Privacy Policy

Last updated: 15 November 2026

Gratitude Tree (the "Service", at https://gratitudetree.app) helps you remember the people who shaped you and the people you grew alongside, and send them a note of thanks. It is run by Gratitude Tree, based in India ("we", "us"). This policy explains what personal data we handle, why, and the choices you have.

1. Who is responsible

For data we receive through the Service, we are the "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the "controller" under the EU and UK General Data Protection Regulation (GDPR). Contact: privacy@gratitudetrees.com.

2. What we collect, and when

a. Kept only on your device

The people you add, the notes you write, your tree's style and your preferences are saved in your browser's local storage. We don't receive them unless you do one of the things below. Clearing your browser data removes them.

b. When you send a thank-you link

We store: your first name as the sender; the first name of the person you're thanking; your note (up to 160 characters); whether they shaped you or grew with you; a snapshot of the people on your tree that you choose to show, with their relationships and notes; a preview picture of your tree that your phone draws; and whether the link has been opened and whether the person added you back.

c. When you create an account

We store your name, your email address, and the trees you sync between your devices. Sign-in codes and sign-in sessions are stored only as one-way hashes, so they can't be read back.

d. Anonymous counts

We keep daily totals (pages opened, trees started, thank-yous sent, people who joined). These contain no names, account IDs or IP addresses.

e. Technical data

Our hosting provider receives your IP address and basic device information to deliver pages and block abuse. We use IP addresses briefly, in memory, to limit repeated requests, and we don't store them. The page's fonts load from Google Fonts, so Google also receives your IP address when the page loads.

3. Data about other people

Your tree and notes are about real people. Please add only what you'd be comfortable with them reading, and don't include sensitive details such as phone numbers, addresses, health, religion or finances. If someone on a tree asks us to remove information about them, we'll remove it from any link stored on our servers.

4. Why we use it, and our legal basis

• To provide the Service (create and deliver links, sign you in, sync your trees): with your consent under the DPDP Act, and as necessary to perform our agreement with you under the GDPR.
• To keep the Service safe (rate limits and preventing misuse): legitimate uses permitted by law, and legitimate interests under the GDPR.
• To understand overall use through anonymous counts, which aren't personal data.

We don't use your data for advertising, profiling or automated decisions, and we don't sell or "share" it as defined by California law.

5. Who receives it

• The people you choose: whoever opens a link you send or a tree you share sees what it contains.
• Service providers that process data for us: Cloudflare, Inc. (hosting, database and delivery), Resend (sending sign-in emails) and Google (fonts). They may only use it to provide their services to us.
• Authorities, when Indian law or a valid legal order requires it.

6. Where it is processed

Our providers run servers in many countries, including outside India (for example, in the United States). The DPDP Act allows such transfers unless the Government of India restricts a country. For visitors from the EU or UK, our providers use the European Commission's Standard Contractual Clauses or equivalent safeguards.

7. How long we keep it

• Thank-you links and their preview pictures: 400 days after they were last changed, or until you withdraw them.
• Sign-in codes: 15 minutes. We keep a count of codes sent for one hour, to prevent abuse.
• Sign-in sessions: 90 days, or until you log out.
• Your account and synced trees: until you delete your account.
• Anonymous counts: 120 days.

Where Indian law requires certain records or logs to be kept for a minimum period (for example, under the DPDP Rules, 2025), we keep only those records, only for that period.

8. Cookies and local storage

We use one cookie, gt_sess, and only after you sign in. It keeps you signed in, is strictly necessary, and can't be read by scripts on the page. Your trees and settings are kept in your browser's local storage. We use no analytics, advertising or tracking cookies.

9. Your rights

Depending on where you live, you can:

• access a summary of your personal data and how it's used;
• correct or update it (you can edit your name in your account);
• erase it: delete your account from the account panel, or withdraw any link from that person's panel;
• withdraw consent at any time, which won't affect what was done before;
• nominate someone to exercise your rights if you die or become incapacitated (India);
• receive your data in a portable form, restrict or object to processing, and complain to your data protection authority (EU and UK);
• know, delete and correct your data, without discrimination for asking (California).

To make a request, email privacy@gratitudetrees.com. We may need to confirm it's you. We reply within 30 days. If you're not satisfied, you can complain to the Data Protection Board of India, or to the supervisory authority where you live.

10. Age

The Service is for people aged 18 and over. We don't knowingly collect data from anyone under 18. If you believe a child has used the Service, email us and we'll delete their data.

11. Security

All connections use HTTPS. Codes and sessions are stored as hashes, sign-in codes expire quickly and allow limited tries, and access to stored data is restricted. No system is perfectly secure. If a breach affects your personal data, we'll tell you and the relevant authorities as the law requires.

12. Grievance Officer

As required by the Information Technology Act, 2000, its Rules, and the DPDP Act:

Grievance Officer: Gratitude Tree
Email: privacy@gratitudetrees.com
We acknowledge complaints within 24 hours and aim to resolve them within 15 days.

13. Changes

If we change this policy, we'll update the date at the top. For significant changes, we'll also show a notice in the Service before they take effect.