Privacy Policy

GrowMate is a web application that helps founders plan content, track SEO and GEO visibility, and manage affiliate promotion. It is operated by an individual, not a company.

Data controller contact: ljc05061314@gmail.com.

Account data: your email address, display name, and a password stored as a salted scrypt hash. We never store your password in plain text.

Project data you enter: project name, website URL, descriptions, competitor names, keyword ideas, and similar content.

Google Search Console data, only after you explicitly connect it: the list of Search Console properties your Google account can access, and search analytics for the property you bind (queries, pages, clicks, impressions, CTR, average position), plus sitemap status.

Google OAuth tokens: a refresh token issued by Google, encrypted at rest with AES-256-GCM. If you supply your own Google Cloud OAuth client, its client secret is encrypted the same way.

Billing data: handled by Stripe or Creem. We receive subscription status and customer identifiers; we never see or store card numbers.

Operating data: server logs, error reports, and basic usage events needed to keep the service running.

GrowMate requests a single Google scope: https://www.googleapis.com/auth/webmasters.readonly (read-only access to Search Console). We do not request access to Gmail, Drive, Calendar, or any other Google service.

GrowMate's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In practice: Google Search Console data is used only to display your SEO dashboard, to compute the diagnostics and task suggestions shown in the product, and to keep historical snapshots so you can compare periods. It is never sold, never used for advertising, never used to train machine-learning models, and never transferred to third parties except as required by law or as needed to run the service (our hosting and database providers, listed below).

We do not allow humans to read your Google data unless you ask us to for support, it is necessary for security or legal compliance, or the data has been aggregated and anonymised.

To provide the features you signed up for: dashboards, diagnostics, content generation, affiliate tracking, and historical comparisons.

To secure the service: detecting abuse, preventing unauthorised access, and debugging failures.

To bill you, if you are on a paid plan.

Vercel — application hosting.

Supabase — PostgreSQL database and storage.

Google — Search Console API, only after you authorise it.

OpenAI — text generation, when AI features are used. Prompts may contain the project details you entered.

BrandScope — GEO/AI-visibility measurement, only for the brand data you submit.

Stripe and Creem — payment processing.

Each provider processes data on our behalf under its own terms and data-processing terms. We do not sell personal data.

OAuth refresh tokens and client secrets are encrypted at rest with AES-256-GCM. Access tokens are short-lived and cached only until they expire.

All traffic is served over HTTPS. Access to the database is restricted to the application and to the operator.

We keep your data while your account exists. When you delete your account or ask us to erase your data, we remove your projects, snapshots, and OAuth tokens; residual backups are purged on the provider's normal backup cycle.

Disconnect Google at any time: in GrowMate under Settings, or from your Google account at https://myaccount.google.com/permissions. Disconnecting deletes the stored refresh token and stops all Search Console requests.

Access, correct, export or delete your data: email ljc05061314@gmail.com and we will respond within 30 days.

Close your account: email the same address. We delete account data unless we are required to retain it by law.

We use a small number of first-party cookies: a session cookie to keep you signed in, a locale cookie to remember your language, and a short-lived cookie that protects the Google OAuth flow against cross-site request forgery.

We do not use advertising cookies or third-party tracking pixels.

GrowMate is not intended for anyone under 16, and we do not knowingly collect data from children.

If this policy changes materially, we will update the date above and notify you by email or in the product before the change takes effect.

Questions about this policy or your data: ljc05061314@gmail.com.