Privacy Policy

GritOS is a personal productivity system operated by Rocket Republic (“we”). This policy describes what we store, why, and what we deliberately do not do. The short version: your data exists to run your account, your documents live in your own Google Drive rather than on our servers, and we do not sell or share personal data with anyone.

What we store

• Account: your email address and a securely hashed password, managed by Supabase, our database and authentication provider.
• Your GritOS content: the identity statements, goals, habits, time blocks, tasks and daily plans you create, stored in our database and visible only to your account.
• Billing:your subscription status and Stripe customer reference. Card numbers are entered on Stripe’s own pages and never touch our servers.

Google data

If you connect Google, GritOS asks for the narrowest permissions that make the product work:

• Google Drive (drive.file): your documents are created in a GritOS folder in your own Drive, and this permission only lets us see files the app itself created. We cannot browse, read, or list the rest of your Drive. We keep no second copy of your documents.
• Google Calendar (calendar.events): used to show your events alongside your daily plan and to place time blocks you schedule. Event titles and times you sync are stored as planner rows in your account; we do not read calendars you have not connected.
• Email address (userinfo.email): shown in Settings so you can see which Google account is connected.

GritOS’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google data is used only to provide the features above — never for advertising, never sold, never used to train models. You can disconnect Google in Settings at any time, and revoke GritOS entirely at myaccount.google.com. Your documents remain in your Drive either way — they are yours.

Who processes data on our behalf

• Supabase — database and authentication (data encrypted at rest).
• Stripe — payments and subscription management.
• Vercel — application hosting.
• Resend — transactional email (sign-in links, confirmations). No marketing email is sent from this system.

What we deliberately don’t do

• No selling or sharing of personal data.
• No advertising and no ad-tech trackers.
• No third-party analytics scripts in the app.
• No training of AI models on your content.

Access inside the product

Support staff (currently, the founder) can view account-level summaries — subscription status, usage counts, block names — through an audited admin tool. Every such view is written to an audit log. Admin tooling has no ability to act as you.

Retention and deletion

Your data is kept while your account exists. Deleting your account removes your data from our database immediately and permanently (rows are deleted, not flagged). Documents in your Google Drive are untouched by account deletion — they belong to you. To delete your account, email josh@rocketrepublic.com from your account address.

Changes

If this policy changes in a way that matters, we’ll email the address on your account before the change takes effect.

Contact

Questions: josh@rocketrepublic.com.