Privacy Policy

Grapla ("we", "us", "our") is operated from Dublin, Ireland. This policy explains what personal data we process when you use the Grapla iOS app and this website, how we use it, and your rights under the General Data Protection Regulation (GDPR).

Grapla requires no account. It is offline-first: the data you create lives on your device. We process the minimum data necessary to operate the service and we do not sell your personal data to third parties.

Depending on how you use Grapla, the following may be processed:

• Your training data — sessions, notes, and logged entities — is created and stored on your device, with optional iCloud sync across your own Apple devices. It is never sent to us.
• Anonymous usage analytics — a randomly generated distinct ID and a small set of structured event names (session start, tab switches, position views, technique creation, training logs, feedback taps), processed by PostHog. See section 08 — Analytics for the full list. On by default; can be turned off in Settings.
• Feedback content — if you send in-app feedback, the message text is transmitted to PostHog as anonymous User Content, not linked to your identity. We ask you not to include personal information in it.
• Purchase status — Grapla is free to download; Grapla Pro is an optional one-time in-app purchase that unlocks the full app. Apple manages billing and confirms entitlement to us. We do not store payment card details and there is no subscription.
• Device information — iOS version and device model, collected by Apple and shared with us in aggregate for crash reporting.
• Crash logs — anonymous stack traces sent via Apple's built-in crash reporting to help us fix bugs.

Under GDPR, we rely on the following legal bases:

• Contract performance — processing your one-time Grapla Pro purchase is necessary to deliver the entitlement you bought.
• Legitimate interests — analysing usage patterns (in aggregate, anonymously) to improve app features and content.
• Legal obligation — retaining billing records as required by Irish tax law.

• Confirm your Grapla Pro entitlement through Apple In-App Purchase.
• Understand aggregate, anonymous feature usage to prioritise improvements (opt-out in Settings).
• Diagnose crashes and improve app stability.

We do not use your training data to profile you. It stays on your device and, if you enable iCloud, in your own private Apple iCloud — we have no access to it.

We do not sell or rent your personal data. We share data only with:

• Apple Inc. — for In-App Purchase billing and App Store analytics. Apple's privacy policy governs their handling of this data.
• PostHog, Inc. — processes anonymous product analytics events from the iOS app on our behalf under a Data Processing Addendum. See section 08 — Analytics.
• Vercel Inc. — this website is hosted on Vercel. Server logs may include your IP address for a limited period.
• Law enforcement — only where required by a valid legal obligation under Irish or EU law.

We do not hold an account for you. The data you create in the app lives on your device — and, if you enable it, your own private iCloud — and is removed when you delete the app and clear iCloud data. We retain anonymous analytics as described in section 08, and Apple retains billing records as required by law (typically 7 years under Irish Revenue requirements).

If you are in the European Economic Area, you have the right to:

• Access — request a copy of any personal data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure — ask us to delete your data (the "right to be forgotten").
• Portability — receive your data in a machine-readable format.
• Restriction — ask us to restrict processing while a dispute is resolved.
• Object — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent, withdraw it at any time.

To exercise any of these rights, email us at privacy@grapla.app. We will respond within 30 days. You also have the right to lodge a complaint with the Data Protection Commission (Ireland) at dataprotection.ie.

To improve Grapla, the iOS app collects anonymous usage analytics through PostHog (PostHog, Inc.), a third-party analytics processor acting on our behalf under a Data Processing Addendum: posthog.com/dpa.

What we collect. Each analytics event consists of:

• An anonymous distinct ID — a randomly generated identifier created on first launch. It is not linked to your Apple ID, email address, or any other personal information, and we never call PostHog's identify() API with personal data.
• session_started — recorded on each cold launch.
• tab_switched — records the tab navigated from and to (e.g. from: "Atlas", to: "Flow Lab").
• position_viewed — records the position identifier and perspective type (e.g. position_id: "mount", perspective: "controlling").
• technique_created — recorded when a technique is saved in Flow Lab.
• training_logged — recorded when a training session is saved.
• feedback_button_tapped — recorded when the in-app feedback action is triggered.

What we do not collect.

• We never ask for or attach your name, email, or Apple ID to analytics events. The only free-text we receive is feedback you choose to send (see section 02) — please don't include personal information in it.
• No Apple Identifier for Advertisers (IDFA) — we do not request advertising tracking permission.
• No data shared with third-party advertisers or ad networks.
• No sensitive data categories (health, financial, biometric, etc.).

Opt-out. Analytics collection is on by default and can be toggled off at any time in Settings → Privacy → Share anonymous usage data. The onboarding tour includes a Privacy card that surfaces this option on first launch. When the toggle is off, no events are sent to PostHog. Your choice is stored locally and respected immediately — no restart required.

Data retention.Anonymous analytics events are retained for 12 months, after which they are deleted. This is shorter than PostHog's default 7-year retention period.

Data location.PostHog processes data on infrastructure located in the United States and/or the European Union. See PostHog's privacy policy at posthog.com/privacy for details.

This website uses no advertising or analytics cookies. Vercel may set a strictly necessary session cookie for performance and security. The Grapla iOS app uses PostHog anonymous analytics (see section 08) and no third-party advertising SDKs.

Grapla is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

We may update this policy as the app evolves. Material changes will be communicated via an in-app notice. Continued use after the effective date constitutes acceptance of the updated policy.

Data controller: Grapla, Dublin, Ireland. Email: privacy@grapla.app