Privacy policy
Effective September 28, 2026
Grafiora is a private app in which a family keeps a child’s photos, videos, stories and milestones, shared only with the people the family invites. This policy explains what the app and this website collect, why, who can see it, how long it is kept and what you can ask of us.
It is written to be read. Where a section says “we”, it means the Grafiora team, who operate the app and this website and are responsible for the personal data described here. You can reach us at privacy@grafiora.com.
1. What Grafiora is, and who it is for
Grafiora is used by adults. You must be at least 18 to create an account. Families use it to keep memories of their children and of each other, so most of what it holds is about people who do not use the app themselves, children first of all. The adult who adds a memory is responsible for having the right to share it with the family members they invite, and every member of a family sees everything that family holds.
2. What we collect
Your account. Your phone number and the name you want shown to your family. Grafiora has no passwords: you sign in with your phone number, and a code sent to it by text message confirms that it is yours. When you sign in, the app receives a sign-in token that it keeps in your phone’s secure keychain. We store only a hash of that token, together with the name your phone gives itself (so you can recognise it in your list of signed-in devices), when it was last used, and when it expires, ninety days after sign-in.
Your email address, if you add one. An email address is optional. Once you verify it, we use it to help you back into your account if you lose access to your phone number, to confirm it is you before a sensitive change, and to write to you about your account. We keep a hash of each code we email you, which works for ten minutes.
A record of your account’s security. When your account is created, your phone number or email changes, an account is recovered or a device is signed out, we note what happened and when, so we can help you if something looks wrong. The record never holds a code or a token, and it is erased with your account.
Your family. The family’s name, who its members are and whether each is an owner or a member. When an owner invites someone, we store the invited person’s phone number and a hash of the invitation link’s secret. An invitation that is not accepted expires after seven days.
The people in it. For each person you add: their name, their relationship to the family, and their birth date if you give one. People in Grafiora need not have an account; a child, a grandparent or a friend is simply a person the family remembers things about.
Memories. The date a memory happened, its title and story if you write them, the milestone you mark it with if any, the people it is about, and its photos and videos.
What a photo brings with it. When you add a photo from your photo library, the app reads what the photo file already records about itself, if the file has it: when it was taken and in which time zone, where it was taken (coordinates and altitude), the camera’s make, model and lens, and the file’s name, type, size and dimensions. These are stored with the photo so your family can see when and where a memory was captured. Grafiora never uses your phone’s location service, never asks for location permission, and does not track where you are: a place only enters Grafiora when a photo file carries it. The copy of a photo the app shows and puts in books is made without this embedded data. Grafiora keeps a high-quality copy of each photo, at most 3,000 pixels on its longest side, not the original file, and anyone in the family can save a copy of it to their phone. You can also record who took a photo and who is in it. Videos carry only their file details and length.
Memory books. When you make a book, we render the memories you chose into a PDF document and keep it with the family’s other files.
Support. If you write to us, we keep your message and our reply so we can help you.
Technical records. Our servers keep request logs for a short time: which route was called, when, how long it took, its outcome and a request identifier; our hosting provider’s own access logs also record the requesting address. Logs never contain the content of memories, names of people, media, links to media, or tokens; this is a rule the code enforces. On your phone, the app keeps a memory you have just saved, with its photos and their details, in the app’s own private storage until it has been uploaded, so that closing the app or losing the connection does not lose the memory.
This website sets no cookies and includes no analytics or tracking. If you choose its light or dark appearance, your browser remembers that choice on your device; it is never sent to us. Fonts are served from this site, not from a third party.
What we do not collect. Grafiora reads none of your contacts, does not use your phone’s location, contains no advertising, no advertising identifiers, no analytics or tracking software and, at this release, no crash reporting. It does not use your photos, videos or stories to train any model, and never will without asking you first.
3. Why we use it
We use the data above for one purpose: to run Grafiora for your family. In particular:
- to show your family its memories, timelines, people and books, and to keep them from anyone who is not a member;
- to sign you in and to protect your account, which includes slowing down repeated attempts to sign in, to create accounts and to guess a code;
- to render the memory books you ask for;
- to answer when you write to us;
- to keep the service working, by reading logs when something fails;
- to meet obligations the law places on us.
We do not sell personal data, do not share it for advertising, and do not build profiles of you or your family.
Where the law asks for a legal basis: running the service you signed up for (performance of a contract); keeping it secure and working (legitimate interest); and your consent, where we ask for it specifically, for instance before any use of your content that this policy does not already describe.
4. Who can see your family’s content
Your family’s members. Every member of a family sees all of that family’s people, memories, media and books. Owners can also invite people, revoke invitations and remove members. A family can have more than one owner: any owner can make a member an owner or return an owner to being a member, and a family always keeps at least one owner. If the last owner deletes their account, the member who has been in the family longest becomes its owner. The person who added a memory and any owner can delete or restore it. You choose who joins: an invitation is a link only you send, and only the person who signs in with the invited phone number can accept it.
Us. We do not browse family content. Access to production data is limited to what operating the service requires, for example investigating a fault you report, and the logs we normally work from contain no content at all.
Service providers. We run Grafiora with four companies, which process data on our behalf and under contracts that limit them to providing that service:
| Provider | What it does for Grafiora | Where |
|---|---|---|
| Vercel Inc. | Runs the app’s server and this website; stores photos, videos and books in a private file store | Frankfurt, Germany |
| Neon Inc. | Hosts the database that holds accounts, families, people and memories | Frankfurt, Germany |
| Google LLC | Verifies your phone number by sending the sign-in code by text message | The United States and other countries |
| Resend Inc. | Sends the emails Grafiora writes to you, such as a code to verify your email address | Dublin, Ireland |
Google sees your phone number and the code it sends, not your family or its memories. Resend sees your email address and the message it delivers.
Photos, videos and books are kept in private storage and reached only through links that expire fifteen minutes after the app requests them.
App stores. You install Grafiora from Apple’s App Store or Google Play. What those stores collect about downloads and purchases is governed by their own privacy policies, not this one.
Maps. If you tap “Open in Maps” on a photo’s details, the coordinates are handed to the maps app you choose, which then acts under its own policy.
When the law requires it. We may disclose personal data to comply with a law, a court order or a lawful request by a public authority, or to protect the safety of a person or the security of the service. If Grafiora were ever transferred to another operator, this policy would continue to apply to the data transferred, and we would tell you first.
5. Where the data is kept
Grafiora’s servers, database and file storage are in Frankfurt, Germany, in the European Union. Our providers are headquartered in the United States and may access data from there in the course of running their services, under contractual safeguards. If you use Grafiora from another country, your data is stored in the European Union all the same. The one exception is verifying your phone number: Google handles the number and the code it texts you in its own data centres, which may be outside the European Union.
6. How long we keep it
| What | How long |
|---|---|
| Your account | Until you delete it (see below); deletion in the app is immediate |
| Sign-in sessions | Ninety days, or until you sign out |
| Email codes | Ten minutes, after which they no longer work |
| Your account’s security record | Until your account is deleted |
| Invitations | Seven days if not accepted; an accepted or revoked invitation is kept as part of the family’s membership record, until the account of the person who sent it or accepted it is deleted |
| Memories, people, media and books | For as long as the family keeps them |
| A deleted memory | Thirty days in “Recently deleted”, during which it can be restored, then permanently erased with its files |
| A photo or video removed from a memory | Hidden at once; its file is erased thirty days later |
| A memory still uploading on your phone | Until it has been uploaded; deleting the memory discards it at once |
| Support messages | For as long as needed to help you and to keep a record of what was agreed |
| Server logs | A short period set by our hosting provider, at most a few days |
| Database backups | Seven days: anything deleted, a whole account included, is gone from them within seven days |
7. Your choices and rights
In the app. You can edit or delete any memory you added, edit the family’s people, rename your family if you are an owner, remove a photo or video from a memory, restore a memory deleted within the last thirty days, leave a family (if you are its only owner, first make someone else an owner), change your phone number, add, verify or remove your email address, and sign out any of your devices.
Deleting your account. In the app, open Settings, then Account, and choose Delete account. After you confirm it’s you, your account is deleted at once: your phone number, name and email address, your sign-in sessions and security record, invitations you sent, anything of yours in “Recently deleted”, and every family in which you are the only member, with everything in it. A family you share with others keeps the memories you added, without your name. Our database backups, which let us recover from a fault, roll off within seven days, so after that no copy of your account remains; we never restore a deleted account from them. If you can no longer sign in, write to support@grafiora.com. Delete your account gives the details, including how we confirm an emailed request is yours.
Your rights. Depending on where you live, you may have the right to access the personal data we hold about you, to have it corrected or erased, to receive a copy of it in a portable form, to object to or restrict certain processing, to withdraw a consent you gave, and to complain to a data-protection authority. Write to privacy@grafiora.com and we will answer within a month. If the request concerns content another family member added about you, we will help that family respond.
8. Children
Grafiora is not directed at children and does not knowingly let anyone under 18 create an account. Children appear in Grafiora as people their parents and guardians remember things about. The adult who adds content about a child is responsible for it, as they would be for a family photo album, and for deciding who to invite to see it. If you believe a child has created an account, or that content about a child is in a family it should not be in, write to us and we will act on it.
9. Security
Everything between the app and our servers travels over HTTPS. There are no passwords to steal. Sign-in tokens, email codes and invitation secrets are stored only as hashes and expire. Every request to a family’s data is checked against the caller’s membership of that family. Media and books live in private storage behind short-lived links. Repeated sign-in attempts and wrong codes are limited. Operator access to production data is restricted. No system is perfectly secure; if we learn of a breach affecting your personal data, we will tell you, and where the law requires it the authorities, without undue delay. If you find a weakness in Grafiora, please write to security@grafiora.com before telling anyone else, so that we can fix it first.
10. Changes to this policy
When we change this policy we will update the effective date at the top, and for a material change we will tell you in the app, or by email if you have given us a verified address, before it takes effect. Continuing to use Grafiora after that date means the new policy applies.
11. Contact
Questions, concerns or requests about your privacy: privacy@grafiora.com. Help with the app itself: support@grafiora.com.