Privacy Policy
Last updated: 22 October 2026
Gratitudes ("we", "us", "the service") is an independent, non-commercial gratitude journalling app operated by a single developer. This policy explains what information we collect, how we use it, and the choices you have.
1. Who runs this service
Gratitudes is built and operated by an individual developer, not a company. If you have any questions about this policy or your data, contact:
2. What information we collect
We collect only what's needed to run the service:
- Account information: your email address and a securely hashed password.
- Journal content: the entries, photos, and any other content you create in the app.
- Public profile details (only if you choose to make content public): your chosen nickname and country.
- Basic technical data: standard server logs (e.g. IP address, timestamps) used for security and troubleshooting.
We do not use third-party analytics or tracking tools (such as Google Analytics). We do not track you across other websites. The only exception to third-party requests is the mailing list signup form described in section 5, and only if you start filling it in.
3. How we use your information
We use your information to:
- Provide and maintain your journal and account.
- Send you password reset emails and essential service notifications.
- Send you our 7-day course and occasional updates about Gratitudes, only if you've opted in to our mailing list.
- Review and moderate content you choose to share publicly, to keep the platform safe and high-quality.
- Diagnose technical issues and keep the service secure.
We do not use your journal content for any purpose other than providing the service to you.
4. Photos you upload
If you upload a photo, we resize it and strip location and device metadata (EXIF data) before storing it. The original, unprocessed file is discarded. This is a privacy safeguard: your photos won't reveal where or on what device they were taken.
5. Mailing list
We only send you occasional updates about Gratitudes if you ask for them. If you tick the box when you create an account, we'll send you our free 7-day course, one email a day, starting once you've confirmed your email address, and occasional updates after that. You can ask for emails by ticking the box when you create an account, or by using the signup form on our About page. The box is never ticked for you, and leaving it empty does not affect your account in any way.
Our mailing list is run by MailerLite, who act as our data processor: they store your email address and send these emails on our behalf, and do not use your data for their own purposes. If you ticked the box, we pass your email address to MailerLite once you have confirmed it. We send nothing else: no name, nickname, country or journal content. Our legal basis for this is your consent.
You can withdraw your consent at any time, using the unsubscribe link in any of these emails or by contacting us directly. If your account is deleted, you are not yet removed from the mailing list automatically, so please unsubscribe or contact us and we will remove you.
The address you enter in the signup form on our About page is also stored by MailerLite. That form uses Google reCAPTCHA to block spam signups. reCAPTCHA and MailerLite's form script are only loaded once you start filling in the form; simply visiting the page does not contact either of them. When loaded, reCAPTCHA may set cookies and collect browser and device information, as described in Google's Privacy Policy. Account emails, such as email confirmation and password resets, are sent through our email delivery provider, Resend.
6. Where your data is stored
Your data is stored securely with a professional, reputable hosting provider, in a managed database. We do not sell, rent, or share your personal information or journal content with third parties for advertising or any other purpose.
The only third parties who ever process your data are the infrastructure and email providers described above (and Google reCAPTCHA, if you use the mailing list signup form), and only to the extent necessary to run the service (hosting, storage, email delivery, and spam protection).
7. Public content and moderation
Journal entries are private by default. If you choose to publish an entry publicly, it will display your chosen nickname (not your email address) and is reviewed before it appears publicly. You can request removal of public content at any time by contacting us.
8. Cookies
We use a single essential session cookie to keep you logged in. We do not use advertising, tracking, or analytics cookies. If you start filling in the mailing list signup form, Google reCAPTCHA may set its own cookies for spam protection (see section 5).
9. Your rights
You can:
- Access the personal data we hold about you.
- Correct inaccurate information.
- Delete your account and associated data.
- Unsubscribe from mailing list emails at any time.
To exercise any of these rights, email [email protected]. We'll respond and action requests promptly.
10. Data retention
We retain your account and journal data for as long as your account is active. If you request deletion, we will remove your personal data and journal content, except where we're required to retain limited records for legal or security reasons.
11. Children's privacy
Gratitudes is not directed at children, and we do not knowingly collect data from children under 13 (or the relevant minimum age in your country).
12. Changes to this policy
As this is a new and evolving service, this policy may be updated from time to time. We'll update the "last updated" date above when changes are made. Significant changes will be communicated to registered users where appropriate.
13. Contact
Questions, concerns, or requests regarding your data or this policy: