks after your data
Last updated 31 October 2026
What you write in Gratia is yours. We collect as little as we can, we never sell it, and we can't see which apps you shut.
Who we are
Gratia Holdings Limited (Scotland, SC903958) is the controller of your personal data under the UK GDPR. For anything about your data, email hello@gratiaapp.uk.
The app
Your account. You sign in with Apple, Google or an email code. We keep your email, your plan and the username you choose, to sign you in and keep your journal in sync.
Your three things. Entries are encrypted on your phone before they're stored. So a new phone can open your journal, your key is also kept with your account, sealed with a separate server key. Our systems could technically open a journal; we don't read your entries. What you write may be sensitive (health, relationships, beliefs), so we store it with your explicit consent.
Health and wearables. With your explicit consent, Gratia reads sleep, HRV and resting heart rate from Apple Health. If you connect WHOOP, it reads your recovery, strain, sleep, HRV and resting heart rate. If you connect an Oura ring, it reads your readiness, sleep, HRV, resting heart rate, stress, blood oxygen, cardiovascular age, workouts, and meditation or breathing sessions, as far as your ring and Oura account provide them. WHOOP and Oura readings pass through our server to reach your phone and aren’t stored there. A short summary stays on your phone, encrypted. If you use Saga, that summary may also be sent for a reading, as explained below. You can disconnect any time in Settings: new readings stop and Saga stops using your wearable, but the summary already on your phone stays there, encrypted, until you delete the app.
Friends. Friends see your name, @username and streak, never what you write. Others can find your @username and nothing more; turn that off with "Let people find me" in Settings.
Speaking your three things uses your iPhone’s speech-to-text, which may use Apple’s speech service. The apps you shut are known only to Apple's Screen Time; we never learn which. Notifications never contain what you wrote. Payments go through Apple; we never see your card.
Crash reports and usage counts. An error, a screen opened, a morning saved: these help us fix and improve Gratia. They’re linked to a random account ID. The app leaves out what you write, your IP address and your location, although the companies receiving a report may briefly see your internet address when it arrives.
Saga
Saga is optional and only reads after you agree. Everyone can have one short reflection on their first three things. Once Saga is on, it reads when you ask, such as for your monthly reading, and also automatically when you open parts of Wellness, so it can write its paragraph there. It receives the recent entries or feelings that reading needs, plus your wearable summary and, for the monthly reading, your supplements. These go through our server, which keeps only a usage count, to Anthropic (the makers of Claude). We don’t attach your name, email or account ID, but what you write may itself identify you.
Anthropic processes this in the US and doesn’t train on it. Under its standard terms it deletes it within 30 days, unless the law requires it to keep it longer or it’s needed to enforce Anthropic’s usage policy. If Anthropic’s safety systems flag something, it may keep it for up to 2 years, and the safety scores for up to 7.
If you wear an Oura ring, your summary comes from Apple Health, not from your Oura connection. The reading stays on your phone, encrypted. You can turn Saga off any time in Settings. It then stops reading, but this doesn’t recall anything already sent.
How long we keep it
Your account and journal: until you delete your account, which you can do in Settings. They are then removed within 30 days, and from backups within the next 30, so up to 60 days in all. Some records are kept longer: crash reports and usage counts for up to 13 months, support emails for up to 2 years and payment records for 6 years, for tax. Apple subscriptions must be cancelled separately.
The waitlist
If you join the waitlist we keep your first name, email, any answers you give to our short questions, and a hashed version of your IP address to stop spam sign-ups. We use them to email you about Gratia, with your consent; unsubscribe from any email. Unconfirmed sign-ups are deleted after 90 days, the rest 12 months after launch. This site sets no cookies of its own (the bot check may set one) and counts visits without identifying anyone.
Your rights
Depending on the circumstances, you can ask for a copy of your data, or to correct, delete or move it, or restrict how we use it. You can object to anything based on our legitimate interest. You can withdraw consent at any time: turn off Saga or disconnect a wearable in Settings, or delete your account to withdraw consent for your entries. This doesn’t affect what happened before you withdrew. We need your email or a sign-in to make an account; wearables, Saga and other permissions are optional, and Gratia works without them. Settings can export everything you’ve written. For anything else, email hello@gratiaapp.uk and we’ll reply within a month. You can also complain to the Information Commission.
Gratia is for people aged 18 and over. If this policy changes in a way that matters, we'll tell you in the app or by email first.