Privacy Policy

1. Information We Collect

We collect information directly from you, automatically from your use of the service, from connected third-party platforms you choose to link, and from service providers that help us operate Growy.

• Account and profile information, including your full name, email address, encrypted authentication session data handled through Supabase, and profile settings you update later.
• Signup legal-assent records, including the current Privacy Policy version, Terms of Use version, and timestamps captured when you create an account.
• Page and workspace information, including page name, handle, niche, biography, profile image, and other page-management fields you create or sync into Growy.
• Content machine and AI configuration data, including audience descriptions, target audience labels, brand footer text, style instructions, reference notes, reference URLs, competitor URLs, CTA variants, learning and strategy metadata, posting preferences, and generation schedules.
• User content and generated content, including prompts, topics, captions, hashtags, tweet text, slide data, uploaded images, uploaded videos, generated cover images, generated reels, rendered thread slides, and other draft or published post materials stored in the app.
• Connected Instagram account data when you connect a page, including Instagram account ID, username, account type, biography, profile picture, OAuth scopes, encrypted access token, token expiry and refresh timestamps, connection status, media container IDs, post IDs, and permalinks.
• Instagram analytics and audience data pulled from Meta on your behalf, including followers totals and gains, reach, views or impressions, profile visits, website clicks, likes, comments, saves, shares, audience demographic buckets, top cities, top countries, and raw API payload snapshots kept for analytics integrity and debugging.
• Billing and subscription data, including plan selection, subscription status, billing interval, trial information, usage quotas, usage counts, provider IDs, external customer IDs, checkout-session IDs, payment-method summaries such as brand, last four digits, and expiration details when made available by the billing provider.
• Support and bug-report information, including your message, current route, selected page scope, related page ID when relevant, user agent, and support metadata submitted from the in-app bug-report flow.
• Security and anti-abuse data, including request IP address values derived from request headers, rate-limit keys, auth event outcomes, and operational errors needed to protect the service.
• Device and browser storage signals, including Supabase auth cookies and limited local or session storage entries used for billing-state caching, analytics refresh timing, and similar in-app session behavior.

2. How We Use Information

We use personal information to provide, secure, maintain, and improve Growy, and to deliver the specific features you request.

• To create and manage user accounts, authenticate sessions, and let you update or delete your profile.
• To create and manage pages, content machines, schedules, drafts, publishing jobs, and review queues.
• To generate AI-assisted content, image prompts, audience refinements, carousel concepts, thread drafts, and related outputs you request.
• To store uploads and generated media so drafts, edits, previews, scheduling, and publishing workflows function correctly.
• To connect to Instagram, refresh account metadata, publish content at your direction, and pull analytics and audience insights back into Growy.
• To calculate plan entitlements, enforce quotas, create checkout sessions, process subscription lifecycle events, and display billing information.
• To respond to bug reports, investigate failures, reproduce issues, and maintain product reliability.
• To apply security protections such as rate limiting, access control, abuse detection, and storage signing.
• To improve the service, including by storing analytics evidence and bounded learning-state data that can inform future content strategy within a page's own workspace.

3. AI Processing

When you use Growy's AI features, we send the prompts and supporting context needed to generate the requested output to our AI and model providers.

That context can include page name and handle, niche, target audience, audience description, tone, brand footer, logo mode, style instructions, additional context, reference notes, reference URLs, competitor URLs, CTA variants, research snippets, topic prompts, and draft text you ask us to rewrite or generate against.

Growy's current AI features are used to generate or refine content and workflow recommendations. Growy does not use those AI features to make decisions that produce legal or similarly significant effects about you.

AI outputs can be inaccurate, incomplete, or unsuitable for your intended use. You are responsible for reviewing content before publishing or relying on it.

4. Connected Accounts and Third-Party Data Sources

If you connect an Instagram account, you authorize Growy to access the data and permissions necessary to provide the features you request, such as profile sync, publishing, scheduling support, and analytics retrieval.

Growy also makes outbound requests to service providers for research, image sourcing, image generation, hosting, and billing. Those providers process the request data necessary to return the requested result.

• Supabase for authentication, database storage, file storage, signed URLs, and realtime updates.
• Vercel for application hosting and delivery.
• Meta and Instagram for OAuth, profile sync, publishing, and analytics.
• OpenRouter and model providers reachable through it for text generation and some image-generation fallbacks.
• Google Gemini services for image generation and related AI features.
• Brave Search for topic research and image-search workflows when enabled.
• Fanbasis for subscription checkout, subscription lifecycle handling, and payment-method visibility where supported.

5. Legal Bases and Permitted Uses

Where privacy law requires a legal basis, Growy generally processes information to perform our contract with you, pursue our legitimate interests in operating and securing the service, comply with legal obligations, and, where required, based on your consent or the permissions you grant through connected accounts.

6. How We Share Information

We do not sell your personal information for money. We share information only as reasonably necessary to operate Growy, comply with the law, protect rights and safety, or as part of a corporate transaction.

• With processors and infrastructure providers that host, secure, bill, or support the service.
• With connected platforms, such as Instagram, when you ask Growy to connect, publish, or sync analytics.
• With AI and search providers when you invoke AI generation, research, or image workflows.
• With professional advisers, law enforcement, regulators, or counterparties where disclosure is legally required or reasonably necessary to protect the service, our users, or others.
• In connection with a merger, acquisition, financing, restructuring, or sale of assets, subject to applicable confidentiality and notice obligations.

7. Storage, Retention, and Deletion

We retain information for as long as needed to operate the service, maintain legitimate business records, resolve disputes, enforce agreements, satisfy legal obligations, and keep security or financial records where required.

In practical terms, account, page, content, analytics, billing, and support data are generally retained until you delete them, delete the related page, or delete your account, unless we need to keep certain records for legal, security, fraud-prevention, tax, accounting, or contractual reasons.

Growy's current account-deletion flow attempts to delete the user's subscriptions, pages, profile, and authentication record. Many related records, including posts and page-linked data, are removed by database foreign-key cascades tied to those records.

8. Cookies and Similar Technologies

Growy uses essential cookies and similar browser storage to keep you signed in, maintain secure sessions, preserve limited product state, and support billing and analytics refresh behavior inside the application.

Growy does not currently use third-party advertising cookies or third-party behavioral marketing SDKs in the product interface.

9. Your Choices and Rights

Depending on your location and applicable law, you may have rights to access, correct, delete, or obtain a copy of certain personal information, and to object to or limit certain processing.

You can currently update core profile information in the app, disconnect Instagram pages, delete pages, and request deletion by using the built-in delete-account flow or by contacting support.

California residents and other users with statutory privacy rights may contact support@growyapp.com to exercise applicable rights. We may need to verify your identity before acting on a request.

10. International Transfers

Growy and its processors may process data in countries other than the country where you live. By using the service, you understand that your information may be transferred to and processed in jurisdictions with different data-protection rules, subject to applicable legal safeguards where required.

11. Security

Growy uses administrative, technical, and organizational safeguards designed to protect information, including row-level access controls, encrypted Instagram token storage, signed media URLs for private draft assets, rate limiting on sensitive routes, file-type and file-size checks, and baseline browser security headers.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Children's Privacy

Growy is intended for adults and is not offered to individuals under 18 years old. We do not knowingly permit individuals under 18 to create accounts or use the service. If you believe someone under 18 has provided personal information to Growy, contact us so we can review and delete it as appropriate.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date and, where required, provide additional notice inside the service or by other appropriate means.

14. Contact

Questions, privacy requests, and notices about this Privacy Policy should be sent to support@growyapp.com.

Passionate Income LLC, 1908 Thomes Ave, STE 12092, Cheyenne, WY 82001. Governing law reference for these public legal terms: Wyoming, USA.