Privacy Policy

Effective July 19, 2026

The short version: your journal is private by default and stays on your iPhone unless you choose otherwise. The intelligence that reads it runs on your iPhone. When you share with a Circle, only the people you invited can read what you shared, protected by end-to-end encryption. With Pro backup on, your journal is stored in your own iCloud, where we cannot read it. We do not run accounts, we do not sell data, and we cannot read your journal.

Who we are

Gratitoo is developed and published by Loopy Labs LLC (“we”, “us”). This policy describes what happens to your information when you use the Gratitoo app for iPhone and when you visit gratitooapp.com. Questions go to our contact page.

What we do not collect

We do not require an account, username, or password.
We do not collect your journal entries, photos, or voice recordings, or anything the app’s intelligence derives from them.
We do not collect your name, email address, contacts, or location.
We do not sell or share personal information with data brokers or advertisers, and the app contains no advertising.

Your journal stays on your device

Everything you write, photograph, or record in Gratitoo is stored locally on your iPhone. The features that read your entries, including Your World, affirmations, and insights, are powered by Apple’s on-device foundation models and run entirely on your iPhone. Your entries are not uploaded to us or to any third party for processing.

iCloud backup

If you enable backup with Gratitoo Pro, your journal is backed up to your personal iCloud account. That backup belongs to you: it is stored in your private iCloud storage, protected by Apple’s iCloud security, and we cannot access it. You can turn backup off in the app and manage or delete iCloud data through your device settings.

Circles and sharing

Circles are optional. If you create or join one, the things you choose to share, such as weekly check-ins and individual journal moments, are delivered through Apple’s iCloud (CloudKit) sharing infrastructure to the people you invited, and only to them. The text you share is end-to-end encrypted: the keys travel with the people in your Circle, and neither we nor Apple can read shared entry text. Leaving a Circle stops sharing, and you can stop sharing at any time.

Content the app downloads

Gratitoo fetches nightly stories, and configuration used to operate the app, from Apple’s CloudKit service. These downloads deliver content to you; they do not attach your journal or personal information. Like any network request, they are handled by Apple’s infrastructure under Apple’s privacy terms.

Analytics

Gratitoo measures how its features are used so we can make the app better: which screens are opened, whether things like stories and check-ins are completed, and which settings are on. These measurements never include what you write. No entry text, no photos, no names, no titles: events carry feature names, counts, and switches, and that rule is enforced in code, not by review. They are tied to a random identifier created on your device that rotates at least once a year and is not connected to your name or anything else about you.

We use Amplitude, an analytics service, to store and analyze these measurements. It is configured not to record your IP address, your location, or your device’s hardware identifiers.

The mood you pick at check-in is handled separately and even more carefully: it is reported with no identifier at all, with the time rounded to the hour, through a channel shared by every copy of the app. It tells us how everyone using Gratitoo is feeling as a whole. It cannot tell us, or anyone, how you are feeling.

You can turn analytics off at any time in the app under Account, in the Privacy section. When it is off, nothing is sent.

Purchases

Gratitoo Pro is sold through Apple’s App Store. Apple processes the payment; we never see your card details or billing information. Subscriptions are managed through your Apple account settings.

The website

gratitooapp.com uses Amplitude, an analytics service, to count page visits and taps on things like the App Store button, so we can tell which pages people find useful. These measurements are anonymous by design: the site sets no cookies and stores nothing in your browser, a new random identifier is generated for each visit and discarded when you leave, and we do not send your IP address or location to Amplitude. Nothing you type anywhere, including in the app, is ever involved. The site is hosted on standard web infrastructure, which may keep routine server logs (such as IP addresses in access logs) to operate the service.

Children

Gratitoo is not directed at children under 13, and we do not knowingly collect personal information from children.

Your choices

Deleting the app deletes the journal stored on your device.
iCloud backups can be disabled in the app and removed through your device’s iCloud settings.
You can leave any Circle at any time, which stops sharing.
Analytics can be turned off in the app under Account, in the Privacy section.
If you email us, we will use your address only to reply, and you can ask us to delete the correspondence.

Changes to this policy

If we change how Gratitoo handles data, we will update this page and change the effective date above before the change takes effect.

Contact

Loopy Labs LLC · gratitooapp.com/contact