Grief-data ethics · v1, July 2026
How we treat grief data
Grief is not a market segment. What you carry here - your words, your dates, your people - is the most sensitive thing anyone could hand us. These are the promises we make about it, in writing, so you can hold us to them.
No ads, ever
Nothing here is funded by attention. There are no ads, no sponsored anything, and no tracking built to follow you around the internet. The app is paid for by membership and by the trips - by people, not by data.
Your grief is never sold - or used against you
We will never sell, rent, or trade what you write or who you've lost. We will never use your loss to target you with anything. No AI is trained on your writing. The details of your grief exist here for one purpose: so this place can hold them with you.
No machinery designed to pull you back
No streaks, no scores, no engagement metrics, no algorithmic feed. Coming back is the whole thing - and it has to be your choice, not a mechanic's. The absence of these things is not an oversight; it is the design.
Tender dates are sensitive, full stop
The anniversaries and birthdays you record are treated as the most sensitive data in the system. They are used only to be gentle - the quiet heads-up you asked for, a softer app on a hard day - and never as triggers for marketing, campaigns, or anything commercial. Your Circle is told a date is near only when you ticked that box, and you can untick it any time.
Your journal is yours; the prompt is the Circle's
Anything you write in your journal is yours alone unless you deliberately share it. The daily prompt is the one place that starts shared: it is a question your Circle answers together, so an answer goes to your Circle unless you choose "Keep private" before you save. Either way it is per entry, revocable from your journal at any time, with the rules enforced in the database itself. The mechanics live on the privacy page; the principle lives here: you always know who can see a thing before you write it, and you can always take it back.
No griefbots. Not ever.
We will never build, host, or integrate a synthetic voice, chatbot, or simulation of the person you lost. This place exists for connection with the living and with memory - not synthetic resurrection. This is a permanent line, not a current policy.
Leaving is honored
Deleting your account deletes your data - entries, dates, people, letters - and, if you choose, everything this app kept on the device you delete from: the on-device journal, the tools' kept things, your unlock phrase. The controls are in your account, they work, and nobody will guilt you on the way out. The same goes for a buddy: ending a pairing is two taps, no reason asked, and the other person is told only that it ended.
Sealed on your device
Private journal entries are encrypted on your device before they're stored - even we cannot read them. The key lives with you as an unlock phrase (in your account), which also means we can never recover it for you - keep a copy safe. Sharing an entry with your Circle is the one deliberate exception: the room reads the words you chose to give it, and making it private again seals it again on the device that holds your phrase. On a new phone that does not have your phrase yet, the words stay readable until you enter it there; the app tells you so at the time. The seal covers the words; a photo kept with a sealed entry is stored as a photo, and stays out of sight wherever the words are sealed.
If anything here ever stops being true, that is a betrayal of what this place is for - and you should call us on it: info@grieftrips.com.