Security at Gracely
Your money information is personal. Here's how we keep it safe — and how much of it never leaves your device in the first place.
01 — Security by design, not as an afterthought
Gracely is built to need as little of your information as possible. You can use the full app offline, with no account at all — in that case your budget data simply stays on your device. When you choose to sign in and sync, we protect that data with strong, industry-standard safeguards and trusted infrastructure. We don't show ads, and we never sell your data.
02 — Built on trusted, audited infrastructure
We don't reinvent security from scratch — we build on providers that are independently audited and specialize in keeping data safe.
Supabase (our backend). Your synced data lives in a database hosted on Supabase, which is SOC 2 Type 2 compliant and independently audited every year against the industry's Trust Services Criteria for security, availability, processing integrity, confidentiality, and privacy. Your data is encrypted in transit and at rest.
Stripe (bank connections). If you choose to link a bank, the connection is handled by Stripe, a global payments-technology company certified to PCI DSS Level 1 — the most rigorous level of payment-data security. See Stripe's security overview.
Apple (sign-in). Accounts use Sign in with Apple, so your sign-in is protected by your Apple ID and its two-factor authentication.
03 — How your data is protected
Encrypted in transit and at rest. Data moving between your device and our backend is protected with TLS, and stored data is encrypted at rest.
Your data is isolated. Access is enforced at the database level with row-level security, scoped to your own household. One account can't reach another's data.
No passwords for us to lose. We use Sign in with Apple, so Gracely never creates, sees, or stores a password for you.
Your assistant runs on your device. Gracely's assistant uses Apple's on-device intelligence — your questions are processed on your iPhone and aren't sent to our servers.
Stored in the United States. Account and financial data is hosted in the US.
Least data by default. No account is required to use Gracely, and we only collect what's needed to make the features you use work.
04 — Bank connections are read-only
Linking a bank is optional and currently available for US accounts only. When you connect one:
Handled securely by Stripe. Gracely never sees your bank username or password.
Read-only. We can import information like transactions and balances to help you categorize spending. Gracely cannot move money or make payments — ever.
Disconnect anytime. You can disconnect a linked account at any time in the app.
05 — You're in control
Use Gracely without an account — fully offline, data on your device.
Disconnect any linked bank whenever you want.
Delete your data by removing the app, or request deletion of account-synced data anytime.
See our Privacy Policy for the full detail on what we collect and how it's handled.
06 — Reporting a security concern
We take security seriously and welcome responsible disclosure. If you believe you've found a vulnerability or have a security concern, please email security@meetgracely.com. We'll investigate every report and ask that you give us a reasonable chance to address an issue before sharing it publicly.
07 — An honest note
No app or service can promise that data is 100% secure — anyone who tells you otherwise isn't being straight with you. What we can promise is that we follow current best practices, build on audited infrastructure, keep as little of your data as possible, and keep improving. You can help by keeping your device protected with a passcode or Face ID / Touch ID.