Gruab is a private gifting app: one person (the giver) prepares presents for people they love, and each of those people (recipients) finds them in a small game. We collect only what makes that work, we never sell it, and you can ask us to delete it at any time.
Who we are
Gruab is operated by its maker as a personal, independent project (“Gruab”, “we”, “us”). It is offered at gruab.party and as the Gruab mobile app. Questions about this policy go to hello@gruab.party.
What we collect
Account data. Your email address and a display name. If you sign in with Google, Google shares your email, name and profile picture with us; we store the email and name and do not use the picture.
Profile settings. Your theme (light or dark), the avatar routine you pick, and the interest tags a giver adds for you.
Gift data. Everything a giver enters about a present: its name, a personal note, an optional picture, a redeem code, date options, and where it sits in the game. For recipients we also record when a present was found and which date was chosen.
Avatar and game configuration. The colours of your avatar, the scene template, and any brand images a giver uploads for the game’s billboard.
Technical data. The session cookie that keeps you signed in on the web portal, and standard server logs (IP address, browser, time of request) kept by our hosting provider for security and debugging.
We do not run advertising, analytics trackers or third-party pixels, and we do not collect precise location, contacts or payment details.
Why we use it
- To create and secure your account and keep you signed in.
- To show a giver’s presents to the right recipient, and only to them.
- To let a recipient schedule a date or show a redeem code, and to tell the giver it happened.
- To send the emails the service needs: sign-in confirmations, invites and password resets. Nothing promotional.
Our legal basis is performing the service you asked for, and our legitimate interest in keeping it secure.
Who can see what
A recipient sees only their own presents and profile. A giver sees the people they invited, the presents they made for them, and whether those presents were found or scheduled. Nobody else sees either. These rules are enforced by the database itself (row-level security), not just by the apps.
Where it lives and who helps us
- Supabase hosts our database, authentication and file storage (servers in the United States, AWS us-east-1).
- Vercel serves the web portal and these pages.
- Google provides sign-in with Google, under Google’s own privacy policy.
- Apple and Expo are involved in delivering the mobile app to your phone.
These providers process data only to run their part of the service. Pictures uploaded for presents and billboard brand images are stored in public storage buckets, reachable by anyone who has their direct link; do not upload anything sensitive as a present picture.
How long we keep it
Your data stays for as long as your account exists. Presents stay until the giver removes them or the account is deleted. Server logs are kept by our hosting providers for a short, rolling period (typically under 30 days).
Your choices
- Access or correction: your name, theme and routine are editable in the app; a giver can edit the rest for the people they invited.
- Deletion: email hello@gruab.party from the address on the account and we will delete the account and its data within 30 days. If a giver deletes a person, that person’s presents go with them.
- Google: you can revoke Gruab’s access at any time from your Google account’s third-party access settings.
Depending on where you live you may have further rights under laws such as the GDPR or similar; write to us and we will honour them.
Children
Gruab is meant for adults gifting adults. We do not knowingly create accounts for children under 16; if you believe one exists, tell us and we will remove it.
Changes
If this policy changes in a way that matters, we will show the new date here and, for significant changes, tell you in the app or by email.