Self-audit
Published
Website, iOS account record, database access boundaries, and policy copy reviewed.
Privacy Proof v1 · reviewed September 13, 2026
Grav Privacy Proof Center
Do not take our word for it. Privacy claims should be inspectable. This page publishes what we checked, what we found, what is outside Grav's control, and how you can test the public website and your own account.
This is a dated self-audit, not an absolute guarantee. Software can have bugs and configurations can drift. We will publish corrections and future reviews here.
Website disclosure corrected October 4, 2026: a live browser check found Cloudflare's performance beacon. Earlier wording that said the website had no browser analytics script was inaccurate. This correction does not represent a new full app or database audit.
Independent assessment
Not commissioned yet
This page does not pretend our own review is independent assurance.
My Grav Record
Built for iOS
Release and physical-device verification are still required before App Store availability.
Current finding
What Grav keeps, and why
The honest claim is not that Grav collects nothing. A private social app needs information to work. The test is whether each category has a clear purpose and a real control.
Account and sign-in
Email, profile details, account dates, and the sign-in methods linked to your account.
Why: Create, secure, and recover your account.
Content and connections
Posts, media, reactions, Feed memberships, invitations, blocks, and related timestamps.
Why: Deliver the private social features you choose to use.
Messages
Message content, conversation membership, requests, reactions, and delivery records.
Why: Deliver, synchronize, restore, secure, support, and moderate conversations when required.
Devices and diagnostics
A push token when notifications are enabled, plus limited crash, security, and operational records.
Why: Send requested notifications, prevent abuse, and keep Grav reliable.
Purchases, support, and privacy requests
Entitlement and transaction references, support tickets, reports, archive jobs, and deletion requests.
Why: Honor purchases, answer requests, meet accounting duties, and document privacy choices.
Public website requests
Cloudflare processes normal requests and browser performance measurements, including page/referrer URLs. Google Fonts receives requests for Grav's typefaces.
Why: Deliver, secure, and operate the website using hosting metrics and Cloudflare's cookie-free browser performance beacon.
Negative findings
What we did not find
These are specific, testable boundaries. They are stronger than a vague promise that we care about privacy.
- No sale of personal information
- No ad network or advertising profile
- No IDFA or cross-app tracking
- No contact-book upload
- No precise-location permission
- No collection of browsing histories or cross-app activity
- No use of private posts or Messages to train Grav AI models
Traffic without Google Analytics
How we monitor the public site
Grav uses Cloudflare hosting metrics for request volume, errors, and performance. The live website also loads Cloudflare's browser performance beacon. There is no Google Analytics script and no Grav analytics cookie.
Requests
How much traffic the site is serving.
Reliability
Errors and failed requests that need attention.
Performance
Hosting metrics and browser page-load measurements used to keep pages healthy.
Cloudflare's beacon reports page-load measurements and page/referrer URLs. Cloudflare documents it as not using cookies or browser storage; see its browser performance beacon documentation. This does not make a web request invisible: Cloudflare also processes normal request data to deliver and protect the site, and Google Fonts receives requests for the site's typefaces. This review does not verify every provider's retention settings.
Outside Grav
Third parties and their boundaries
App stores, payment processors, sign-in providers, infrastructure providers, and your device may collect information under their own policies. We cannot honestly claim otherwise.
Database and media storage
Stores the account information and media needed to operate Grav.
Access is restricted by authenticated account and membership rules.
Cloudflare
Hosts, delivers, and protects the public website.
Processes normal web requests and browser performance measurements. The live site loads Cloudflare's performance beacon, documented by Cloudflare as cookie-free.
Apple
App distribution, optional Apple sign-in, push delivery, and in-app purchases.
Apple may collect information under its own policies when you use those services.
Optional Google sign-in, Android push delivery, and public-site font delivery.
Google sign-in is linked only when you choose it. These services remain governed by Google's policies.
Stripe
Web-based payments for applicable Grav purchases and business tools.
Stripe handles payment details under its own policies. Grav does not receive full card credentials.
Method
Our self-investigation
We use the same checklist for each published review so changes can be compared instead of hand-waved.
- 01
Inventory code and dependencies
Search for analytics, advertising, identity, payment, diagnostics, notification, storage, and moderation integrations.
- 02
Inspect network and browser storage
Check every public page for tracker requests, cookies, local storage, and identifiers before and after navigation.
- 03
Review database boundaries
Inspect schemas, access policies, function grants, private media rules, and the exact fields returned to each account.
- 04
Exercise two-account isolation
Create rollback-only test fixtures and confirm one authenticated account cannot read another account's record.
- 05
Reconcile every public promise
Compare the product, privacy policy, App Store disclosures, provider behavior, and the live My Grav Record response.
Reproduce it
Test the website yourself
You do not need access to our repository. A normal desktop browser can verify the public-site claims below.
- 1
Open developer tools
Choose the Network tab, enable Preserve log, and reload this page.
- 2
Look for trackers
Filter for googletagmanager, google-analytics, doubleclick, facebook, segment, and mixpanel. The result should be empty.
- 3
Inspect storage
In the Application or Storage tab, check Cookies and Local Storage. Grav should not leave a Google Analytics cookie or analytics-consent key behind.
- 4
Identify the performance beacon
Look for static.cloudflareinsights.com/beacon.min.js and /cdn-cgi/rum requests. These are Cloudflare performance monitoring, not Google Analytics. Browser settings, region, and blocking tools may affect whether they appear.
- 5
Check your account
When the next iOS release is available, open Settings, Privacy & Data, then My Grav Record. Compare its categories with your archive request.
Browser console check
performance.getEntriesByType("resource").map((entry) => entry.name).filter((url) => /googletagmanager|google-analytics|doubleclick|facebook|segment|mixpanel/i.test(url))Paste this into the Console after reloading. An empty array means none of the listed tracker domains loaded. It does not prove every possible privacy claim.
Account evidence
My Grav Record
The public audit explains the system. Your private record answers the personal question: what does Grav currently hold for my account?
Directly in account settings
It shows live counts, why each category is needed, retention guidance, export and deletion status, connected services such as Google sign-in when applicable, and the sensitive fields the screen intentionally never displays.
It is an overview, not the downloadable archive itself. The archive remains a separate request because it can take time to assemble and must be delivered securely.
Found a mismatch?
Tell us exactly what you observed. We will investigate it, correct the product or the claim, and date the change here. That feedback loop is part of the proof.