Growli

Growli Privacy Policy

Effective from 20 October 2026. The Polish version is binding; this is a translation.

In short

• We collect only what the diary needs: your account and the child data you enter.
• We process data about your child’s health and development only with your explicit consent, given separately for each child. You can withdraw consent in the app at any time.
• We store data on servers in the European Union, in Frankfurt.
• We show no ads, sell no data and do no profiling. Growli does not assess your child’s development or health.

Who is responsible for your data

The controller is Maciej Siadkowski, a sole trader trading as Maciej Siadkowski, tax ID (NIP) 6772482350.

Questions about your data: maciek.siadkowski@gmail.com.

What data we collect, why, and on what legal basis

Data	Why	Legal basis
Account: email address and Google account ID, display name, app language, account creation date	signing in and running the app	contract, i.e. the Terms (Art. 6(1)(b) GDPR)
Child data: first name or nickname, date of birth, due date if the child was born early, sex, and measurements, marked milestones and notes if you use them	keeping the diary, corrected age, WHO growth charts that differ for girls and boys	your explicit consent (Art. 9(2)(a) and Art. 6(1)(a) GDPR)
Consent register: which text version, when, on which platform, in which app version and language the Terms were accepted or consent was given or withdrawn	showing that consent was given or withdrawn	the duty to demonstrate consent (Art. 7(1) with Art. 6(1)(c) GDPR)
Technical data: IP address and server logs when you connect	security and running the service	our legitimate interest (Art. 6(1)(f) GDPR)

We treat the whole child profile as health data, including the name and date of birth, because together with measurements they say something about the child’s health and development.

We collect no crash reports and no usage statistics. If we ever add them, it will only be with your separate consent, which you can switch off in the app.

Where the data comes from

From you. Google gives us your email address and account ID when you sign in with Google.

Do you have to provide data

An account is needed to use the app. Child data and consent are voluntary, but the diary does not work without them.

Who receives the data

• People you share a child’s profile with, once that feature is available.
• Supabase (Supabase Pte. Ltd., Singapore): database and sign-in. We store data in the EU region (Frankfurt, Germany). Supabase processes it on our behalf under a data processing agreement with the European Commission’s standard contractual clauses.
• Google: signing in with a Google account. Google is a separate controller of the sign-in data, under its own privacy policy.
• Apple and Google as app stores, under their own rules, when you download the app.

We do not sell data or share it for marketing.

Transfers outside the European Economic Area

We store child data in the EU. Supabase is based in Singapore, so any access from outside the EEA, for example for technical support, is covered by the European Commission’s standard contractual clauses. Google may process sign-in data in the USA under the EU-US Data Privacy Framework and standard contractual clauses.

How long we keep data

• Account: until you delete it.
• Child data: until you withdraw consent, delete the child’s profile or delete your account.
• Backups: deleted data leaves the backups after their rotation cycle, within 30 days at the latest.
• Consent register: while the account exists, and after that for the limitation period for claims.
• Server logs: up to 90 days.

Your rights

You have the right to:

• access your data and get a copy of it;
• have it corrected;
• have it deleted;
• restrict processing;
• data portability: in the app, More → Privacy and consents → Download my data;
• object to processing based on our legitimate interest;
• withdraw consent at any time: in the app, More → Privacy and consents, or in the child’s profile.

Withdrawing consent does not affect the lawfulness of processing before the withdrawal. After withdrawal we delete the child’s profile with its data. Your account stays.

You can also write to maciek.siadkowski@gmail.com about anything. We reply within one month.

You can lodge a complaint with the Polish data protection authority, Prezes Urzędu Ochrony Danych Osobowych (ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or with the authority in your EU country.

Deleting your account

In the app: More → Delete account. You can also ask by email. Details: How to delete your account.

Security

• The connection to the server is encrypted.
• Only people with access to a child’s profile can see the child’s data. Access rules in the database enforce this.
• Child data never goes into logs or reports.

Children

The app is for adults (18+). A child’s data is entered by the child’s parent or legal guardian.

Automated decisions

We make no automated decisions and do no profiling. Growli is not a medical device and does not assess a child’s development or health.

Changes to this policy

We will tell you about important changes in the app before they take effect. Earlier versions are in the change history.