Gratelle Privacy Policy — Pilot Program

Last updated: October 12, 2026 Effective date: October 12, 2026

The essentials

• Gratelle is an attention and self-reflection tool for people 18 and older. It is not therapy, medical care or an emergency service.
• We store your reflections and responses so you can see them in your Journal and track your progress.
• We do not sell your data, use it for advertising or use third-party advertising trackers.
• Our team does not read your Journal. The only exception is if you expressly authorize the optional internal use described in section 6.
• If you joined through a coach, your coach sees your activity only if you allow it, and never sees your reflections.
• You can export your Journal and delete your data from Settings at any time.
• If you live in Washington, Nevada or Connecticut, please also read our Consumer Health Data Privacy Policy.

1. Who we are

Gratelle is operated by Ownday Solutions Inc, a Florida corporation ("Gratelle", "we").

• Address: 184 Aces High Ln, Davenport, FL 33896, USA
• Privacy: gratelleapp@gmail.com
• Website: https://www.gratelle.com

This policy applies to the Gratelle website and web app during its U.S. pilot program. Access to the pilot is by invitation.

2. Information we collect

Your reflections may include information about emotions, mental health or other sensitive matters. Only write what you want to record, and avoid including other people's information. Giving us your phone number does not mean you agree to SMS marketing.

Gratelle is not a crisis service. We do not monitor your reflections in real time. If you are in danger or thinking about harming yourself, call or text 988 (Suicide & Crisis Lifeline) or call 911.

3. Pilot coaches

If you signed up through a coach's invitation:

• Always: we record that link and whether your subscription is active, because coaches earn a commission for each client with an active subscription. As a result, the coach may know that you signed up through their invitation and whether your subscription is active.
• Only with your permission: the coach can see your activity, meaning check-ins completed, active days and streaks. This permission is optional and off until you turn it on. You can withdraw it at any time in Settings.
• Never: the coach cannot see your reflections, open-ended responses, intentions or GAI scores.

Coaches are independent professionals, not Gratelle employees. They must keep the information they see confidential and use it only to support you.

4. How we use information

We use information to:

• Create and protect your account.
• Provide check-ins, the morning routine, the Journal, assessments and reminders.
• Show your progress and, if you allow it, share it with your coach.
• Manage your subscription and coach commissions.
• Evaluate and improve the pilot using usage data that contains no free text.
• Respond to your requests and comply with the law.

We do not use your data for advertising, commercial profiling or training artificial intelligence models.

The only automated emails we send are access codes and payment receipts. We do not send marketing emails.

5. Your authorizations

Each authorization is requested separately, with boxes unchecked by default. We record the version and date of each authorization you give or withdraw. Withdrawing an authorization does not affect what we did before you withdrew it. If we ever want to use your data for a new purpose that requires consent, we will ask you first.

6. Human review, optional improvement and artificial intelligence

Our team does not read your Journal. We review and write Gratelle's content (questions, affirmations and micro-actions), not what you write.

There are three exceptions:

• Optional improvement: if you authorize it, an authorized Gratelle administrator may review your reflections and open-ended responses in an internal export. The goal is to improve the wording of questions and micro-actions. In that export, texts carry a pseudonymous code instead of your name or email. Note that pseudonymous does not mean anonymous, because the text itself may identify you. We do not share these texts with external researchers, universities or AI providers. If you withdraw this authorization, we stop including your texts and delete them from existing exports.
• Support: when you ask us to help with a specific problem, and only as needed to solve it.
• Security or law: when needed to investigate a security incident or meet a legal obligation.

Artificial intelligence: Gratelle currently does not use AI models or machine learning to analyze or respond to your activity. All content is written in advance and selected using fixed rules. We do not send your data to AI providers. If we ever add AI features, we will update this policy and ask for your consent before using them with your data.

7. Who we share information with

• Providers that run the service on our behalf:

  • Lovable Cloud (hosting, database and authentication) and Cloudflare (delivery and protection).
  • Apple, Google or Mozilla, which deliver push notifications depending on your browser.
  • Google (Gmail), for support email.

  They receive only what their function requires.

• Stripe: processes payments on its own page (checkout.stripe.com). We send Stripe your email and an internal identifier to create the payment. Gratelle does not receive or store your card details; it receives only your subscription status. Stripe handles your data under its privacy policy.

• Your coach: as described in section 3.

• Authorities: when validly required by law, limited to what is strictly necessary.

• Corporate transactions: in a merger or acquisition, with the same protections as this policy.

We do not sell your personal data or share it for targeted advertising, including under California's definitions of "sell" and "share".

8. Cookies and on-device storage

Gratelle does not use advertising cookies or third-party trackers (such as Google Analytics or Facebook Pixel). We use your browser's storage for the following:

Stripe may use its own cookies on its payment page to prevent fraud.

When you delete your account, we remove your session token. Language and theme preferences may remain in your browser until you clear site data; they do not contain your name, email or reflections.

9. Do Not Track and Global Privacy Control

We do not track people across websites, so we do not change our practices in response to Do Not Track signals. We honor the Global Privacy Control (GPC) signal as a request not to sell or share your data, which we do not do anyway.

10. Security

• Encryption in transit: HTTPS (TLS 1.2 or higher).
• Encryption at rest: hosted data and backups use AES-256 disk encryption.
• Row-level access controls, so each account can access only its own information.
• Administrative access limited to authorized personnel.

These measures are not end-to-end encryption. A Journal you download is under your control on your device. No system is 100% secure. If an incident affects your data, we will notify you as required by law.

11. Retention and deletion

How to delete your data

1. Open Settings.
2. To keep your reflections, tap "Export my journal" (file gratelle-journal.txt).
3. Tap "Leave the pilot and delete my data".
4. If you wish, give a reason for leaving. This is optional.
5. Confirm with "Delete my data and leave".

You can also do this at https://app.gratelle.com/settings or by emailing gratelleapp@gmail.com. If you cannot sign in, email us from the address you registered with.

When you confirm, we immediately delete your account and everything linked to it from our database:

• Profile, reflections, responses, intentions, assessments, GAI scores and progress.
• Preferences, authorizations, usage events, coach permissions and scheduled notifications.

We handle email requests and procedure failures within 7 days.

Deleting your account does not automatically cancel your subscription. Cancel it through the management link in your Stripe receipt, or email us and we will do it for you. Cancelling is not a requirement for requesting deletion.

How long we keep each type of data

12. Your rights

Depending on the state where you live, you may have the right to:

• Access your data and get a copy.
• Correct it.
• Delete it.
• Withdraw consent.
• Opt out of sale, sharing or targeted advertising (which we do not do).
• Limit the use of your sensitive data.

You can exercise any of these rights, even if your state does not require it, by emailing gratelleapp@gmail.com. An authorized agent may also do so on your behalf.

• Verification: we will ask only for information reasonably needed to confirm your identity.
• Timing: we respond within 45 days, extendable once by another 45 days when necessary. If we extend, we will tell you.
• Appeals: if we deny your request, you can appeal by emailing us with the subject "Privacy appeal". If you disagree with the outcome, you may contact your state attorney general.
• No retaliation: we will not treat you differently for exercising your rights.

13. Washington, Nevada and Connecticut residents

Some of your reflections and responses may be considered consumer health data. Our Consumer Health Data Privacy Policy explains the additional rights and consents that apply.

14. Minimum age

Gratelle is only for people 18 and older. If we discover an account belonging to a minor, we close it and delete the data. If you believe a minor has given us information, email gratelleapp@gmail.com.

15. Where data is stored

Our primary hosting is in the United States (Oregon region). Some providers, such as notification or payment services, may process data in other locations depending on their services. The pilot is intended for people in the United States.

16. Changes

If we change this policy, we will update the date above. If the change is significant, we will notify you in the app or by email before it takes effect. If a change requires your consent, we will ask for it.

17. Contact and language

Ownday Solutions Inc — gratelleapp@gmail.com — 184 Aces High Ln, Davenport, FL 33896, USA.

This policy is available in Spanish and English with the same content. If there is any difference, the English version prevails.