Privacy Policy

The Gray App

Effective Date: August 25, 2026 | Last Updated: August 25, 2026

1. Introduction

Welcome to The Gray App ("we," "our," or "us"). This Privacy Policy explains how The Gray App collects, uses, discloses, and safeguards your personal information when you use our mobile application and related services (collectively, the "Service").

By accessing or using the Service, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy. If you do not agree, please discontinue use of the Service immediately.

This Privacy Policy applies to all users of The Gray App, including users located in the United States (including California) and internationally.

2. Information We Collect

2.1 Information You Provide Directly

We collect the following personal information that you voluntarily provide when you create an account or interact with the Service:

Full Name (first and last name) — collected at account registration.
Email Address — collected at account registration and used for account management and communications.
Password — collected at account registration. Passwords are stored in hashed/encrypted form and are never stored in plain text.
Feedback Form Submissions (optional) — if you choose to submit feedback, we collect your name, email address, and the content of your message.

2.2 Habit and Usage Data

We collect data you input into the Service, including:

Habits you create and their completion records.
App usage patterns and interaction data (e.g., features accessed, session frequency).

2.3 Automatically Collected Information

When you use the Service, we may automatically collect certain technical information, including:

Device type, operating system, and version.
IP address and approximate geographic location (country/region level).
App version and crash/diagnostic reports.

2.4 Payment Information — Collected by Paddle, Not by Us

The Gray App does not collect, process, or store any payment or billing information. All subscription payments are processed by our third-party payment processor, Paddle (paddle.com). Paddle collects and processes the following data directly from you on our behalf:

Billing address
Credit or debit card information
Phone number
Email address (for billing purposes)

Paddle acts as the Merchant of Record for all transactions. Your payment data is governed by Paddle's own Privacy Policy, available at https://www.paddle.com/legal/privacy. We encourage you to review Paddle's privacy practices.

3. How We Use Your Information

We use the information we collect for the following purposes:

Purpose	Legal Basis (where applicable)
To create and manage your account	Performance of a contract
To provide and operate the Service (habit tracking features)	Performance of a contract
To process subscription payments via Paddle	Performance of a contract
To respond to feedback and support inquiries	Legitimate interests
To send transactional emails (e.g., account confirmation, password reset)	Performance of a contract
To send service-related communications and updates	Legitimate interests
To improve and develop the Service	Legitimate interests
To detect, prevent, and address fraud or security issues	Legitimate interests / Legal obligation
To comply with applicable laws and regulations	Legal obligation

We do not sell your personal information to third parties. We do not use your personal information for automated decision-making or profiling that produces legal or similarly significant effects.

We do not sell, rent, or trade your personal information. We may share your information in the following limited circumstances:

4.1 Service Providers and Third-Party Processors

We share information with trusted third-party vendors who assist us in operating the Service, subject to confidentiality obligations. These include:

Paddle — payment processing and subscription management. Paddle is the Merchant of Record and processes all billing data independently.
Cloud hosting and infrastructure providers — for data storage and application hosting.
Analytics providers — for aggregate, anonymized usage analytics to improve the Service.
Email service providers — for transactional and service communications.

4.2 Legal Requirements

We may disclose your information if required to do so by law, regulation, court order, or governmental authority, or if we believe in good faith that such disclosure is necessary to protect our rights, your safety, or the safety of others.

4.3 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of all or substantially all of our assets, your information may be transferred as part of that transaction. We will notify you via email or prominent notice within the Service prior to your information becoming subject to a different privacy policy.

4.4 With Your Consent

We may share your information for any other purpose with your explicit prior consent.

5. Data Retention

We retain your personal information for as long as your account is active or as necessary to provide the Service. Specifically:

Account data (name, email, password hash): Retained for the duration of your account and deleted within 30 days of account deletion (or up to 90 days where necessary for technical or legal reasons).
Habit and usage data: Retained for the duration of your account and deleted upon account deletion.
Feedback submissions: Retained for up to 2 years for quality assurance and support purposes.
Billing records: Retained by Paddle in accordance with their data retention policies and applicable financial regulations.

You may request deletion of your account and associated data at any time by contacting us at thegrayapp@gmail.com.

6. Data Security

We implement commercially reasonable technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

Encryption of passwords at rest using industry-standard hashing algorithms.
Encrypted data transmission via TLS/HTTPS.
Access controls limiting employee access to personal data on a need-to-know basis.
Regular security assessments of our infrastructure.

No method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security. In the event of a data breach that affects your rights and freedoms, we will notify you and any relevant supervisory authority without undue delay and, where required by the GDPR, within 72 hours of becoming aware of the breach, and otherwise within the timeframes required by applicable law (including applicable U.S. state breach-notification statutes).

7. Cookies and Tracking Technologies

The Gray App mobile application does not use browser cookies. We may use limited analytics tools within the app to collect anonymized, aggregate usage data. These tools do not track you across third-party websites or applications.

If we introduce cookies or additional tracking technologies in the future, we will update this Privacy Policy and, where required, obtain your consent.

8. Your Rights and Choices

8.1 All Users

Regardless of your location, you have the right to:

Access the personal information we hold about you.
Correct inaccurate or incomplete personal information.
Delete your account and associated personal data.
Opt out of non-essential communications.

To exercise any of these rights, contact us at thegrayapp@gmail.com.

8.2 California Residents — California Consumer Privacy Act (CCPA) / CPRA

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA):

Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purposes for collection, and the categories of third parties with whom we share it.
Right to Delete: You may request deletion of personal information we have collected from you, subject to certain exceptions.
Right to Correct: You may request correction of inaccurate personal information.
Right to Opt-Out of Sale or Sharing: We do not sell or share your personal information for cross-context behavioral advertising.
Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To submit a verifiable consumer request, contact us at thegrayapp@gmail.com. We may ask you to verify your identity before processing your request. We will respond within 45 days of receipt of a verifiable request, which period may be extended by an additional 45 days where reasonably necessary, with notice to you.

8.3 International Users — GDPR Notice

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you may have additional rights under the General Data Protection Regulation (GDPR) or equivalent legislation, including:

Right of Access (Article 15 GDPR)
Right to Rectification (Article 16 GDPR)
Right to Erasure / Right to be Forgotten (Article 17 GDPR)
Right to Restriction of Processing (Article 18 GDPR)
Right to Data Portability (Article 20 GDPR)
Right to Object (Article 21 GDPR)
Right to Lodge a Complaint with your local supervisory authority

Legal Bases for Processing: We process your personal data on the bases of contractual necessity, legitimate interests, consent (where applicable), and legal obligation, as described in Section 3.

Data Transfers: The Gray App is operated from the United States. If you are located outside the United States, your information will be transferred to and processed in the United States. We rely on appropriate safeguards (such as standard contractual clauses where applicable) for such transfers.

To exercise your GDPR rights, contact us at thegrayapp@gmail.com. If you are located in the EEA and wish to contact a local representative, please email us for current representative contact details.

9. Children's Privacy

The Service is not directed to children under the age of 14 (or under 16 in the EEA), and in no event is it directed to or intended for children under the age of 13. Consistent with the Children's Online Privacy Protection Act (COPPA), we do not knowingly collect, use, or disclose personal information from children under 13, and we do not market or advertise the Service to children under 13. If you believe we have inadvertently collected information from a child under the applicable age threshold, please contact us immediately at thegrayapp@gmail.com and we will take prompt steps to delete such information.

10. Third-Party Links and Services

The Service may contain links to third-party websites or services (including Paddle's payment portal). We are not responsible for the privacy practices of those third parties. We encourage you to review the privacy policies of any third-party services you access.

11. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy at any time. When we make material changes, we will:

Update the "Last Updated" date at the top of this policy.
Notify you via email or a prominent in-app notice at least 30 days before the changes take effect (for material changes).

Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated Privacy Policy.

12. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of the State of Arizona, United States, without regard to its conflict of law provisions.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

The Gray App
Email: thegrayapp@gmail.com