Grava Privacy Policy

Effective date: September 22, 2026

Grava is a private connection book for keeping in touch with people you choose. You can share contact details, availability, and travel plans with accepted friends and discover when you may be nearby. Grava does not use GPS, upload your address book, sell personal information, serve advertising, or include behavioral analytics or remote crash reporting.

This policy covers the official Grava application, its public support pages, and hosted Grava Auth/Node services. Contact the Grava developer at gian2automation@gmail.com for support, privacy, security, or safety requests. A self-hosted or modified service has its own operator and privacy terms.

Information kept on your device

Your device copy of the private identity key, recovery material when applicable, profile, optional compressed profile photo, contact methods, friend list, blocked identities, trips, availability ranges, received updates, relay configuration, delivery queue, and app preferences are kept in encrypted local application storage. On iOS and Android the identity key is held in the platform secure store. Self-custodied Nostr identities on web are encrypted with your local passphrase. Regular-login keys on web are wrapped with a non-exportable key held by that browser origin.

If you enable contact-book integration, Grava reads the contacts the operating system allows and displays their current names, photos, birthdays, phone numbers, email addresses, websites, instant-message addresses, and social profiles locally. Grava may match an accepted friend to exactly one contact using an email address or normalized phone number, or store a device-local contact identifier when you link them manually. Address-book contents and these links are not uploaded to Grava relays, included in encrypted account backups, sent to friends, or copied into a Grava profile. Changes made in the system Contacts app are reflected when Grava refreshes its local view.

If you explicitly enable calendar sync, Grava creates a dedicated system calendar and writes each active trip's destination city and inclusive dates as an all-day event. Grava uses full calendar permission to create, update, repair, and remove only this dedicated calendar and the events it created; it does not import appointment titles, attendees, notes, or other calendar contents into profiles, relays, or Grava account backups. Device calendar and event identifiers stay in encrypted local application storage and are excluded from relay backups. Your operating-system calendar may synchronize the Grava calendar through Apple, Google, an employer, or another configured provider, so trip city and date data then falls under that provider's practices. Disconnecting calendar sync removes the dedicated calendar when Grava still has permission; if permission was revoked first, you must remove it in the system Calendar app.

Login and account recovery

You may choose a self-custodied Nostr identity or a regular Grava login. A self-custodied identity has no central login record: you control its nsec, 24 recovery words, and any encrypted device links, and Grava cannot recover it for you.

A regular login processes your email address, chosen account name, password credential, session identifiers and expiry, and security/rate-limit metadata. Passwords are sent to the auth service over HTTPS and stored as salted hashes rather than plaintext. Email addresses are unverified login identifiers; Grava does not send verification codes or use an email-delivery provider for signup or sign-in. Forgotten-password reset is not available in this version, so keep your password to restore access on another device.

For a regular account, Grava creates one stable Nostr key so it can communicate with either account mode. The auth service encrypts this key at rest with an operator-managed encryption key and returns it to authenticated devices over TLS. The client encrypts a minimized latest-state backup with that Nostr key before uploading it. The backup includes profile, friends without duplicate friend photos, trips, incoming trips, connection requests, blocked keys, language, and an optional push-management capability; it excludes the private key, delivery queue, contact-book data and links, and calendar identifiers. The service stores only the latest backup. Because the service can decrypt the managed key, the operator or a compromise of both the database and operator key could decrypt the backup and impersonate that regular account. Choose self-custodied Nostr mode if you do not want to place this trust in the account service.

Deleting a self-custodied identity removes its key and encrypted application state from that device. Deleting a regular account removes the login records, managed encrypted key, server backup, sessions, and local application state. Both paths attempt to delete the push capability and encrypted inbox data from the official node when configured. Neither can delete copies already decrypted by friends, data retained by third-party relays, or data left on another offline device.

Information shared with friends

After mutual acceptance, populated profile fields are encrypted separately for each friend. These may include first and last name, an optional compressed profile photo, declared home city, month/day birthday, phone, email, social profiles, availability ranges, and relay or push routing information. A trip destination and dates are sent only to friends you explicitly select during the final review step. Grava does not send live location.

An invitation contains your public identity, full name, relay addresses, expiration, and signature. It does not contain your home city, birthday, contact methods, trips, or private key.

Relays and network metadata

Relays receive signed encrypted events. Operators cannot read Grava payloads, but they can observe recipient public identities, sender event identities, IP addresses, timestamps, ciphertext sizes, relay selections, and connection behavior. Internet providers and hosting companies may observe similar connection metadata. Third-party relay operators control their own retention and privacy practices.

The official Grava Node retains encrypted relay events for no more than 120 days by default, or until event expiration or authenticated deletion, subject to backups and operational recovery windows. Inbox quotas and shorter operator-configured retention may apply.

Notifications

Notifications are optional. Enabling them sends an Expo/Apple/Google platform delivery token and your public identity in a signed request to the configured Grava Node. Friends receive only a random notification capability. Notification requests have no message body, and the node always sends generic text without a name, destination, date, or relationship detail. Push providers can observe device and delivery metadata.

Safety reports

Reporting is optional and requires an affirmative preview. A report sends your public identity to authenticate the request, the reported public identity, a selected category, and any comment you enter. It does not automatically attach profile fields, contact methods, messages, or trip details. Reports are restricted to authorized safety operators, used only for abuse response, and deleted after 90 days by default unless preservation is reasonably necessary for an active safety, fraud, or legal matter. You can also contact gian2automation@gmail.com with a safety concern.

Permissions

Grava requests camera permission only when you choose to scan an invitation or encrypted device-link QR code. It requests limited photo-library access only when you choose a profile photo, and processes the selected image on your device. It requests contacts permission only when you enable contact-book integration; supported operating systems may let you limit Grava to selected contacts. It requests full calendar permission only after you confirm calendar sync because automatic updates and removals cannot work with iOS write-only access. It requests notification permission only when you choose to enable notifications. It does not request location, microphone, advertising-tracking, or motion permission.

Purposes and legal bases

The official service processes information to provide user-requested encrypted connection, relay, notification, recovery, deletion, and safety functions; protect the service and users; comply with law; and maintain reliability. Depending on jurisdiction, the basis is performance of the service you request, your consent for optional notifications and reports, legitimate interests in security and abuse prevention, and legal obligations. You may withdraw optional consent by disabling notifications, deleting their capability, or not submitting a report.

Service providers and international processing

The iOS app uses Railway to host the authentication service, encrypted account backups, relay, and public support pages. These services currently run in Railway's Europe West region. Better Auth is authentication software running on this infrastructure; it is not a separate hosted login provider. Grava does not use an email-delivery provider for login.

Optional iOS notifications pass through the Expo Push Service and Apple Push Notification service. Apple distributes the app through the App Store and TestFlight and processes Apple-account, installation, and beta-feedback information under Apple's terms. If you email support, Google/Gmail processes your email and any attachments. These providers may process information outside your country, including in the United States. Compatible third-party relays and any operating-system contacts or calendar providers you choose have their own practices.

The public privacy and support pages do not set account cookies, use analytics, load third-party scripts, or collect form submissions. Railway may process network and request metadata to serve these pages.

Retention, deletion, and choices

• Local encrypted data remains until you delete the identity, uninstall the application, clear browser storage, or the operating system removes it.
• Regular-login records, encrypted managed keys, and latest encrypted backups remain until account deletion or operator deletion under an applicable retention/legal process. Expired sessions and rate-limit records are cleaned according to the deployed authentication configuration.
• Contact-book data is read from the operating system on demand and is not retained in Grava's encrypted account backup. Device-local friend/contact links remain until unlinked, the friend or identity is removed, or application data is cleared.
• Calendar sync is off by default. Active trip events remain in the dedicated system calendar until their trip ends or is canceled, calendar sync is disconnected, the identity is deleted while permission remains available, or the user deletes them in the Calendar app. Calendar IDs remain only on that device.
• Official-node encrypted events expire according to their event expiration and the node's maximum retention, currently 120 days by default.
• Push subscriptions remain until capability deletion, service cleanup, or token invalidation.
• Safety reports are retained for 90 days by default, with the limited exception described above.
• You can remove or block a friend, retract an active trip, disable profile availability sharing, use different compatible relays, self-host services, sign out of a regular account, delete a regular account, or delete a self-custodied identity.

Removing or blocking someone stops future application processing but cannot recall information already received.

Your rights

Depending on where you live, you may request access, correction, deletion, restriction, portability, or objection regarding information controlled by the official service, and may complain to a data-protection authority. Requests concerning a regular account require authentication or a separately verified ownership check; knowing its unverified email address is not proof of account ownership. For self-custodied identities and device-local or relay-encrypted data, the operator may still be unable to identify or recover data without information you provide. Never send an nsec, private key, recovery words, password, or session cookie to support.

Children

Grava is not directed to children under 13, or a higher minimum age required for independent consent in their country. Contact us if you believe a child provided information to the official service.

Security and changes

Contact gian2automation@gmail.com for security reports, privacy requests, and general support. Do not include recovery words, nsec values, private keys, passwords, session cookies, or unnecessary personal information. Material policy changes will update the effective date and, when appropriate, be announced in the application or release notes.