Privacy Policy

Last updated: 25 May 2026

The short version

Your journal entries are private. We don't read them, sell them, or share them with anyone. You can export or delete all your data at any time from Settings.

Who we are

grATTitude is a personal journaling web application operated by Matthew Barton. For questions about this policy, contact hello@grattitude.space.

What data we collect

• Account information: When you sign up, we store your email address, display name, and profile photo (if you sign in with Google). This is handled by Firebase Authentication.
• Journal entries: The text you write in your morning and evening journal. Stored in Google Cloud Firestore, linked to your account.
• Practice settings: Your chosen journal blocks, theme preference, and evening unlock time.
• Usage analytics: We use Vercel Analytics to track anonymous page views (no cookies, no personal data). We may use PostHog for product analytics in the future.

What we don't collect

• We don't use tracking cookies
• We don't collect location data
• We don't read or analyse the content of your journal entries
• We don't sell or share your data with third parties
• We don't serve advertisements

How your data is stored

Your data is stored in two places:

• Locally in your browser's localStorage (works offline)
• In the cloud via Google Cloud Firestore (for cross-device sync)

Cloud data is protected by Firebase security rules that ensure only you can access your own data. All data is transmitted over HTTPS.

Third-party services

• Firebase Authentication (Google) — handles sign-in
• Cloud Firestore (Google) — stores your journal data
• Vercel — hosts the website and provides anonymous analytics
• Stripe — processes payments (if you subscribe to a paid plan). We never see or store your card details.

Your rights

Under GDPR and UK data protection law, you have the right to:

• Access your data — use the "Export all data" button in Settings
• Delete your data — use "Delete my account" in Settings to permanently remove everything
• Data portability — your data exports as a standard JSON file
• Withdraw consent — you can delete your account at any time

Data retention

We keep your data for as long as your account exists. When you delete your account, all data is permanently removed from our servers immediately. There is no recovery period.

Children

grATTitude is not intended for children under 16. We do not knowingly collect data from children.

Changes to this policy

If we make significant changes, we'll update the date at the top of this page. Continued use of the service after changes constitutes acceptance.