Privacy Policy

1. Information We Collect

1.1 Account Information

Email address and authentication data managed through our identity provider. We do not store passwords directly.

1.2 User Content

Sketches, images, versions, Skill Checks, and related metadata such as size and timestamps.

1.3 Analytics & Diagnostics

The Grifoli app uses PostHog for bounded product analytics and crash diagnostics. Analytics and diagnostic properties do not include email addresses, names, artwork, prompts, feedback content, or other private user content.

We also collect aggregate session counts, total durations, and duration ranges. App duration measures foreground time; website duration measures visible-page time. We store these totals without linking them to an account, a persistent device identifier, or individual session history. Standard network metadata, such as an IP address, may accompany a submission while it is transmitted.

1.4 Device Permissions

Access to photos, camera, and network connections.

2. How We Use Information

• Provide and improve App features
• Sync user content
• Perform Skill Checks and analysis
• Handle purchases and subscriptions through Apple
• Customer support & security

3. Storage & Retention

Account authentication data is stored securely using our identity provider. User-created content and related metadata are stored securely to provide core app functionality.

Saving or storing a drawing in Grifoli does not by itself send it for AI analysis or use it to train an AI model. AI processing happens when you use a feature that requires analysis, such as feedback, a Skill Check, exercise analysis, or drawing-guide generation.

You may delete your account at any time from within the App settings or request deletion on our account deletion page at https://www.grifoli.com/account-deletion/. When you delete your account, your authentication data is permanently removed. Purchase records may be retained for financial or legal purposes. We retain the email address and operation details needed to verify and complete a deletion request; completed or expired request records are removed after 30 days, while unresolved cleanup retries remain until they can be completed.

4. Third-Party Services

We use Apple APIs and Apple StoreKit to provide core app functionality and process in-app purchases. We use PostHog for the analytics and diagnostics described above.

For AI feedback, Skill Checks, exercise analysis, classification, and drawing-guide generation, our backend temporarily gives OpenAI access to the relevant image and sends the request needed to provide that feature. OpenAI states that API inputs and outputs are not used to train its models unless the API customer explicitly opts in to data sharing. OpenAI may retain API content in abuse-monitoring logs under its API data policies; retention and access controls are separate from Grifoli's storage and from the expiry of our temporary media URL. Grifoli does not claim Zero Data Retention unless the applicable organization and endpoint configuration has been verified.

AWS hosts our backend and media storage. When the app registers for remote notifications, we store the device token with your account. Purchase and subscription records include Apple transaction identifiers linked to your account.

5. Children’s Privacy

The App is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe that a child has provided personal information through the App, please contact us and we will take appropriate steps to remove such information.

6. Your Rights

You can access and manage your account information directly within the App. You may delete your account at any time from the App settings.

If you have questions about your data or this Privacy Policy, you may contact us at support [at] grifoli [dot] com or use the contact form.

Account deletion

7. Changes

We may update this policy as needed.