Privacy Policy

Growy is a trading name of GRIBOV LLC, 8 The Green, Suite A, Dover, DE 19901, United States, which is the data controller for the information described here. For any privacy question or request, email hello@growy.io — a person reads it and replies. If you are in the EU or UK and are not satisfied with our answer, you also have the right to complain to your local data protection authority.

Your email address (for authentication), your Instagram handle and public post data (collected via Apify, with RocketAPI as a fallback), the content you create within Growy (drafts, schedules, chat history, uploaded photos, video and voice notes), and basic product-usage events, including session replay of your in-app activity (which screens you open, what you type and generate) used to understand and improve the service — replay masks your password and email fields but not other typed text. Payments are handled by Stripe: we never see or store your card number — only your subscription status and the identifiers Stripe returns to us.

We process your data to perform our contract with you (providing the coaching service you signed up for), on the basis of our legitimate interest (keeping the product secure, understanding how it is used, and measuring our advertising), and with your consent where the law requires it — in particular for optional messenger connections and for advertising cookies. Where we rely on consent you can withdraw it at any time, and where we rely on legitimate interest you have the right to object.

To provide the coaching service: analyzing your content, generating drafts, and delivering insights. We use large language models for AI features — primarily Claude (Anthropic), and additionally models served through Vercel's AI Gateway (routed to US-based hosting providers). Your data is sent to these providers' APIs under their data processing terms and is not used to train their models.

Supabase (database + auth), Vercel (hosting + AI Gateway), Anthropic (AI), additional AI model providers accessed via Vercel AI Gateway and routed to US-based hosts, fal.ai (AI image, video and audio generation, and transcription), Apify and RocketAPI (Instagram data — RocketAPI is a fallback we use if Apify is unavailable), Modal (server-side audio and video processing, including transcription), Cloudflare (CDN, workers, and file storage), Stripe (payments and subscription billing), Resend (account and product emails), PostHog (product analytics, including the session replay described above), LoopMessage (delivers your coach’s replies if you connect iMessage or WhatsApp — see Messaging channels below), and Meta (advertising measurement — see Cookies and advertising below). Each processes data only as needed to deliver the service, under a data processing agreement.

We set a small number of cookies. Strictly necessary ones keep you signed in and remember which pricing variant you were shown — without them the paywall could quote a different trial length than checkout charges, so these are always on and cannot be switched off. Separately, if you arrive from one of our ads, the Meta Pixel tells Meta that a visit or signup happened so we can measure whether our advertising works; this means Meta receives your IP address, browser information, and the fact that you visited or subscribed, and may match that to an existing Facebook or Instagram account. In the EEA, the UK and Switzerland the Pixel and ad-attribution cookies are loaded ONLY after you accept them — declining is offered just as prominently, costs you nothing, and you can change your mind at any time via "Cookie settings" in the footer. Elsewhere they run by default, and you can still opt out through your browser settings, an ad blocker, or your Meta ad preferences.

Growy runs on US-based infrastructure, so if you are outside the United States your data is transferred there. For transfers out of the EEA and the UK we rely on the European Commission’s Standard Contractual Clauses (with the UK Addendum where applicable), or on our providers’ certification under the EU–US Data Privacy Framework.

You can optionally connect a messenger (Slack, WhatsApp, or iMessage) to chat with your Growy coach there. When connected, we process the messages, photos, voice notes, and files you send the coach — exactly as we would in the web app — to generate your replies and content, and store the conversation with your account so the coach has context. You can disconnect any channel at any time from Settings. Connecting Slack uses OAuth: we store only the bot token needed to reply in your workspace, and only read direct messages you send our bot — never other channels or conversations.

Your data is retained as long as your account is active. When you delete your account we cancel your subscription and erase your personal data — chats, uploads and generated files, drafts, Instagram data, session recordings and account details — within 30 days. Backups are the one exception we cannot delete on demand: copies may persist in encrypted backups until that cycle is overwritten (within 35 days), during which they are put beyond use and are never restored into the live product. Two things outlive deletion permanently: records we are legally required to keep (invoices and payment records, for tax and accounting purposes), and anonymous aggregated statistics, such as the fact that someone who joined in a given month used the product on three days and then cancelled. Those statistics carry no name, email, handle or account id, and cannot be traced back to you.

You can access and export your data (Settings → Export my data, which returns a JSON file of everything tied to your account), correct inaccuracies, or delete your account at any time from Settings. You also have the right to object to processing based on legitimate interest, to withdraw consent, to ask us to restrict processing, and to receive your data in a portable format. For any of these, or for GDPR and CCPA requests, email hello@growy.io. We do not sell personal information, and we do not share it for cross-context behavioural advertising beyond the advertising measurement described above.

Growy is not intended for anyone under 16, and we do not knowingly collect data from children. If you believe a child has given us personal data, email hello@growy.io and we will delete it.

All data is encrypted in transit (TLS) and at rest. We use row-level security in Supabase and never store raw passwords (magic-link auth only).

If we make a material change we will update the date below, and where the change meaningfully affects your rights we will tell you by email before it takes effect.