Privacy policy

Earlier versions of the service ran a one-time liveness check at signup using Amazon Rekognition Face Liveness, and derived a face template from it so that one person could not hold several memberships. That step has been removed. Nothing in the product performs it any more, and the code that did has been deleted.

Members who joined while that step existed have an enrolment record from it. Each one carries a deletion deadline stored on the record itself, and the images are deleted when it passes. We do not create new records, and nothing reads the existing ones to make decisions about you.

If you were enrolled and want the remaining record erased before its deadline, write to info@growmoment.app and we will remove it. Because nothing depends on it any more, there is no consequence to your membership for asking.

• Email address and, if you sign in with a password, a password held in hashed form by Firebase Authentication. We never see the password itself.
• Member number, allocated once and never reused.
• Nickname and avatar. Both are generated for you: the nickname and its meaning, and the avatar image, are produced by a model from a prompt and a style you choose. Your stated gender is used to pick an avatar style and for nothing else.
• A selfie, if you make your portrait from one. This is optional — you can always use one of the default avatars instead. The photo is sent to our server and on to OpenAI, whose image model draws your portrait from it. We keep the photo only while the portrait is being made and delete it as soon as it is done or the attempt fails; the portrait is what we store. The photo is not used to recognise you, and no face template is made from it. The iOS app asks before the first photo is sent.
• “About me”, if you write one. It appears on your public profile and is given to Aris as standing context.
• Your timezone, captured from your browser. It exists so the daily reminder lands at 22:00 where you are rather than at a random hour.

• Check-ins. One per local day: a level from 0 to 5 and, optionally, a note. The note is private to you. To write his reply, Aris sends your level, your current streak and the note to our AI provider — see Your notes and AIbelow. His reply is stored so your history can show what he said.
• Stories. If you publish a day, a single headline written by Aris from your note becomes visible to other members. That headline is a synthesis, not your note reproduced. A second, separate choice — made per day — decides whether the note behind the headline travels with it. Unpublishing removes both and leaves no record that a story existed.
• Your protocol base. Sex, birth date, height, weight, how often you train, how the rest of your day moves, your bedtime and how long you intend to sleep. We store what you told us; every target is computed from it on read and none of the computed numbers are stored.
• Your day. The schedule, targets and goals you keep, and which parts of the protocol you ticked off on a given day.
• Forum activity. Posts, comments and votes, under your nickname and visible to other members.

Body and health figures. Your height, weight, date of birth, sleep and training load can amount to data concerning health. We treat them as special-category data and process them on the basis of your explicit consent, given at checkout and again when you set up your base — or, in the iOS app, when you choose to save your base. You can withdraw that consent or delete the base entirely, without giving up the rest of the membership. Apart from Apple Health, below, we do not connect to fitness trackers or wearables, and we do not collect step counts or heart-rate data.

If you connect Apple Health, the app reads your sex, date of birth, height, weight, sleep (the last 14 nights) and workouts (the last 28 days) — nothing else — and never writes to Health. On your phone it works out a usual bedtime, a usual sleep length and how many days a week you train. Those figures leave your phone only if you agree to save them as your base, and then they are handled exactly like a base you typed in.

Data from Apple Health is never sold, never used for advertising or marketing, and never used for anything but your base and the protocol built from it. You can say no and type your numbers yourself, and you can turn off access at any time in the Health app.

Your daily note is a free-text field, so what goes in it is entirely yours to decide — and people write about their health, their moods, their treatment and their setbacks. We do not ask for any of that, and no part of the product looks for it. But we do have to say plainly what happens to a note once you save it.

Where it goes. The note is stored in our database in Frankfurt. To write his reply, Aris sends the text of that note, with your level and your current streak, to OpenAI in the United States; to write a story headline if you ask for one, he sends the note. It is sent without your name, your email or your account id — the provider receives the words and nothing that identifies who wrote them. We ask the provider not to store it, and it is not used to train their models. Like any API customer we cannot rule out a short abuse-monitoring window on their side; what we control is that nothing we send links those words to you.

The basis for it. Because a note can contain data concerning health, we treat it as special-category data and rely on the explicit consent you give at checkout, which names your notes and this transfer — or, in the iOS app, the one it asks for before Aris’s first reply, which names OpenAI. You can withdraw that consent at any time (in the app, under Settings); the practical effect is that Aris stops replying, because a reply to a note requires sending the note.

What stays private. Notes are private by default and no other member can read one. Publishing a day as a story is a separate choice you make per day, and it publishes a one-line headline rather than the note; releasing the note behind it is a further, separate choice. Nothing is inherited from one day to the next.

If you would rather Aris never saw a particular day, leave the note empty — the check-in still counts, and your streak is unaffected.

The GROW report shows you your own week or month — or, when your first two weeks as a member end, those two weeks: its GROW %, what each day contributed to it, and which patterns held in your levels and, if you allow it, in your notes. A day without a check-in scores 0%, and the report shows it that way. The numbers and patterns are computed in your browser, from the check-ins the app has already shown you on your calendar, and nothing about them is stored (see lib/aris/report/). A report is made only when you ask for one.

Your notes are read only if you say so. Because a note can concern your health, the report leaves notes out until you switch on “Find patterns in my notes”, and it rests on that explicit consent (Article 9(2)(a)). That switch works on your device only.

Aris’s read is AI, and only on request. When you generate a report and have agreed to Aris’s read (you are asked the first time, and can generate a report without it), our server recomputes that period’s facts from your check-ins and sends them to OpenAI in the United States so Aris can write the read: one line per day (day of the month, weekday, level, the day’s score, how it compared with your own normal and your streak day), the period’s GROW % and the patterns that held — and that period’s notes only if you switched on note patterns, with email addresses, links, handles and phone numbers removed first. It is sent without your name, your email, your account id or the year; we ask OpenAI not to store it and it is not used to train their models. We do not store the request or Aris’s reply either: the read is shown to you and discarded when you leave. This rests on your explicit consent (Article 9(2)(a)), which you can withdraw at any time under “Your data & privacy” in the report (see app/api/aris/report/read/route.ts and lib/aris/report/aiPayload.ts).

On the preview site only, anyone can ask Aris to read the invented sample month without an account. Nothing personal is involved: the sample contains no member’s data, and that route does not exist on growmoment.app.

Your controls. You can leave any day out of the report, download everything it read and concluded as a file, and see the method behind every number. The report describes your week or month and decides nothing: it does not change your index, your membership or anything else about your account, and no other member can see it.

Payments on this website run through Stripe. We hold a Stripe customer id, a subscription id and status, the price, the amount, the currency, the billing interval, the renewal date and invoice records. We never receive or store your card number.

In the iOS app, you pay Apple. A membership bought there is an App Store subscription: Apple takes the payment under its own terms and privacy policy, and renewal and cancellation are managed in your Apple ID settings. RevenueCat checks the purchase for us. We receive which plan you bought, the transaction and subscription ids, the store environment, and when it renews or ends — never your payment details, and not your Apple ID.

• Request data — IP address, user agent, the page requested, and the time — logged by our hosting provider for security and diagnostics.
• Error reports — when something breaks, a stack trace and the account id associated with the failing request go to our monitoring service.
• Page-timing measurements — anonymous loading and responsiveness figures. They carry no identifier and are used to find slow pages.
• Cookies. Only the ones that keep you signed in, carry an in-progress signup, and remember your cookie choice. See the cookie policy.