Effective date: October 28, 2026 · Covers the Grove app and groveplantcare.com.
At a glance
- Grove Plant Care is operated by Julian Gonzalez Arranz, an individual. This document outlines how your data is used.
- We collect what Grove needs to work: your account details, your households, your plants and photos, your care tasks, and your home's general location.
- AI features only run with your permission. When you allow them, plant photos and plant details go to our AI providers to identify plants and build care plans. Your name and email are never sent to them.
- We don't sell your data, show ads, or track you across other apps and websites.
- You can delete your account at any time in the app, and you can ask us for a copy of your data.
- Questions: support@groveplantcare.com.
Who we are
Grove Plant Care ("Grove", "we", "us") is operated by Julian Gonzalez Arranz, who is the data controller (in Mexico, the responsable; in Colombia, the responsable del tratamiento; in Quebec, the person in charge of the protection of personal information).
- Postal address: Grove Plant Care, 1207 Delaware Ave #3818, Wilmington, DE 19806, USA
- Email: support@groveplantcare.com
This policy covers the Grove mobile app, the Grove web app, and groveplantcare.com, including the waiting list.
What we collect and why
We collect only what Grove needs to run, and we use it only for the purposes below.
| What | Examples | Why we use it | Legal basis (UK and similar laws) |
|---|---|---|---|
| Account details | Name, email, password (stored only as a secure hash), language, region, consent choices. If you use Sign in with Apple: the name and email (or private relay address) Apple shares | Create and secure your account, sign you in, contact you about your account | Contract |
| Household details | House name, rooms, members and their roles, invitations | Let you share plant care with the people you live with | Contract |
| Home location | A location label and coordinates for each house, stored encrypted. Collected once at house setup, only if you allow location access | Tailor care to your climate and season | Consent (you can skip it or remove it) |
| Plants and photos | Plant names, species, rooms, growing method, photos and photo history, health checks | Show and track your plants; with AI features on, identify plants and check their health | Contract |
| Care activity | Tasks, completions, schedules, comments, notes you write | Run your care schedule and household task list | Contract |
| Notifications | Device push token and notification preferences | Send care reminders you've turned on | Consent |
| Purchases | Subscription status, plan, trial and renewal dates, plant packs (sent to us by Apple; we never see your card details) | Unlock what you've paid for | Contract |
| Technical data | IP address, device type, app version, error and security logs | Keep Grove secure, prevent abuse, fix problems | Legitimate interests |
| Waiting list (website) | First name, email, language, region, whether you want early access, marketing consent, referral code, the link you arrived from | Run the waiting list and send launch news you've agreed to | Consent |
| Website analytics | Pages viewed and general device information, through Google Analytics, only if you accept analytics cookies | Understand how the website is used | Consent |
Sensitive data. Grove doesn't ask for sensitive personal data (such as health, religion or ethnic origin). Please don't include it in notes, comments or plant photos.
Automated decisions. Grove's AI suggests plant care. It doesn't make decisions about you that have legal or similarly significant effects.
Who we share data with
We share data only with service providers that help run Grove, under contracts that limit them to providing their service. We don't sell your personal data or share it for advertising, and we don't use it to track you across other companies' apps or websites. We may also disclose data if the law requires it, to protect people's safety, or as part of a transfer of Grove to a new owner (such as Grove's future company), in which case this policy continues to apply.
| Provider | What it does for Grove | Data it handles | Where |
|---|---|---|---|
| Supabase | Database and photo storage | All app data; names, emails and locations are encrypted by Grove first | USA |
| Railway | Runs the Grove servers | All app data in transit | USA |
| Upstash | Security and performance (rate limits, short-lived cache) | Account ID or IP address, cached plant care plans | USA |
| Resend | Sends email | Your email address and the message (invites, sign-in and reset links, and waiting-list and launch emails you've agreed to) | USA |
| Expo, Apple and Google | Deliver push notifications | Push token, notification text (plant name and task) | USA |
| Apple or Google | Turn your house location into a place name, once, at setup | Your coordinates at that moment | USA |
| Apple | Sign in with Apple, purchases and subscriptions | As set by Apple's own privacy policy | Worldwide |
| RevenueCat | Manages subscriptions and purchases with Apple | Grove account ID, purchase and subscription history | USA |
| Vercel | Hosts the website and web app | Website requests | USA |
| Google Analytics | Website analytics, only with your consent | Pages viewed, general device information | USA |
| AI providers | See below | See below | USA |
AI providers
Grove's AI features identify plants, build care plans, check plant health and write short check-in notes. They only run after you allow them in the app, and you can turn them off at any time in Settings. Grove works without them: you can add plants and tasks yourself.
What we send: plant photos (with location metadata removed), plant details (name, species, room, indoor or outdoor, growing method), notes you write, care history, and your home's approximate location (to about 1 km) and season.
What we never send: your name, email address or account ID.
Our current AI provider: Anthropic (Claude), USA.
Our commitments for every AI provider we use: they process your data only to provide these features to Grove; they don't use it to train their models; and they keep it only as long as their service requires. We may change or add AI providers over time. When we do, we'll update this list, and if a change affects what's sent or how it's protected, we'll ask for your permission again.
AI suggestions can be wrong. They're plant care guidance, not professional advice.
Where your data is stored
Grove's servers and providers are in the United States. Our team may also access data from other countries where we work, currently including Colombia. So your data may be processed in countries other than your own, which may have different data protection laws. We protect it the same way wherever it's processed: through contracts with our providers, encryption, and the safeguards in this policy. Where your local law requires a specific transfer mechanism, we use one.
How long we keep it
| Data | How long |
|---|---|
| Your account and app content | While your account is open |
| After you delete your account | A 30-day grace period (so you can change your mind), then permanently deleted |
| Photos you delete | Deleted straight away |
| Waiting list details | Until launch communications end, or until you ask us to remove them |
| Security and error logs | Up to 12 months |
| Records we must keep by law (such as purchase records) | As long as the law requires |
Your content in a shared household (for example, comments on tasks) may stay visible to the household after you leave it, but it's no longer linked to your account once that's deleted. If a household's owner deletes the household, its members are notified, and it can be restored for 30 days before it's permanently deleted with its photos.
How we protect it
Names, email addresses and home locations are encrypted before they're stored. Photos are kept in private storage and shown only through short-lived secure links. Location metadata is removed from every photo you upload. Passwords are stored only as secure hashes, and access to production systems is limited and protected with two-factor login. No system is perfectly secure, but if a breach affecting your data happens, we'll notify you and the relevant authorities as the law requires.
Children
Grove isn't directed at children under 13, and we don't knowingly collect their data. Teenagers between 13 and 18 can use Grove as part of a household with a parent or guardian's permission. If you believe a child under 13 has given us data, contact us and we'll delete it.
Your rights
Wherever you live, you can ask us to:
- Access the personal data we hold about you, and get a copy in a portable format
- Correct data that's wrong or incomplete
- Delete your data (you can also delete your account yourself in Settings > Account > Delete account)
- Object to or limit how we use it, and withdraw consent at any time, for example by turning off AI features, location or notifications. Withdrawing consent doesn't affect what we did before.
To make a request, email support@groveplantcare.com from the address on your account. We may need to confirm it's you. We answer within the time your local law sets, and always within 30 days. We won't treat you differently for using your rights.
Additional rights where you live
| Where you live | What also applies |
|---|---|
| United States, including California | We don't sell or share personal data for targeted advertising. Our apps don't respond to "Do Not Track" browser signals, because we don't track you across other sites. |
| Canada | You can complain to the Office of the Privacy Commissioner of Canada. In Quebec, the person in charge of protecting personal information is Julian Gonzalez Arranz (contact above), and you can complain to the Commission d'accès à l'information. |
| United Kingdom | You can complain to the Information Commissioner's Office (ico.org.uk). |
| Australia | You can complain to the Office of the Australian Information Commissioner (oaic.gov.au). |
| Mexico | You can exercise your ARCO rights (access, rectification, cancellation and opposition) by emailing us with your name, the right you're exercising and a copy of an ID, and you can revoke consent the same way. We respond within the legal deadlines. The supervisory authority is the Secretaría Anticorrupción y Buen Gobierno. |
| Colombia | Under Law 1581 of 2012 you can know, update, correct and delete your data, ask for proof of your authorization, and revoke it. We answer queries within 10 business days and complaints within 15 business days. You can complain to the Superintendencia de Industria y Comercio. |
| Argentina | You can access your data free of charge at six-month intervals unless you show a legitimate interest otherwise. The Agencia de Acceso a la Información Pública, as the control body of Law 25,326, handles complaints about breaches of personal data rules. |
| Chile | You can exercise your rights of access, rectification, deletion, objection and portability, and complain to the data protection authority. |
| Peru | You can exercise your rights of access, rectification, cancellation and opposition, and complain to the Autoridad Nacional de Protección de Datos Personales. |
Changes to this policy
We'll post any changes here and update the effective date. If a change matters, such as new uses of your data or a new type of provider, we'll tell you in the app or by email before it takes effect and, where the law requires, ask for your consent again.
Contact
Grove Plant Care (operated by Julian Gonzalez Arranz), Grove Plant Care, 1207 Delaware Ave #3818, Wilmington, DE 19806, USA · support@groveplantcare.com