Grief-data ethics · v1, July 2026
How we treat grief data
Grief is not a market segment. What you carry here - your words, your dates, your people - is the most sensitive thing anyone could hand us. These are the promises we make about it, in writing, so you can hold us to them.
No ads, ever
Nothing here is funded by attention. There are no ads, no sponsored anything, and no tracking built to follow you around the internet. The app is paid for by membership and by the trips - by people, not by data.
Your grief is never sold - or used against you
We will never sell, rent, or trade what you write or who you've lost. We will never use your loss to target you with anything. No AI is trained on your writing. The details of your grief exist here for one purpose: so this place can hold them with you.
No machinery designed to pull you back
No streaks, no scores, no engagement metrics, no algorithmic feed. Coming back is the whole thing - and it has to be your choice, not a mechanic's. The absence of these things is not an oversight; it is the design.
Tender dates are sensitive, full stop
The anniversaries and birthdays you record are treated as the most sensitive data in the system. They are used only to be gentle - the quiet heads-up you asked for, a softer app on a hard day - and never as triggers for marketing, campaigns, or anything commercial. Your Circle is told a date is near only when you ticked that box, and you can untick it any time.
Your journal is yours; the prompt is the Circle's
Anything you write in your journal is yours alone unless you deliberately share it. The daily prompt is the one place that starts shared: it is a question your Circle answers together, so an answer goes to your Circle unless you choose "Keep private" before you save. Either way it is per entry, revocable from your journal at any time, with the rules enforced in the database itself. The mechanics live on the privacy page; the principle lives here: you always know who can see a thing before you write it, and you can always take it back.
No griefbots. Not ever.
We will never build, host, or integrate a synthetic voice, chatbot, or simulation of the person you lost. This place exists for connection with the living and with memory - not synthetic resurrection. This is a permanent line, not a current policy.
Leaving is honored
Deleting your account deletes your data: entries, dates, people, letters, what the tools kept and the words part way through them, drafts and memorial photographs, and your settings. That happens after 14 days, kept hidden from other members until then in case you change your mind. Until then you can download all of it as one file, made on your own device from your own account, with your private entries opened in it for you alone. After the 14 days it is permanently deleted, and can no longer be downloaded or recovered. Once the account is gone, the next time the app opens on the device you deleted from, it clears what it still kept there, such as anything that had not reached your account yet. The controls are in your account, they work, and nobody will guilt you on the way out. The same goes for a buddy: ending a pairing is two taps, no reason asked, and the other person is told only that it ended.
Private entries are encrypted
Private journal entries are encrypted in your browser before they're stored, so what sits in our database is not readable words. Being straight with you about what that is worth: the key is held with your account, so we could decrypt a private entry if we set out to. We don't, and nobody here has a reason to. What the encryption does buy is real but narrower than it sounds. Your key is itself encrypted, with something kept outside the database entirely, so a stolen copy of the database holds your words as ciphertext and your key as ciphertext and no way to turn one into the other. Reading a private entry takes both halves and somebody here deciding to. The app no longer writes your key to your device: it is fetched from your account when you open the app and held only in memory. A key that once lived on a single device goes to your account, encrypted the same way, the next time the app opens on that device, so the entries it sealed open wherever you sign in. For now that device keeps its old copy too, as a spare. Until 19 September 2026 the key lived only on your device and we genuinely could not read a private entry. That also meant your own journal could not follow you to a new phone, and that losing the phrase lost the words for good, with nothing anyone could do. We chose your writing being there over a stronger claim we could make about ourselves, and would rather say that plainly than leave the old sentence up. Sharing an entry with your Circle is a deliberate exception: the room reads the words you chose to give it, and making it private again encrypts it again. The seal covers the words; a photo kept with a private entry is stored as a photo, and stays out of sight wherever the words are sealed.
If anything here ever stops being true, that is a betrayal of what this place is for - and you should call us on it: info@grieftrips.com.