Privacy Policy
GROW is a habit app for small groups of friends: you set habits, post a photo when you do them, and your group sees it. This policy covers the GROW iPhone app and the GROW web app, and explains what we collect, why, who handles it for us, and how to delete it.
The short version. We collect what the app needs to work: your account, your habits, the check-in photos you post and your groups' activity. Your check-ins are shared only with the groups you post them to. We don't sell your data, show ads, use analytics or tracking tools, or track you across other apps and websites. You can delete your account and its data in the app at any time.
What we collect
| Data | What it is | Why |
|---|---|---|
| Account | Your name, email address and password. We store only a one-way hash of your password (bcrypt), never the password itself. Also your sign-up date, your personal invite code and, if you joined through a friend's invite, who invited you. | To create your account, sign you in and show your name to your groups. |
| Profile photo | Optional. Stored with Cloudinary. | Shown next to your name in your groups. |
| Habits | Each habit's name and how often you aim to do it, which groups it's shared with, and any break you take. In the web app you can also set a practice stake and pick a charity; no money is charged or donated. | To track your progress and streaks and show them to the groups you share them with. |
| Check-in photos | The photos you post as proof, with the time, the habit and the groups you posted them to. Photos are uploaded to and stored with Cloudinary. | The core of the app: your group sees them and confirms them. |
| Group activity | Groups you create or join (name, photo, category, invite code, who owns it), when you last opened each group, the check-ins you confirm (“validations”) or skip, chat messages, and automatic notes such as “taking a break”. | To run your groups, show who has confirmed what, and mark what's new. |
| Safety | Reports you make (the check-in and your reason) and the people you block. | To review reports and remove content and accounts that break our Terms, and to hide people you block. |
| Notifications | If you allow notifications, your device's push token (an identifier from Expo and Apple that lets us send pushes to your device) and your notification settings. | To tell you when a friend checks in, confirms your check-in or nudges you, and in the evening when friends haven't checked in yet. |
| Time zone | The web app sends your browser's time zone. Otherwise we use UTC. | So “today”, weeks and streaks follow your local day. |
| Request logs | Our hosting providers keep standard logs of requests to our servers, which include your IP address and the time. | To keep the service running and secure, and to fix problems. |
Kept only on your device
The app stores your sign-in token securely on your phone, along with a few settings that never leave it: your daily habit reminders (scheduled as local notifications), when you last nudged each friend, and whether you've seen the tutorial. The camera and photo library are used only when you choose to take or pick a photo, and only the photo you post is uploaded.
What we don't collect
No location, contacts, health data, advertising identifiers or payment details. GROW has no ads and no analytics or tracking SDKs, and we don't sell or share your data for advertising.
Who can see your data
- Your groups. Members of a group see your name and profile photo, the habits you share with that group and your progress on them, the check-ins you post there, your confirmations and your messages. People outside the group don't.
- Your invite link. If you share your personal invite link, whoever opens it sees your name and profile photo.
- Photo links. Photos are served from Cloudinary at long, unguessable web addresses. The app only shows them to the right people, but anyone who is given a photo's address can open it.
- Our team, only to run the service, review reports and answer your requests.
- Authorities, if the law requires it or to protect someone's safety.
Who processes it for us
These companies handle data on our behalf, only to provide their service to us:
- Railway hosts our servers and database, where everything above (except the photo files) is stored.
- Cloudinary stores and delivers check-in photos, profile photos and group photos.
- Expo delivers push notifications to your device through Apple's push service, and delivers app updates.
- Vercel hosts the GROW website and web app.
They may process data in the United States and other countries.
How long we keep it
- Your account and content stay until you delete them or your account.
- Deleting a habit deletes its check-ins. Leaving a group removes you from it, but the check-ins and messages you posted there stay for its members until you delete that habit or your account.
- Reports stay until we've dealt with them; if we remove the content or the account, the report goes with it.
- Request logs are kept by our hosting providers for a short period.
- Copies can remain in database backups until they are overwritten in the normal backup cycle.
Deleting your account
In the app, go to Settings → Delete account. It takes effect immediately and can't be undone. It permanently deletes:
- your account: name, email, password hash, profile photo and time zone;
- your habits, with their breaks and stakes;
- every check-in you posted, in every group, with the confirmations and reports on them;
- the confirmations, reports and blocks you made;
- your group memberships and your chat messages;
- your push tokens and notification settings.
Groups where you were the only member are deleted. Groups you owned pass to the member who has been in them longest, and they keep their name and photo. Your check-in photos and profile photo are then deleted from Cloudinary. If you invited friends, their accounts stay; they're just no longer linked to you.
You can also email support@growwithfriends.com from the address on your account and we'll delete it for you.
Your rights
You can change your name and profile photo in the app. Depending on where you live, you may also have the right to get a copy of your data, correct it, delete it, or object to how we use it. Email support@growwithfriends.com and we'll respond within 30 days. You can also complain to your local data protection authority.
Where the law asks for a legal basis: we use your data to provide the service you signed up for, for our legitimate interest in keeping GROW safe and secure, and with your consent for push notifications, the camera and your photo library (which you can withdraw at any time in iOS Settings).
Security
Passwords are stored only as bcrypt hashes, connections to our servers are encrypted (HTTPS), sign-ins are rate-limited, and each request is checked against your group memberships. No system is perfectly secure; if something goes wrong that affects your data, we'll tell you.
Children
GROW is not for children under 13, and you must be at least 13, or the minimum age in your country if that's higher, to use it. We don't knowingly collect data from children under 13. If you think a child has given us their data, email support@growwithfriends.com and we'll delete it.
Changes
When we change this policy we'll update it here and change the date at the top. If a change significantly affects how we use your data, we'll also tell you in the app before it applies.
Contact
Questions or requests: support@growwithfriends.com. See also our Terms of Use and Support.