Privacy Policy

1. What we collect

• Account info: your name and email address, and a securely hashed password (we never see or store your password in plain text).
• Financial records you enter: hustle names, income and expense entries, categories, budgets, invoice details (including customer names/contact info you choose to enter), and any payment details you add to be shown on invoices.
• Wallet and billing records: top-up and subscription transaction history. We do not collect or store your card number. That's handled entirely by Flutterwave, our payment processor.
• Push notification subscription: if you opt in, a device endpoint/key used only to deliver notifications to that device.
• Bank alerts (only if you set it up): see "Bank alert catcher" below.
• The Sit-down (Pro): your answers in the monthly check-in, the actions you choose and any notes you write. It runs entirely inside Gripd; nothing is sent to an outside service. You can delete any sit-down, or all of them, in the app.
• Receipts and statements you choose to scan (Pro): the image or file you upload to be read into entries. See "Who we share it with" below.
• How you use the app: simple events, such as finishing setup or opening a feature, so we can see what helps people and what doesn't. They are linked to your account and never sold or used for advertising.
• Basic technical data: standard server logs (IP address, browser type, timestamps) generated by our hosting provider, and error reports if something breaks, so we can fix it.

2. How we use it

• To provide the core service: storing and showing your records back to you.
• To calculate reports, budget progress, and rule-based insights from your own data.
• To process wallet top-ups and subscription billing through Flutterwave.
• To send notifications you've opted into (reminders, wallet/renewal alerts).
• To respond to support requests.
• To detect, investigate, and fix bugs or abuse.

We do not sell your data, and we do not use it for third-party advertising.

Bank alert catcher

The Gripd Android app has an optional feature that notices bank debit and credit alerts on your phone and offers to log them for you. It is off until you turn it on, and Android asks for your permission ("notification access") before it can work.

• What it reads: notifications on your phone that look like bank alerts (an amount in naira with debit or credit wording), from bank apps and SMS. Chat and social apps are ignored.
• What it keeps: only the amount and whether money came in or went out. It never keeps names, account numbers, balances, or the text of the alert. This happens on your phone.
• What reaches Gripd: nothing, unless you tap the "log it" prompt. Then only the amount and in/out are passed to the app, and an entry is saved only when you confirm it.
• Turning it off: switch it off any time in the app (Settings, Bank alerts), or remove Gripd's notification access in your phone's settings.

On iPhone, you can set this up yourself with Apple's Shortcuts app (see our iPhone guide). When a bank alert arrives, your shortcut sends its text to Gripd using a personal key only your shortcut has. Gripd reads two things from it, the amount and whether money came in or went out, then discards the text straight away: it is never saved, logged or shown to anyone. Gripd then sends you a notification offering to log it, and an entry is saved only when you confirm it. To stop, switch off the automation in Shortcuts, or turn off the iPhone bank alerts in Gripd's Settings, which stops your key working at once.

Home-screen widget (Android app)

The Android app can show a widget on your home screen with this month's income, what's left after spending, and your streak. Amounts are hidden until you tap to show them.

• How it gets your numbers: when you add the widget, Gripd creates a private widget key and saves it on your phone. The key can only read those widget numbers. It can't see your entries or change anything.
• What we store: a scrambled copy of the key and when it was last used, so we can show it in Settings.
• Turning it off: disconnect it in Settings (Home-screen widget). The widget stops showing your numbers straight away.

3. Who we share it with

We share data only with the service providers that make Gripd work:

• Supabase: hosts our database and handles authentication.
• Vercel: hosts and serves the app.
• Flutterwave: processes wallet top-up payments and handles your card details directly; we never receive or store them.
• Resend: sends Gripd's emails, such as sign-up confirmation, password resets and invoices you choose to email to a customer.
• Google: if you choose "Continue with Google", Google confirms who you are and shares your name and email with us. When you scan a receipt or import a bank statement (Pro), the file you choose is sent to Google's Gemini service to read the amounts and dates, and nothing else from your account goes with it.
• Push notification services run by your browser or phone maker (for example Apple or Google): they deliver the notifications you've turned on.

We don't share your data with anyone else unless required by law or with your explicit consent.

Where your data is stored

Your account and records are stored in a database hosted by Supabase in the European Union (Ireland). The app is served by Vercel, which may process requests on servers in other countries, including the United States, and some of the providers above are based outside Nigeria, the UK and the EU. When your data is handled outside the country you live in, we rely on our providers' data protection terms, including standard contractual clauses where they apply, so it stays protected to the standard the NDPA and GDPR require.

Why we're allowed to use it

Data protection law asks us to have a lawful reason for each use of your data. Ours are:

• To provide the service you signed up for (performing our contract with you): your account, records, invoices, reports, the Sit-down and billing.
• Your consent: push notifications, bank alert catching, and keeping words the Sit-down couldn't understand ("Help improve The Sit-down"). You can withdraw consent any time in Settings, and that doesn't affect anything done before.
• Our legitimate interests: keeping Gripd secure, preventing abuse, fixing errors, and understanding which features help people, in ways you'd reasonably expect and that don't override your rights.
• Legal obligations: keeping billing records for tax and accounting.

Gripd's insights and Sit-down suggestions are worked out from your own numbers by fixed rules. They are suggestions only, and we don't make any automated decisions about you that have legal or similarly significant effects.

4. How we protect it

Data is encrypted in transit. Your records are protected by database-level access rules (row-level security) that restrict them to your own account and anyone you personally invite to a shared hustle. Even our own systems access your financial data only through code paths scoped to you, except for the specific server-side processes needed to process billing (top-ups, subscription renewals) and to keep the service running.

5. Data retention

We keep your data for as long as your account is active. If you request account deletion, we delete your personal records within a reasonable time, except where we're required to retain certain billing records for legal or accounting purposes.

6. Your rights

Wherever you live, you can ask us to:

• give you a copy of your data (on Pro you can also export your records as CSV from Reports yourself);
• correct data that's wrong;
• delete your data;
• restrict or stop a particular use of it, or object to a use based on our legitimate interests;
• send your data to you, or to another service, in a common format.

You can access, correct, or delete most of your data directly in the app (Settings, individual records). See how to delete your account and data for the full self-service process. For anything else, email us (see Contact). We reply within one month, and won't charge you unless a request is clearly excessive.

If you're unhappy with how we've handled your data, please tell us first so we can put it right. You can also complain to a data protection authority: the Nigeria Data Protection Commission (ndpc.gov.ng), the Information Commissioner's Office in the UK (ico.org.uk), or the data protection authority in your EU country.

7. Cookies

Gripd uses only the cookies necessary to keep you signed in. We don't use third-party advertising or tracking cookies.

8. Children

Gripd isn't intended for anyone under 18, and we don't knowingly collect data from minors.

9. Changes to this policy

If we make material changes to this policy, we'll update the effective date above and let you know in the app.

10. Contact

Questions about this policy or your data? Reach us at support@gripd.ng.