This policy explains, in plain words, what information the Grew mobile app processes, why, who can see it, and how you stay in control of it. Grew is a mood journal: a people of little characters, one per emotion, that you pick every day and can show to your groups of friends.
In short
- Grew is for people aged 15 and over.
- Your mood journal may reveal your state of health: it is treated as health data, only with your explicit consent, which you can withdraw at any time.
- With every grew, you choose who sees it: Just me, My groups (all or some), or My groups + the map. Your groups see it for 6 hours at most.
- Your tags (“What's behind it?”) and your “Other” words are never shown to anyone. Your behind the scenes (text, photo, voice note) are private by default.
- The map is anonymous: an area of about 2 km, with no name; your location is only recorded at the “+ the map” level and it is erased after 72 hours.
- Server and database in France (OVHcloud). No advertising, no audience measurement, no reselling.
Who publishes the app
Grew is published by an independent developer, who is the controller of your data:
- Grégory Mostacci, sole trader (entrepreneur individuel, France)
- developer@gregory-mostacci.fr
- grew.world
There is no data protection officer (one is not required for this app). The full legal notice is in the terms of use.
The information processed
Grew uses a server: your data does not stay only on your phone. This server and its database are hosted by OVHcloud, in France. Here is what is recorded, why, and on what legal basis:
| Information | What it is for | Legal basis |
|---|---|---|
| A device identifier (a random number created by the app, not a hardware identifier of the phone) and an account identifier | Creating your account without an email and finding it again on this device | Contract (terms of use) |
| Your nickname (chosen by you, or something like “Grew#1234”) | Displaying you in your groups | Contract |
| Email and password (stored hashed, never in plain text), only if you create an email account | Logging you back in from another phone | Contract |
| Language and time zone | Showing the app in your language, counting your days and streaks at the right time | Contract |
| Your moods: emotion (one of 9), intensity from 1 to 5, “What's behind it?” tags (sleep, sport, work, family, friends, love, health, screens, studies, money…, and “Other” with a few free words, 30 characters at most), optional free note (500 characters at most), date and time, your grew's outfit, and who sees it (chosen level, chosen groups, behind the scenes shown or not), as well as your default audience | Your personal journal, your history and your statistics; showing your grew to the groups you choose and, if you tick it, your behind the scenes | Explicit consent (see below); for sharing, your choice with every grew |
| Optional behind the scenes: a voice recording (30 seconds at most) and/or a photo (taken with the camera or picked from your gallery, resized, metadata removed, including GPS location) | Illustrating your mood for yourself; showing it to the chosen groups while your grew is active, if you tick it | Explicit consent, like moods |
| Your approximate location (centre of an area of about 2.2 km by 2.2 km) and the name of the town, only if you choose “My groups + the map” for a grew | Placing your active grew, without your name, on the mood map | Consent (choice with every grew + Android permission) |
| Your groups (membership, role), the reactions you send and receive (hug, high five, heart, sunshine), your gifts and their message (80 characters at most) | Features between friends | Contract; explicit consent for the mood you show |
| Your sessions: refresh token (stored hashed), phone model, login and last refresh dates | Keeping you logged in securely, “Log out of all my devices”, detecting session theft | Contract; security: legitimate interest |
| The notifications you receive, the Firebase (FCM) device token and your language | Your daily reminder and the alert when a friend reacts | Contract (requested feature); Android permission |
| Your seeds (balance and history), items, dances, quests, achievements and mini-game plays | Running the game and preventing cheating | Contract |
| Your pack purchases: Google order number, purchase token, pack, amount, date | Delivering your seeds, proving payment, handling refunds | Contract; after the account is deleted: legal obligation and legitimate interest |
| Your consents: date of the age declaration, date of your agreement for mood data, version of this policy | Being able to prove that you did give your agreement | Legal obligation |
| IP address, date and type of requests sent to the server | Security, abuse limiting, technical logs | Legitimate interest |
| Date of your last visit | Automatically deleting inactive anonymous accounts | Legitimate interest |
| Reports you make: category, written details (500 characters at most), target, copy of the reported content as it was at that moment (nickname, group name, gift message) | Reviewing the report, keeping evidence, informing you of the outcome | Legal obligation (EU Digital Services Act) |
| Moderation decisions concerning you (warning, suspension, ban, nickname reset, content hidden, group or account deleted): reason, duration, content at issue, any appeal; emails we send you about it | Enforcing the terms of use, informing you of the reason, handling your appeal | Legal obligation and legitimate interest |
Pack purchases are not open yet: the purchase information above will only be recorded once they are.
Your mood journal: health data
A single mood is not necessarily health information. But your history, the intensity, the tags, your “Other” words, your note, your photo or your voice note (“I can't sleep anymore”, “doctor's appointment”…) can say a lot about your mental health. As a precaution, Grew therefore treats your whole journal as health data, a category given special protection by the GDPR.
- Your explicit consent is requested on the app's welcome screen, with a dedicated, unticked box, separate from accepting the terms of use. Without it, no account is created.
- We keep proof of your agreement (date and version of this policy).
- Showing a grew or behind the scenes to your groups also requires an action from you every time: choosing the level, ticking the groups, ticking “Show behind the scenes too”.
- You can withdraw your agreement at any time: Settings › Privacy › Withdraw my consent. Your whole mood journal (including notes, tags, photos and voice notes) is then erased. Your account, your seeds and your wardrobe stay.
- Grew is not a medical device and does not replace a health professional.
Who sees this grew?
With every grew you post, you choose its audience. The choice you make becomes your default audience (which you can change in Settings › Privacy) and it is always shown, and can be changed, before you post the grew.
| Level | Who sees your grew (emotion, outfit, time) |
|---|---|
| Just me | Nobody but you. It still counts for your statistics. |
| My groups | The members of your groups: all of them, or only the ones you tick. |
| My groups + the map | The same groups, and the mood map: an anonymous dot, accurate to about 2 km. |
- For how long? Your groups see your grew while it is active: 6 hours at most, or until your next grew. After that, it becomes private again and stays only in your journal. You can change its audience while it is active.
- What your groups see: your nickname, your streak and your dance; your active grew (emotion, outfit, time of update) only if you have shown it to that group. Otherwise, you appear there exactly like someone who hasn't posted a grew yet: nobody can guess that you have posted one.
- Never shown: your intensity, your tags (“What's behind it?”) and your “Other” words. They are only used for your statistics.
- The members of a group are the people who received its invitation code and joined it. If you leave a group, it no longer sees anything of yours.
Behind the scenes: text, photo, voice note
“Behind the scenes” means your note (500 characters at most), a photo and a voice note (30 seconds at most), which you can attach to a grew to say why you feel that way.
- Private by default: they are not shown to anyone until you tick “Show behind the scenes too”.
- If you tick it, they are visible to the groups that see this grew, and only while it is active (6 hours at most). After that, they become private again and stay in your journal. They are never on the map, nor in notifications.
- Photo: you take it with your phone's camera app or pick it with the Android photo picker. Grew only receives that one photo, with no access to your gallery. It is resized, and its metadata (including GPS location) is removed by the app and then a second time by the server. Think of the people who appear in it: don't show anyone without their agreement.
- Voice note: the microphone is only used while you are recording, never in the background. Your voice is neither analysed nor recognised: it is only played by the people who have access to it.
- The files are stored on our server in France, never publicly accessible: every playback checks that the person is allowed. They are erased with the grew, when you withdraw your agreement or when you delete your account.
- A member who sees your behind the scenes can report them if they think they break the rules (see what the publisher sees).
The map and approximate location
Your location is requested and recorded only if you choose “My groups + the map” for a grew. With the other levels, no location is sent.
- Your phone rounds your location to the centre of an area of about 2.2 km by 2.2 km before sending it, and the server rounds it a second time, whatever the app sends it. Only the name of the town is attached to it. Grew never asks for your precise location (GPS).
- On the map, everyone sees anonymous dots: an emotion and a number of people per area, never a name or an account, and only for active grews.
- When filtered on one of your groups, the map shows the areas where members of that group have put their grew on the map. An area where only one person from the group would be present is not displayed: nobody can locate you on your own.
- The location is erased after 72 hours.
- If you refuse the location permission, your grew simply stays in your groups.
Notifications
If you turn them on, Grew sends you a daily reminder and lets you know when a friend reacts. For this, your phone receives a “device token” from Firebase Cloud Messaging (a Google service) which we keep on our server. The content of the notification (type of reaction, sender's nickname, name and emoji of the group) passes through Google's servers to reach you. It never contains your behind the scenes, your tags or your location. You can turn off notifications in the app or in Android.
Reactions, seeds and purchases
Seeds are the game's virtual currency, with no monetary value. Your first reaction of the day is free; the next ones cost seeds. These movements are recorded in your balance history. Seed packs will be sold only through Google Play, which collects the payment: Grew never sees your bank card or your payment methods, it only receives an order number and a purchase token. If you are under 18, ask a parent for permission before buying. Purchases are not open yet.
Staying logged in
So that you don't have to log in again all the time, the app keeps a session: an access token valid for 24 hours, renewed automatically with a refresh token. The latter is stored hashed on the server, along with your phone model and the dates of use. A session expires 90 days after the app was last used on the device. It is closed immediately when you log out or with Log out of all my devices. If a stolen token is reused, the whole session is cut off.
What Grew does not do
- No advertising, no reading of your advertising ID, no tracking from one app to another.
- No statistics or audience measurement tool (Firebase Analytics is explicitly disabled).
- No access to your contacts or your gallery: only the photo you pick.
- The microphone, only while you are recording a voice note.
- Never your precise location.
- Never your tags, your “Other” words or your intensity shown to others; never your behind the scenes without your agreement.
- No selling or renting of information about you.
Who receives information
| Recipient | Why | Where |
|---|---|---|
| OVHcloud | Hosting the server, the database and the files (photos, voice notes); sending emails; hosting this website | France (European Union) |
| Google (Firebase Cloud Messaging) | Delivering notifications. Receives the device token and the content of the notification (type of reaction, sender's nickname, group name) | United States: transfer covered by the EU–US Data Privacy Framework and Google's standard contractual clauses |
| Google Play | Downloading the app and paying for packs. Google is responsible for its own payment processing | Ireland / United States (Data Privacy Framework) |
| Google services on your phone (location, Android geocoder) | Getting your approximate location and the name of the town, if you put a grew on the map. This processing takes place on your phone, according to your Google settings | According to your phone's Google settings |
| OpenFreeMap | Displaying the base map. Receives your IP address and the area displayed, like any website. No account data is transmitted | Free and open service, subject to its own terms |
| The members of the groups you choose | Seeing your active grew and, if you tick it, your behind the scenes, 6 hours at most (see above) | — |
| The authorities | Only upon a lawful request | — |
There is no other recipient, and no data is sold or rented.
What the publisher sees
Grew's admin tool shows your profile, statistics, your emotions and their dates, and the audience of each grew. It shows neither your coordinates (only the town), nor your notes, your “Other” words, your photos or your voice notes.
- A note or “Other” words are only displayed for a legitimate reason (your request, a legal obligation), with a mandatory stated reason, and every read is logged.
- Behind the scenes are only viewed if a member has reported them, from the time of that report, and every opening (text, photo, voice note) is logged. The reported person never learns the identity of the person who reported.
How long we keep your data
| Data | Duration |
|---|---|
| Your account and its data | As long as the account exists; deleted when the account is deleted |
| Anonymous account (without email) that is no longer opened | Automatically deleted after 24 months of inactivity |
| Mood journal (including notes, tags and “Other” words) | Lifetime of the account; erased immediately if you withdraw your agreement |
| Photo and voice note attached to a grew | As long as the grew exists; erased (files included) with it, when you withdraw your agreement or when the account is deleted |
| Grew and behind the scenes shown to your groups | 6 hours at most after posting (less if you post another grew), then private again; they stay in your journal |
| Location and town name of a grew | Erased after 72 hours |
| Sessions (hashed token, phone model, dates) | 90 days after the app was last used on the device; closed immediately on logout |
| Notifications | 90 days after being displayed (180 days if never displayed) |
| Firebase device token | Until you log out or delete the account, or 270 days without a refresh |
| Technical logs (IP address) | Automatic rotation, a few weeks at most |
| Log of admin actions | 12 months |
| Processed reports and moderation decisions | 24 months after they are closed (an ongoing ban is kept for as long as it lasts) |
| Emails sent (decisions, outcome of a report) | 12 months |
| Unpaid or abandoned orders | 30 days |
| Paid orders (Google Play) | When the account is deleted, they are anonymised (no longer linked to you) and kept as proof of payment, for the legal accounting period (up to 10 years) |
| Backups of the database and files | Rolling 30 days: deleted data disappears from backups when they expire |
Security
Exchanges with the server are encrypted (HTTPS only). Passwords are stored hashed. The server and the database are hosted in France and the database is not exposed to the Internet. Photos and voice notes are never served publicly. Admin access is protected and logged, notes and behind the scenes are hidden from administrators, and locations are rounded and then erased after 72 hours. Sessions are short and revocable, and session tokens are excluded from Android backups. Anti-abuse limits are in place. In the event of a data breach, the CNIL (the French data protection authority) would be notified within 72 hours and the people concerned informed if the risk is high.
Android permissions
| Permission | Why |
|---|---|
INTERNET, ACCESS_NETWORK_STATE | Communicating with the Grew server and detecting when there is no network. |
ACCESS_COARSE_LOCATION | Approximate location only, while the app is open, and only if you put a grew on the map. Precise location is never requested. |
RECORD_AUDIO | The microphone, requested when you record a voice note (30 seconds at most), never in the background. |
| None for photos | The camera goes through the phone's camera app and the gallery through the Android photo picker: Grew only receives the chosen photo, with no access to storage. |
POST_NOTIFICATIONS | Showing the daily reminder and your friends' reactions. |
VIBRATE | Haptic feedback (light vibrations). |
com.android.vending.BILLING | Pack purchases through Google Play (added by the Google Play Billing library; inactive as long as purchases are not open). |
com.google.android.c2dm.permission.RECEIVE | Receiving notifications (added by Firebase Cloud Messaging). |
WAKE_LOCK, RECEIVE_BOOT_COMPLETED, FOREGROUND_SERVICE, ACCESS_WIFI_STATE | Scheduling reminders, including after the phone restarts, and knowing the network state for the map. |
Android automatic backup
Your Grew data is on the server, not in your phone's backup. On the device, the login token, the device identifier and the locally recorded consent are excluded from the Google backup and from device-to-device transfer. In practice: an anonymous account is not recovered on a new phone (it is tied to the original device). An account with an email, on the other hand, is recovered by logging in.
Exporting or deleting your data
You are in control at any time, directly in the app:
- Export your data: Settings › Privacy › Export my data generates a complete JSON file (moods, audience of each grew, description of your photos and voice notes…) which you save wherever you like. The photo and voice note files can be viewed in the app; to receive them, write to us.
- Withdraw your agreement for mood data: Settings › Privacy › Withdraw my consent (erases your whole mood journal, including photos and voice notes).
- Delete your account: Settings › Delete my account erases your data immediately, with a double confirmation.
- Without the app: see the Delete my Grew account page.
- Delete a grew or its behind the scenes, change its audience while it is active, turn off location or notifications: in the app or in Android settings, whenever you like.
Your rights
The GDPR gives you the following rights over your data:
- Access and portability: get a copy of your data (JSON export from the app).
- Rectification: correct your nickname, your settings and your recent moods in the app; for anything else, write to us.
- Erasure: delete your account (in the app or via the deletion page).
- Withdrawal of consent: at any time, as easily as you gave it.
- Objection: to processing based on legitimate interest (security logs, for example). We send no marketing.
- Restriction: ask for your account to be temporarily frozen, by email.
- Instructions after death: decide what happens to your data, in accordance with French law.
To exercise these rights, write to developer@gregory-mostacci.fr, from your account's address if possible. We reply within one month at most. If you believe your rights are not being respected, you can also lodge a complaint with the CNIL.
Minimum age
Grew is for people aged 15 and over (the age from which French law allows you to consent on your own to the use of your data online). You declare it on the app's welcome screen by ticking “I am 15 or older”; without this, no account is created. If you are under 18, ask a parent for permission before any purchase. The app does not take part in Google Play's “Families” programme. If you think someone under 15 is using Grew, write to us and we will delete their account.
Changes to this policy
The date of the last update is shown at the top of the page. The version of the policy in force is recorded with your consent (current version: 2026-10-06). In the event of a significant change, you will be informed in the app before it takes effect.
Main changes in version 2026-10-06: choosing the audience with every grew (“Who sees this grew?”), behind the scenes (note, photo, voice note) that can be shared with your groups for 6 hours at most, map limited to active grews put “on the map”, free words for the “Other” tag, microphone for voice notes, first reaction of the day free, 90-day sessions, and publication of this page on grew.world.
Contact
For any question about this policy or about the app:
- Grégory Mostacci
- developer@gregory-mostacci.fr
See also the terms of use and legal notice and the Delete my account page.