Privacy Policy
About this policy
Little Gratitude is a gratitude journal with an optional public community. The service operator and controller of personal data processed through our service is Elite Experience SRL, registered in Romania with the Bucharest Trade Registry under no. J2026001200007, tax identification number (CUI) 53231839, with its registered office at București Sectorul 3, Bulevardul 1 Decembrie 1918, Nr. 2, Bl. MY9, Scara 1, Etaj 2, Ap. 9, Romania. Contact us about privacy or your data at littlegratitude@ericcosulea.ro. Updated 11 October 2026.
Your private journal
Your journal is stored locally on your iPhone, iPad or Android device. On iOS, when iCloud Drive is available, your journal entries, attached photos and legacy videos, profile and journal preferences also sync to your private iCloud container so they can be restored on your devices. This is available on Free and Pro. Apple processes this storage through your iCloud account. Face ID settings, reminder permissions, purchase credentials and community access credentials are not included in this synced journal. Private entries are not sent to our community service. You can disable iCloud Drive access for the app in device Settings; local journaling remains available. On Android, optional Google Drive sync connects the Google account you choose in Settings > Backup & export. It uploads journal entries, attached photos and legacy videos, profile and journal preferences to private app-data storage in that account. It is available on Free and Pro. Google processes this storage through your Google account. Community and purchase credentials, biometric lock and notification permissions are excluded. You can pause Drive sync in Backup & export. Exported backups are separate copies.
Application analytics
We use PostHog in its European region to measure application use. Our Cloudflare service forwards metadata about sessions, screens, onboarding, journal creation and deletion, Explore interactions, purchase outcomes and error categories. Journal measurement includes hashed entry identifiers, change timestamps and whether entries still exist, including private entries. These records use the app's random identity and contain platform, app version and session identifiers. Copies of the same entry count once across devices; usage identities may differ between devices. Analytics never includes entry text, questions, photographs, videos, names, profile photographs or raw error messages. Offline metadata is retained locally and retried. Historical entries and retained deletion records may be counted after an update; unmeasured historical usage cannot be reconstructed. Deleting an entry updates its presence; Delete all data submits deletion of the installation's analytics identity and associated events. Deletion is queued and retried independently of journal deletion; we retain the anonymous identifier and request timestamp until it is accepted. PostHog processes this deletion asynchronously. We do not enable session replay or advertising tracking.
Camera, photos and reminders
The camera is used only when you choose to take a photo and grant camera permission. The system photo picker gives the app access to the photos you select, not your entire photo library. Selected photos are stored with your journal and are sent to our community service only when you share that entry publicly. Your profile photo is stored with your profile and is not displayed in the public community. Daily reminders use local notifications with your permission. Face ID, Android biometrics or your device credential are checked by the operating system; we do not receive biometric templates. You can change camera, notification and biometric permissions in device Settings.
Anonymous community identity
There is no email or password login. When the app reports analytics or you use the community, we create a random identifier and store an access credential in the iOS Keychain or encrypted Android storage protected by Android Keystore. Our server stores a hash of that credential. Anonymous means your name is not displayed publicly; your activity is still linked to this identifier. Your public moments show your current streak, as a number of days. Reinstalling the iOS app may preserve Keychain credentials. On Android, uninstalling the app or clearing its storage removes the local community credential; it is not included in Google Drive journal sync. Losing the credential may prevent recovery of your community identity.
What sharing sends
Choosing Public Feed sends the entry text, attached photos and selected country to our Cloudflare service. Public posts and private messages are screened by rule-based filters on our server. Flagged text awaits moderator approval before publication. Photos are published when the accompanying text passes these filters, including photo-only posts. Photos are not automatically checked for visual content; moderators investigate reported photos. We do not send submissions to third-party AI services. We also store private messages, legacy comments, reactions, blocks, submission dates and moderation status. Reports include the reported text, reason, details and identifiers needed to investigate. Approved public posts and their country are visible to other community members. A private message is delivered only to the user who posted it, with the sender's selected country and no name or profile photo. The recipient can reply anonymously. Messages are stored on our server, are not end-to-end encrypted, and moderators can access them for safety review. Old public comments are no longer displayed and are not converted into private messages. Moderators can access submissions, photos and reports. Do not include personal information you do not want to disclose.
Country and network information
The app detects an approximate country from your internet connection through our Cloudflare service, with api.country.is as a fallback. The fallback provider receives your IP address when used. We save the country with your community identity and use it to complete missing country information on your earlier shared moments, messages and reactions. You can correct the country in My profile. We do not request GPS location. Cloudflare processes network and request information to deliver and protect the service. We store a hash of the connecting IP for session rate limiting, not as your public identity. Expired rate-limit rows are removed during subsequent session creation.
Why we use data
We use your submissions and anonymous credential to provide the community you request. We process reports, blocks and limited technical information to protect members, moderate content and prevent abuse. These purposes rely on providing the service and our legitimate interests in operating a safe community. Optional device permissions can be withdrawn in device Settings. We do not sell your journal or use it for advertising.
Providers and purchases
Cloudflare hosts the community API, database, media storage and rule-based content filters. The database and photo bucket are configured in the EU; delivery and security processing may involve Cloudflare infrastructure elsewhere. Country lookup is provided by country.is. Apple handles App Store payments on iOS; Google handles Google Play payments on Android. We use RevenueCat to display subscription offers, validate purchases, restore subscriptions and determine access to Pro. RevenueCat processes a private app user identifier, purchase and subscription records, and technical information such as device type, operating system and last app activity. Our server links this private identifier to your anonymous community identity to verify access to paid photo sharing. The purchase identifier is not displayed publicly. Our app does not send your journal entries, photos, videos, profile name or profile photo to RevenueCat. We do not receive your card details. RevenueCat processes service data on our behalf, including on infrastructure in the United States. More information: https://www.revenuecat.com/privacy. If you email support, your email provider and our mail provider also process that message.
Retention and deletion
Local data stays until you delete it. Community content, pending or rejected submissions, reports and moderation records currently stay until deleted; there is no automatic age-based expiry. Settings > Delete all data removes the identity, its posts and photos, private messages, legacy comments, reactions, blocks, related reports and moderation records from active storage, then clears local app data. If this device has used iCloud sync, deletion also clears the synced journal and waits for iCloud to upload that change. On Android, if this device has used Google Drive sync, deletion clears the synced journal and waits for the cloud deletion operation to finish. Keep the original Apple or Google account available until deletion finishes. Minimal deletion markers prevent older device copies from restoring deleted entries. Apple and Google may retain recovery copies according to their service policies. Deletion can be retried after an interruption. Cloudflare database recovery copies may retain deleted records for up to 7 days on our current plan. Exported backups, device backups and copies saved by other people are outside this deletion. Support correspondence is retained while needed to handle the request and any applicable obligations. The in-app deletion action does not automatically delete purchase records held by Apple, Google or RevenueCat and does not cancel an App Store or Google Play subscription. Contact littlegratitude@ericcosulea.ro to request deletion of subscription-related data we control; we may need information to locate the relevant purchase record. Some records may need to be retained to meet legal obligations.
Your choices and rights
You can keep entries private, export your journal, edit your selected country, report content, block members and delete your data in Settings. Depending on applicable law, you may request access, correction, deletion, portability, restriction or object to processing by emailing us. We may need information to establish control of an anonymous identity; do not email your access credential. You may complain to your local data protection authority, including ANSPDCP in Romania. The app is not directed at children under 16.
Changes
Material changes to data use will be explained in the app before they take effect. Contact littlegratitude@ericcosulea.ro for questions or deletion assistance.