GravGrav

Privacy Policy

Last updated: October 4, 2026

Grav is a private social network. You choose who belongs in each Feed and where every piece of content is shared, your feeds are chronological, and there are no ads deciding what you see. Grav is funded by Grav+ and Brand tools, so your private life is never the product.

Grav Messages are private and server-backed. They are protected by transport encryption (HTTPS/TLS), authenticated accounts, conversation-membership rules, database row-level access policies, private storage with short-lived media links, approval-based message requests, blocking, and revocable invitations. Grav stores message content so it can be delivered, synchronized across your devices, and restored when you sign in again, and so it can be handled when a participant reports something, for security and abuse investigations, support requests, and legal requirements.

Grav is built around the idea that "social" shouldn't mean "public." This policy explains what data we collect, what we do with it, what we don't do with it, and the rights you have over it. We've tried to keep it readable, actual sentences, not boilerplate.

If you read nothing else: we do not sell your data, share it with advertisers, or track you across other apps. People in your private Feeds are the intended audience for private posts, enforced by app logic and database policy. The app is funded by Grav+ subscribers, not by advertising or data deals. That is the entire business model.

Want evidence you can inspect? Open the Privacy Proof Center →

1. Who we are

Grav Private Social ("Grav") is a privacy-first social app operated by its individual owner ("we", "us", "our"). Contact: privacy@social-orbit.app

The app is currently available in the United States. If you are outside the US, this policy still applies, but our infrastructure may be located in the US.

2. What data we collect

Information you give us

  • Account info: email address, username, display name, password (stored as a one-way hash; we never see your plaintext password)
  • Profile content: avatar, bio
  • Content you create: posts, captions, thoughts, Messages, media, scheduled Moments, comments, reactions, channel subscriptions, reports, and related metadata. Grav stores message text and media so your conversations can be delivered, synchronized across your devices, restored when you sign in again, and processed when necessary for reports, security, support, or legal requirements.
  • Social graph: which Feeds you've created, who you've invited, who's joined, your roles, message requests and personal message invitations, blocks
  • Account activity records: meaningful actions such as creating, editing, or deleting content; joining a Feed; blocking an account; sending a message request; or opening a support or safety request. These records contain the action, time, and related record identifiers. They do not contain content bodies, passwords, authentication tokens, device tokens, or precise location.

Information from your device

  • Camera and photo library access, only when you explicitly add an image or video to a post or message, including the audio accompanying a video. We do not access these continuously. Photo and video metadata (location, device info, timestamps) is stripped on your device before upload.
  • Push notification token, if you grant notification permission, an opaque token issued by Apple is stored so we can send you push notifications.
  • Crash and diagnostic data, provided by iOS (MetricKit). This includes stack traces, app version, and the OS-supplied signal/exception type. Diagnostic submissions and operational events can be linked to your signed-in Grav account so we can investigate faults. They do not include your message or media content.

Information generated by your use of the app

  • Activity timestamps (when you last opened a conversation, when a post was viewed)
  • Historical capture events, collected by earlier app versions when they reported a screenshot or screen recording. Grav no longer collects these events or sends capture alerts. Existing records remain subject to our normal retention and deletion rules.
  • Sign-in security log, when you sign in, our infrastructure records the IP address and timestamp of that sign-in, retained for up to 90 days. We keep this for us and for you: it's how we investigate a compromised account, and it's what lets us hand law enforcement something real when someone uses Grav to harm children or other people. It is used for security and abuse investigations only, never for advertising, profiling, location tracking, or anything else. If you never break the rules, this log does nothing but expire. If you exploit children here, it goes straight to the authorities.
  • Message delivery metadata, including conversation membership, message participants, message request and personal invitation state, delivery timestamps, reactions, and app/device compatibility records used to sync your conversations.
  • App infrastructure request data, our API and storage providers retain normal request information needed to deliver and secure the service, including IP address, request path, device and browser details, timing, and approximate city, region, or country derived from the IP address. Authenticated requests can be linked to your Grav account. This approximate location is infrastructure data; we do not request GPS or device location permission, and do not use it for advertising or cross-app tracking.
  • Public website request data, our website host processes normal request information needed to deliver and secure pages, such as IP address, browser and device details, requested path, timing, and security signals. Grav uses hosting-level totals such as request counts, error rates, and performance. The live site also loads Cloudflare's browser performance beacon, which reports page-load measurements and page/referrer URLs to Cloudflare. Cloudflare documents this beacon as cookie-free. We do not load Google Analytics or set analytics cookies. The site also requests its typefaces from Google Fonts, so Google receives the normal request information needed to return those font files.
  • Subscription entitlement state, whether your account currently holds an active Grav+ entitlement.
  • Aggregate channel metrics, subscriber growth and engagement totals derived from channel membership and interactions such as likes, comments, and views. Channel and administrative statistics show aggregate counts. The underlying membership and interaction records can be linked to your Grav account; these statistics do not expose an individual subscriber's identity to a channel operator.
  • Diagnostic events, additional operational logs used to keep the service running and to investigate incidents.

We use this data to run and secure the app and to understand aggregate channel activity. A social messaging app needs to store messages so it can deliver them. We do notcollect data for advertising, behavioral profiling, or sale.

3. What we don't collect

  • The iOS app does not include IDFA, ad networks, an advertising analytics SDK, Google Analytics, contact upload, location permission, or cross-app tracking. This public website does not load Google Analytics or set analytics cookies. Website monitoring includes hosting-level metrics and Cloudflare's cookie-free browser performance beacon, as described in section 2.
  • Precise device location. We don't request location permission, and supported iOS upload paths strip embedded location and device metadata from photos and videos before upload. Our infrastructure can retain approximate location derived from IP addresses, as described above.
  • Device address-book contacts. We don't read your address book.
  • Browsing histories or activity in other apps. We do not collect your browsing history or monitor your activity in other apps. Requests to Grav can include the referring page URL, as described above.

4. How we use the data

  • To deliver the app, sign you in, show your Grav, post your content to the Feeds you choose
  • To operate Messages: delivery, synchronization across your devices, persistent conversation history, reactions, and notifications
  • To handle support you ask us for, and to investigate reports
  • To enforce safety and prevent abuse, process reports, action suspensions, respect blocks
  • To keep the service secure, and to detect and fix crashes; MetricKit diagnostics are reviewed in aggregate to fix bugs
  • To understand channel audience size and engagement through aggregate membership and interaction statistics, without advertising profiles or cross-app tracking
  • To meet legal obligations and respond to legal requests when required by law

We do not use private Messages for advertising, behavioral profiling, sale, or cross-app tracking, we do not use them to train AI models, and we do not proactively review private Messages for advertising or profiling.

We do not use your data to train our own AI models, sell it to third parties, or share it with advertisers.

5. Who sees what

  • Private Feed posts are visible only to the members of that Feed. Access rules are enforced on our side, not just in the app.
  • Your Messages (direct and group) are visible only to the people in the conversation for ordinary app use. A new one-to-one conversation begins only with your approval or a personal message invitation you shared. Message content is stored and processed so we can deliver, synchronize, secure, support, and moderate the service. Authorized personnel and service providers may access content when reasonably necessary for operations, support, safety, security, abuse investigation, reported-content review, or legal compliance. We do not use private Messages for advertising, behavioral profiling, sale, cross-app tracking, or training AI models.
  • Your profile (username, display name, avatar, bio) is visible to anyone you've interacted with through the app.
  • Your email is visible only to you and Grav's infrastructure (for account recovery and security notifications).

When you block someone:

  • They can no longer see your posts, thoughts, comments, likes, or messages
  • You no longer see their posts, thoughts, comments, likes, or messages
  • Neither of you appears in the other's user search
  • This is enforced at the database layer, not just in the app's UI

6. How we moderate

Privacy-first does not mean anything-goes. Grav prohibits child sexual abuse material, sexual content, and abusive content entirely, see the Terms of Service for the full list. Here is exactly how enforcement works, because how a platform moderates is a privacy question:

  • Public and private content is reviewed when reported. We do not proactively scan private Feeds or Messages. When a participant reports content, that specific content and any evidence they attach is queued for trained human review.
  • Reported Messages can be reviewed. A participant can report a message or conversation and attach up to three screenshots. Moderators review the reported material, not unrelated private content.
  • Human-reviewed moderation. Grav does not send user content to an AI moderation provider. Reports are prioritized by their stated reason, with child-safety reports treated as urgent, and staff make enforcement decisions.
  • Zero tolerance for child exploitation, and we're proud to say exactly what that means. Confirmed child sexual abuse material is reported to the National Center for Missing & Exploited Children (NCMEC) and law enforcement as US law requires, and we provide any and all data and information we collect, account details, the content, timestamps, sign-in IP addresses, and relevant interaction records. Evidence is preserved for law enforcement for the legally required period. Our privacy commitments protect people, not predators.
  • Accounts under review may be frozen. When a serious report requires an investigation or legal preservation, involved accounts may be placed under review-hold. Account deletion can be delayed while that hold or legal obligation remains active. Staff release or escalate holds after human review.

You can report any post, message, comment, user, or Feed from inside the app, with up to three screenshots attached as evidence, and block anyone. If we action your content or account, you can appeal via Settings → Support.

7. How long we keep it

  • Account data, until you delete your account
  • Messages remain available until you delete them through product controls, or until the related conversation or account is deleted, subject to backups, security and fraud logs, payment records, active safety reviews, legal preservation, and the other operational requirements disclosed here.
  • Expiring Feed posts and Beams are removed from normal app access when their lifecycle ends. Minimal reference metadata may remain when needed to show that an expired Beam was previously shared in a Message, without retaining its media.
  • Crash reports, retained for 30 days, then deleted
  • Screenshot events, retained for 14 days, then deleted
  • Account activity records, retained for up to 365 days so we can investigate support requests, reproduce account-state problems, prevent abuse, and verify whether a requested account action occurred

Deletion controls do different things on purpose:

  • Deleting a message you sent removes its content for everyone in the conversation and may leave a neutral deleted-message marker.
  • Removing a conversation from your view clears it for you and does not erase another participant's retained copy.
  • Deleting content you authored removes that post, thought, comment, or media from Grav.
  • Deleting your account removes the account and the content you authored from active Grav systems. Other people keep content they created themselves.

Account deletion is intended to remove your account and user content promptly, subject to safety review, legal preservation, payment records, fraud/security logs, backups, and diagnostic retention that we disclose here. It is intended to remove:

  • Profile, posts, thoughts, messages, comments, likes, reactions
  • Media files in storage
  • Subscriptions, Feeds you owned (members keep their own content)
  • Push notification tokens, message device records, pending data exports

The narrow exception: if specific content is subject to an active abuse investigation or a legal preservation obligation, we may retain that content for as long as the law requires before destroying it.

8. Where the data lives

Grav's database and media storage are hosted in the United States. Data is protected in transit with HTTPS/TLS, and access to stored data is restricted by database access policies and private storage buckets.

We never transfer your information to advertising networks. The public website does not load Google Analytics, set analytics cookies, or join website visits to a Grav account. We monitor the site through hosting-level request counts, error rates, and performance metrics, together with Cloudflare's cookie-free browser performance beacon described above. Like every internet host, our website provider processes normal request information to deliver and secure the site. Google Fonts receives normal request information when your browser downloads Grav's typefaces. The iOS and Android apps contain no Google Analytics, advertising network, or third-party behavioral analytics SDK.

9. Your rights

You can:

  • Access your data, open the app and view your profile, posts, messages
  • Correct your data, edit your profile, edit captions on posts, edit thought text
  • Delete your account, Settings → Delete Account. Deletion is intended to be prompt and permanent, subject to the retention exceptions described above
  • Export your data. You can request a data export from Settings. The export contains the information currently available to Grav, and the download is available through a time-limited link (valid for 7 days). A small number of historical records created under earlier message formats may not be readable in the export. (Email privacy@social-orbit.app if you can't access the app.)
  • Block anyone, Settings → Blocked Users
  • Withdraw consent for notifications, iOS Settings → Notifications → Grav

If you're in a jurisdiction with GDPR-equivalent rights, you also have the right to lodge a complaint with your supervisory authority.

10. How we protect your data

  • Message protections, secure connections, controlled conversation access, protected storage, short-lived media links, message approval and blocking controls, metadata protection on supported upload paths, and ongoing security monitoring.
  • Private storage access on every database table, each user can only read what they're authorized to see
  • Short-lived media URLs, image and video links expire roughly every hour to limit the window of any leaked URL
  • Metadata stripping on upload, GPS, device info, timestamps removed before bytes leave your device
  • Report evidence, members can attach relevant screenshots to a report for authorized reviewers. Grav does not blank viewed content during screen recording or notify a member when another person captures their content
  • Database access policies, the app deliberately provides no way to download or export someone else's content

We use HTTPS/TLS to protect data in transit. Stored content sits behind authenticated access, row-level database policies, and private storage buckets served through short-lived links. Staff access to private content is limited to defined administrative, moderation, and privacy roles, is used for reports, investigations, support, and legal requirements, and administrative actions are written to an audit log. No system is perfectly secure. If a security incident affects your information, Grav will provide notice as required by applicable law.

11. Children

Grav is intended for adults 18+. We use App Store age rating and account enforcement, and we remove underage accounts when discovered. We do not knowingly collect data from anyone under 13 (COPPA).

If you're a parent who believes your child has registered, contact privacy@social-orbit.app and we'll remove the account immediately.

12. Changes to this policy

If we make material changes, we'll notify you via in-app banner and email at least 14 days before the changes take effect. The "Last updated" date at the top tracks when this document last changed.

13. Contact

  • Privacy questions: privacy@social-orbit.app
  • Account deletion help: Settings → Delete Account, or email above
  • Data export: Settings → Export my data, or email above

We aim to respond within 7 days.

This policy is written in plain English on purpose. If anything is unclear, ask us, we'd rather explain than hide behind legalese.