Grovelet Privacy Policy

Effective date: September 26, 2026

Grovelet lets you build personal Screens from widgets, artwork, and connected data, and save and synchronize your Library and Screen setup across devices. This page explains the information used to provide those features, including optional Google sign-in.

Grovelet is an independent project based in California, United States. This policy describes how its operator (“we” or “us”) handles personal information through the Grovelet website, apps, and related services. Contact: support@grovelet.app.

Information we process

We process the following information, depending on the features you use:

Account information: email address, account identifier, optional profile information, authentication records, and workspace membership.
Device and configuration information: device names and identifiers, connection and authorization records, settings, and data catalog names and descriptions.
Saved content: screen layouts, widget settings, data bindings, designs, images, and other library files. Some account-linked layouts and settings synchronize automatically.
Recorded data: updates sent to cloud storage when “Keep history” is enabled for a supported dataset. Disabling history does not erase existing recordings; queued updates may still be saved.
Support and technical information: information you send us and service records such as IP addresses, request times, authentication events, errors, and performance information.

Connectors process information from the devices, files, websites, or services you configure them to access. Live updates can travel directly between authorized devices or through connection relays. Cloud services help authenticate and coordinate these connections. Peer-to-peer delivery does not eliminate the cloud processing described above. Devices and browsers may also retain local content, caches, and updates awaiting synchronization.

How we use information

We use information to operate Grovelet, authenticate accounts, manage permissions and connections, synchronize and store content, provide support, diagnose and improve service reliability, prevent abuse, and meet applicable legal obligations.

Under our current practices, we do not sell or rent personal information, use it for targeted advertising, or use it to train AI models. External agents you authorize operate under their own privacy policies.

Google sign-in is optional. The following describes how Grovelet handles information received through it:

Data accessed: your Google account identifier, email address and verification status, and basic profile information such as your name and profile picture. We request the basic identity scopes openid, email, and profile. This does not give Grovelet your Google password or access to Gmail messages, Drive files, or Calendar events.
Use: to identify and authenticate you, link your Google identity to your Grovelet account, maintain sign-in sessions, and provide account profile information.
Storage and sharing: Supabase processes the sign-in and stores linked identity and account records on our behalf. Grovelet uses those records to operate your account; signed-in devices receive the account and session information needed to use the service. Our service providers process information for the functions described under “When information is shared,” and disclosures may also occur for the legal and security needs described there. We do not sell Google user data, use it for targeted advertising, or use it to train AI models.
Protection: Google account records are protected by access controls and encrypted network connections. Cloud-stored records may be accessible to the operator and service providers for the purposes described here; these measures do not guarantee absolute security.
Retention and deletion: we retain linked identity and account records to operate your account, subject to the security, legal, and deletion considerations below. To request deletion of your Grovelet account and associated Google-derived information, email support@grovelet.app. Requests may require identity verification; backup expiry and permitted security or legal retention can differ from removal from active systems.

You can revoke the Google connection in your Google Account settings. Revocation does not itself delete your Grovelet account or stored information, or necessarily end an existing Grovelet session. Google's own processing is described in its Privacy Policy.

Our use of information received from Google APIs follows the Google API Services User Data Policy, including Limited Use requirements where applicable.

When information is shared

Service providers: Supabase provides authentication and database services; Cloudflare provides website and service delivery, file storage, and connection infrastructure. Account emails also use an email delivery provider. Providers process information for these functions.
Your connected devices, agents, and services: information is shared as needed for the connections and permissions you enable. Authorized agents may access private content or change settings within their permissions. External providers apply their own terms and privacy policies to information they receive.
Public content: items you publish publicly become available to others. Saving a private library item does not itself publish it.
Legal and security needs: information may be disclosed when reasonably necessary to comply with law or legal process, investigate abuse, or protect the service and people's rights or safety, subject to applicable law and Google data restrictions.

Revoking access cannot retrieve information already received by another device, person, or service.

Local storage and measurement

Grovelet uses browser and device storage, including local storage and IndexedDB, for sessions, preferences, cached content, and synchronization. Clearing it may sign you out or remove unsaved local changes.

Infrastructure services process operational measurements such as request counts, errors, and performance information. We currently do not enable advertising trackers or third-party advertising tools on our website. Grovelet does not respond to browser Do Not Track signals. Our current practices do not include selling personal information or sharing it for cross-context behavioral advertising, regardless of browser privacy signals.

Retention, deletion, and your choices

We retain information for the purposes described in this policy. Retention depends on account activity, feature settings, content dependencies, storage limits, security needs, legal obligations, and deletion requests. This policy does not promise indefinite storage or recovery of content.

You can manage supported connector permissions, history settings, saved content, and agent connections through the service. Signing out does not delete cloud data. Deleting cloud content may leave copies on your devices or with recipients. Removal from active systems, file cleanup, and backup expiry may occur at different times. Some records may be retained where reasonably necessary for security or legal obligations, as permitted by applicable law.

For access, correction, or deletion requests, email support@grovelet.app. Requests are handled manually during the beta and may require identity verification. We handle requests subject to applicable law, including its exceptions. Depending on your location, you may also have rights to a copy of your information, to restrict or object to processing, to withdraw consent, or to complain to a privacy regulator.

Security and locations

Grovelet uses access controls and encrypted network connections. These measures do not guarantee absolute security. Cloud-stored information is not necessarily end-to-end encrypted and may be accessible to the operator and service providers for the purposes described in this policy.

Our primary account database is in the United States. Other processing may occur in countries where our providers operate.

Age eligibility

Grovelet's beta is intended for adults aged 18 or older. We do not knowingly collect personal information from children under 13. Contact us if you believe a child has provided personal information through the service.

Policy changes

Updates will be posted on this page with a revised effective date. For material changes, we will provide a prominent website or in-app notice, or an email. We will provide advance notice and obtain consent where required by applicable law or Google's policies, including before using Google-derived information for a new, previously undisclosed purpose.

For privacy questions, contact support@grovelet.app.