Privacy Policy

Account details. When you sign up we collect your phone number, a username, your name, and a password (stored only as a salted hash). If you turn on two-factor authentication we store the secret needed to verify your codes.

Recipients. To deliver your notes we store the name, phone number, time zone, and sending schedule for each person you add.

Messages. We store the messages you write, when they are scheduled, and when they were sent so you can review your history.

Billing. Payments are processed by Stripe. We keep a reference to your Stripe customer record and your subscription status. We never see or store your full card number.

Technical data. Like most services we keep standard server logs (such as IP address, browser type, and pages requested) and error reports so we can keep GratiText reliable and secure.

• To create and secure your account and verify your phone number.
• To send your messages to your recipients on the schedule you set.
• To remind you when a recipient has no message waiting to be sent.
• To process payments and manage your subscription.
• To respond to your support requests.
• To detect abuse and keep the service running smoothly.

We do not use your messages to train AI models, build advertising profiles, or for any purpose other than delivering them as you asked.

GratiText sends SMS messages through Twilio. Before we deliver your notes to a new recipient, we text them a one-time verification code so they know who is reaching out and can confirm they are happy to receive messages from you.

Any recipient can reply STOP at any time to opt out of all future messages, and START to opt back in. Standard message and data rates from their carrier may apply.

We share information only with the service providers that help us run GratiText, and only as needed for them to do their job:

• Twilio to deliver text messages and receive replies.
• Stripe to process payments and manage subscriptions.
• Fly.io to host the application and its database.
• Sentry to capture error reports so we can fix problems quickly.

We may also disclose information when required by law or to protect the rights and safety of our users. We do not sell personal information.

We keep your information for as long as your account is active. You can delete your account at any time from your settings page; doing so removes your account, recipients, and messages from our database. Copies in routine backups and logs age out on a rolling schedule after that.

You can also download a copy of everything we hold about you from the same page.

All traffic to GratiText is encrypted in transit. Passwords are hashed with bcrypt, sessions are stored in signed cookies, and access to production systems is limited to the people who operate the service. No system is perfectly secure, so please use a strong, unique password and consider enabling two-factor authentication.

• Update your name, username, and phone number in your settings.
• Pause or delete any recipient whenever you like.
• Cancel your subscription at any time through the billing portal.
• Download or delete all of your data from your settings page.

GratiText is not directed at children under 13, and we do not knowingly collect information from them. If you believe a child has created an account, please contact us and we will remove it.

If we make meaningful changes to this policy we will update the date at the top of this page and, where appropriate, let you know by text or within the app.

Questions about privacy? Email us at support@gratitext.app and a human will get back to you.