Privacy Policy · Growney Build

The short version

• A child can use Growney Build without any account. Then we collect no personal data at all: the models built, the rung, bookmarks and builds from the free workshop stay on the device.
• The app has no ads, no analytics, no tracking, no purchases, no chats and nothing a child could publish. Children don't enter data about themselves.
• A grown-up can sign in with a Growney account and pick the child: then the child's models, rung and builds are kept in the family and show up on the child's other devices, and grown-ups see in Growney Family how many minutes a day the child played.
• What the child sees — the models, pictures, voice, real photos and sounds (from Wikimedia Commons and NASA, with their authors and licences) — is part of the app.
• Links that leave the app, signing in and the settings for grown-ups are behind a parental gate.

1. Who is responsible for your data

The controller of your personal data is Yevhenii Dryha, ul. Milczańska 18a/22, 61-131 Poznań, Poland, NIP 5273007452, REGON 522367200 (“we”, “us”). Contact: support@growney.app. We have not appointed a data protection officer.

2. Without an account

Without signing in, Growney Build works entirely on the device. Which models the child built and on which rung, the step where they stopped, how many misses and hints there were on each step (the app suggests a rung from these), the chosen rung, whether sound is on, the build in the free workshop and the saved builds (“My models”) are stored only on this device (in the app's storage, or in the browser on the website). They are deleted with the app or with the browser's data.

Without an account, the app and the website send nothing about the child.

3. With a Growney account

A grown-up can sign in with a Growney account (email and password, Sign in with Apple or Sign in with Google), create a family if there is none and add a child, or pick a child already in the family. The grown-up enters the child's name or nickname, picks an animal avatar and the year of birth. The account, the family and the child's profile are the same as in the Growney app and are described in the Growney privacy policy: chore.growney.app/privacy.

When the child plays as themselves, we keep in their family: which models they built and on which rung, bookmarks, misses and hints by step, the chosen rung, whether sound is on, and when it was last updated.

The builds the child saves in “My models” are kept in the family too: a name (a date or words the child picked), the board size, where the parts stand and when it was updated. The child and the family's grown-ups see them; other children in the family see a build only when the child sends it to the family. Builds are never published outside the family.

So that grown-ups can see in Growney Family how long the child played and set a daily limit, we count the minutes played: the date, the number of seconds that day on this device and the app's name. These records are deleted after 40 days. When today's time is up, the child can ask for more, and grown-ups see the request in Growney Family.

The device the child plays on is linked like a child's phone in Growney: we keep an identifier the app creates for that device (no email or password), the name “Growney Build”, the type of device and the time it was linked. The device appears among the child's devices in Growney Family, where a grown-up can unlink it. A grown-up can also show a one-time 6-digit code to link a child's own device; the code expires after 15 minutes.

4. What we don't do

• We don't show ads, use advertising SDKs or read the advertising identifier.
• The app has no analytics and no crash reporting from other companies.
• We don't track anyone across other companies' apps and websites.
• We don't ask for a child's email, phone number, location, contacts, photos or voice. The app doesn't use the camera or the microphone.
• We don't sell personal data or share it for marketing.

5. The website

The website build.growney.app uses no cookies and no third-party trackers. We count visits with Cloudflare Web Analytics: no cookies, no stored IP addresses and no tracking across sites — only overall numbers, such as how many times the library was opened. Our hosting provider processes IP addresses and request logs to deliver the pages and protect them from abuse.

6. Legal bases

We process personal data under the EU General Data Protection Regulation (GDPR) for the contract with the grown-up who signs in (Art. 6(1)(b)): keeping the child's progress, counting play time for grown-ups and linking devices; and for our legitimate interests (Art. 6(1)(f)): keeping the service secure, preventing abuse, fixing errors and answering support requests. By adding a child or choosing one, a grown-up confirms that they are the child's parent or legal guardian, or have their permission.

7. Who we share data with

• The child's family: the progress and play time are stored with the family, and grown-ups in the family manage the child's profile and devices in Growney and Growney Family.
• Google Cloud and Firebase (Google Ireland Limited): sign-in, database, server functions and hosting. Database and server functions are in the EU (Belgium); sign-in may also be processed in other countries, including the United States.
• Google Workspace (Google Cloud EMEA Limited): our support email.
• Cloudflare, Inc.: visit counts on the website only.
• Apple and Google: downloading the app from the App Store or Google Play and, if a grown-up chooses Sign in with Apple or Sign in with Google, the sign-in too, under their own privacy policies.
• Authorities: only when the law requires it.

8. Transfers outside the European Economic Area

When a provider processes data outside the EEA, we rely on a European Commission adequacy decision, such as the EU–US Data Privacy Framework for certified companies, or on the Commission's Standard Contractual Clauses.

9. How long we keep data

• Progress and builds on a device without an account: until the app is deleted or the browser's data is cleared.
• The child's progress and builds in Build: until the child deletes a build, a grown-up deletes the child's profile, or the family is deleted.
• Minutes played: 40 days.
• A linked device: until it is unlinked in Growney, Growney Family or Growney Build, or the child's profile is deleted.
• Device codes: 15 minutes.
• Database backups: 7 days. Server and hosting logs: up to 30 days. Support emails: up to 2 years after the question is resolved.

10. Your rights

You have the right to access your data and get a copy, to correct it, to have it deleted, to restrict processing, to data portability and to object to processing based on our legitimate interests. Parents exercise these rights on behalf of their children. A grown-up can delete the account and all the family's data in Growney Build (Me → Sign in, behind the parental gate), in Growney Family or in the Growney app; for anything else write to support@growney.app. We reply within one month.

You can also complain to a data protection authority. In Poland that is the President of the Personal Data Protection Office (Prezes UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

11. Security

Data is encrypted in transit and at rest. Access rules let a child's device read and write only that child's progress, and it loses access as soon as it is unlinked.

12. Changes and contact

When we change this policy, we update the date at the top and tell grown-ups about significant changes before they take effect. Yevhenii Dryha, ul. Milczańska 18a/22, 61-131 Poznań, Poland, support@growney.app.