Your data never leaves your phone.

Gray is built and operated by L Squared (مؤسسة لام تربيع), an independent studio based in Riyadh, Saudi Arabia. Gray stores everything — your check-ins, locked messages, diary entries, time capsules, and settings — locally on your device using Apple's SwiftData framework. There is no user account, no server, and no network code anywhere in the app. We, L Squared, never receive, see, or store any of your Gray data, because there is no channel for it to reach us.

Everything below lives only in local storage on your device, inside the app's sandbox:

• Check-ins — the emotion and intensity you log, and any optional DBT detail.
• Locker messages — messages you write and lock away, encrypted (see Section 3).
• Diary & daily logs — sleep, medication, and morning/evening reflections you choose to record.
• Gray Area entries — Gray Slider reframes, Splitting First-Aid notes, Evidence Vault text and photos, and Catastrophe De-escalator sessions.
• Time Capsules — text or voice notes you record for your future self.
• Who I Am anchors — the identity-anchor entries you write across five categories.
• Profile & preferences — your name, language, appearance, gendered-wording preference, and your one optional trusted contact (name and phone number, chosen via Apple's contact picker).

None of this is uploaded, synced, backed up to iCloud, or shared with L Squared or anyone else. It exists only in the app's local database and in iOS Keychain entries marked This Device Only.

• Locker message bodies are encrypted with AES-GCM before they touch disk.
• The encryption key, and your optional app passcode (stored as a salted hash, never in plain text), live only in the iOS Keychain, marked ThisDeviceOnly — they are never included in backups and never leave the device.
• The entire local database is explicitly excluded from iCloud and iTunes/Finder backups.
• App Lock (Face ID / Touch ID, or your app passcode) re-engages automatically every time Gray leaves the foreground.

Gray only ever requests a system permission when a feature genuinely needs it, and shows its own plain-language explanation first. The full breakdown, including live mock-ups, is on the Support page. In summary:

• Face ID / Touch ID — used only to unlock the app itself, if you turn on App Lock. Handled entirely on-device by Apple's LocalAuthentication framework; Gray never sees your biometric data.
• Microphone — used only when you choose to record a voice Time Capsule. The audio is saved locally and never transmitted anywhere.
• Contacts — Gray never requests address-book access. Picking a trusted contact opens Apple's system contact picker, which runs outside the app and returns only the one contact you select.
• Photo Library — Gray never requests full photo-library access. Adding a photo to Evidence Vault uses Apple's Photos picker, which returns only the exact image you choose.
• Notifications — not used. Gray does not currently send notifications of any kind.

Gray contains no analytics SDKs, no advertising, no crash-reporting network calls, and no third-party libraries that phone home. We have no way to know how many people use Gray, what they type into it, or how they use it — by design, not by policy.

Because everything lives on your device, you already hold every right a privacy law would normally ask us to grant you:

• Access & export — Diary and Settings can generate a PDF of your check-in history at any time, for yourself or to share with a clinician.
• Deletion — Settings → Your data → Delete Everything permanently erases every model and preference immediately. There is no server copy to also delete, because none exists.
• Portability — uninstalling the app removes its local database entirely.

Gray discusses emotionally intense experiences, including brief references to crisis and self-harm coping skills, and is intended for teens and adults, not young children. Gray is not directed at children under 13, and we do not knowingly collect any information from anyone — of any age — since the app collects nothing at all.

L Squared is based in Riyadh, Saudi Arabia, and this policy is written with Saudi Arabia's Personal Data Protection Law (PDPL) in mind, alongside general good practice for users anywhere Gray is used. Because Gray processes data exclusively on-device, most cross-border data-transfer concerns simply don't apply — your data never crosses any border, on any server, at any time.

If Gray's data practices ever change — for example, if a future version adds an optional feature that requires new permissions — this page will be updated first, with a new "last updated" date above, before that feature ships.

Questions about this policy or how Gray handles data can be sent to contact@lsquared.sa, or via the Support page.