How Grav protects private sharing

Photos and videos can contain embedded metadata, including capture time, device details, camera settings, and location when recorded. Image metadata is often called EXIF. It may not be visible when you view the photo, but someone with the file may be able to read it.

Before normal app uploads reach Grav's servers, photos are re-rendered and videos are exported with metadata containers cleared. We verify camera, camera-roll, edit, and share paths before treating this as a release guarantee.

Being in the same Grav does not automatically give someone access to your inbox. You can choose whether people in a Feed may send you a message request, and a conversation begins only after you approve it.

You can also share a personal message invitation with someone directly. They do not need to join one of your Feeds first.

Share a personal message QR code or invitation link with someone you trust. It opens a private conversation without adding them to one of your Feeds.

Grav uses account authentication, controlled access, secure connections, protected storage, short-lived media links, blocking, and reporting tools to help keep your spaces private.

Most apps include third-party software libraries that report your behavior back to advertising and analytics companies, even if the app itself has no ads. These libraries run silently in the background and can track which screens you visit, how long you spend on each one, what you tap, and sometimes link that behavior to profiles used for advertising across other apps.

The Grav apps do not include ad networks, tracking domains, or third-party behavioral analytics SDKs. We do collect first-party operational data such as account-linked crash diagnostics, security logs, push tokens, and account activity. Aggregate product metrics can be derived from retained memberships and interactions. These records help us run, secure, and support the app.

This public website does not load Google Analytics or set analytics cookies. Cloudflare hosts the site and provides request, error, and performance metrics. The live site also loads Cloudflare's browser performance beacon, which reports page-load measurements and page/referrer URLs. Cloudflare documents this beacon as cookie-free. Google Fonts receives normal requests to deliver our typefaces.

See our Privacy Proof Center and browser checks for the website findings and provider boundaries.

Private posts are protected by access rules on our side, not just by what the app chooses to show. Membership decides what you can see, and that rule is enforced before any content is returned to a device.

Private media is served through short-lived access URLs. The app requests a fresh URL when needed, and copied links should expire rather than becoming permanent public media URLs.

Deleting a message you sent removes its content for everyone in the conversation and may leave a neutral deleted-message marker. Removing a conversation from your own view clears it for you without reaching into another person's copy. Deleting a post removes that post and its media.

Deleting your account removes the account and the content you authored from active Grav systems. Content other people created themselves stays theirs. Narrow safety, legal, fraud, security, financial, and audit requirements can hold limited records for a while, and we spell those out in the Privacy Policy.

Your conversations stay available until you delete them, so you do not lose the thread when you switch devices.