Legal
Privacy Policy
Grace exists to read a narrow slice of your email — booking confirmations — so it can warn you before a cancellation fee hits. This page explains exactly what that means in practice.
Last updated July 11, 2026. This is a draft policy pending legal review — see the maintainers before relying on it for real users.
1. Scope
Grace is a US-only, iOS-only product. This policy covers the Grace mobile app, the account and billing systems behind it, and this website. It does not cover the studios, class platforms, or payment processors you interact with directly — their own privacy policies govern those relationships.
2. What Grace processes
To do its job, Grace processes:
- Booking-related email content. Either forwarded copies of studio confirmation, reminder, and cancellation emails you send to your unique Grace address, or — if you connect your Gmail account — the contents of messages Grace identifies as booking-related, read via a restricted, read-only Google OAuth grant (the
gmail.readonlyscope). Grace does not request write access to your mailbox and cannot send email as you. - Account information. Your email address and authentication identifiers, handled by our authentication provider (WorkOS).
- Billing information. Subscription status and payment handled by Apple (in-app purchase) or Stripe (for the optional web-billing link) — Grace itself never receives or stores your card number.
- Device and notification data. A push-notification token so we can alert your device, and basic app-usage signals needed to keep the alert pipeline reliable. Delivering that alert means the notification text (which can include the studio, class, and time) passes through our push delivery subprocessor — see §5.
- Waitlist signups. If you join the pre-launch waitlist on this website, we collect the email address you submit so we can notify you when Grace is available. This is separate from, and does not require, a Grace account.
3. How Grace uses what it processes
Email content is processed to extract booking details — the studio, the class, the date and time, the cancellation window, and the late-cancellation fee. Extraction runs first against deterministic rules (patterns specific to known studio senders) and falls back to a large-language-model inference step only when needed.
That LLM step is per-user inference only. Your email content is sent to our model provider (Anthropic) solely to extract structured booking fields for your own account. It is never used to train Anthropic's models or anyone else's, and it is not retained by the model provider beyond what is needed to return the extraction result.
Grace does not read, use, or sell your email content for advertising, and does not sell your personal information to third parties.
4. What Grace stores, and for how long
| Data | Retention |
|---|---|
| Extracted structured booking fields (studio, class, times, window, fee) | Kept while your account is active, so Grace can keep alerting you and show your history. |
| Raw email content (forwarded copies or content read via OAuth) | The full message body is retained a maximum of 30 days, used only to parse bookings and debug parsing failures, then automatically purged (the underlying content is deleted, not just hidden). Grace does not keep a permanent copy of the body of your emails. |
| Email metadata (sender, recipient, subject line, message ID, a content hash, and the parse outcome) | Kept indefinitely, separate from the 30-day body purge above, for de-duplication, debugging, and abuse/fraud prevention. Subject lines can contain booking details (e.g. a studio or class name); if you delete your account, this metadata is purged along with everything else within 7 days (see §6). |
| OAuth tokens (if you connect Gmail) | Encrypted at rest; retained until you disconnect the mailbox or delete your account, whichever is first. |
| Account, subscription, and device-token records | Retained while your account is active, then deleted on account deletion (see §6). |
5. Subprocessors
Grace relies on the following subprocessors to operate. Each only receives the data it needs to perform its function:
| Subprocessor | Purpose |
|---|---|
| Postmark | Receives forwarded booking emails (the email-forwarding ingestion path). |
OAuth grant for the Gmail-connect ingestion path (read-only gmail.readonly scope). | |
| Anthropic | Per-user LLM inference for booking-detail extraction, no training on user content. |
| Vercel | Application hosting. |
| Neon | Primary database (Postgres). |
| WorkOS | Sign-in and session/authentication management. |
| Upstash (QStash) | Scheduling the timed alerts that fire before a cancellation window closes. |
| Stripe | Optional web-billing checkout and subscription management. |
| Apple | In-app purchase billing and, ultimately, delivering push notifications to your device. |
| Expo (Expo Application Services) | Relays each push notification — including the alert text, which can contain booking details — from Grace's servers to Apple's push service. |
We put a data processing agreement in place with each subprocessor that handles real user data before it does so.
6. Your rights: access and deletion
You can:
- Access the booking data Grace has extracted about you, in-app, at any time.
- Delete your account and data in-app (Settings → Delete account) or via the web deletion request below. Your account is deactivated immediately — every signed-in session is revoked and no further alerts fire — and the underlying data (extracted booking data, stored raw email and its retained metadata, and OAuth tokens) is permanently purged within 7 days, subject to what we're legally required to retain (e.g., billing records for tax purposes).
To request deletion from the web without opening the app, email privacy@trygrace.app from the address associated with your account. Depending on your state of residence, you may have additional rights under state privacy law (such as the right to know what categories of data we hold); contact the address above to exercise them, and we'll respond consistent with applicable law.
7. Security
OAuth tokens are encrypted at rest. Access to production data is limited to what's needed to operate and debug the service. No system is perfectly secure, and we can't guarantee absolute security of information transmitted to Grace.
8. Children's privacy
Grace is not directed at children and we do not knowingly collect information from anyone under 13.
9. US-only service
Grace is offered only to users in the United States in this version. Our subprocessors may process or store data in the United States as part of providing their services to us.
10. Changes to this policy
If we make a material change to how Grace handles your data, we'll update this page and adjust the "last updated" date above, and where required, notify you directly.
11. Contact
Questions about this policy or your data: privacy@trygrace.app. General support: see the Support page.