Privacy
Privacy Policy
Groworth is a personal finance tracking tool. That means you entrust us with the most sensitive data there is — your spending, debts, savings and goals. This policy describes honestly and completely what we do with that data, and what we do not. Our promise, in three parts: encrypted, never sold, deletable in one click. Every section opens with an "In short:" line — if you read only those, you will already know what matters most.
1.Who the data controller is
In short: your data is the responsibility of Groworth's operator in Latvia, and you can email him about any data-related question.
The data controller within the meaning of the General Data Protection Regulation (EU 2016/679, hereinafter — "GDPR" or "the Regulation") is:
SIA Appmeway, reg. No. 40103588483, Mēness iela 16-8, Riga, LV-1013, Latvia
Hereinafter — "we" or "Groworth". The service is available at groworth.xyz. If you have any question about this policy or about the processing of your data, write to support@groworth.xyz — we will reply without undue delay, and no later than within one month.
2.What data we process
In short: your email, a password hash, and the financial data that you yourself enter. We collect nothing in secret — everything in our database was either typed in by you or is technically necessary for your account to work.
2.1. Account data
- Email address — the account identifier, needed for signing in and for password recovery.
- Password hash (bcrypt) — your password is never, at any moment, stored in plain text. We do not know it and cannot find it out; if you forget it, we issue a new one rather than remind you of the old one.
- Two-factor authentication (2FA) secret — if you enable it; stored encrypted.
2.2. Optional demographic data
During initial setup (onboarding) you may state your gender and age group. Both questions are voluntary — you can skip them or choose "prefer not to say", and the app will work exactly the same. We use this data only in anonymous, aggregated statistics (for example, "how many users are in the 25–34 age group"), never individually.
2.3. Financial data you enter yourself
Everything in the app is your own work or your direct choice — we obtain nothing without your action:
- transactions (amounts, dates, descriptions, notes);
- categories and budget limits;
- your financial goal and its amount;
- accounts and their balances;
- assets and their values (real estate, savings, etc.);
- liabilities (loans, their balances and payments);
- portfolio positions (securities, crypto-assets, their quantities and acquisition costs);
- public crypto wallet addresses, if you add any;
- bank statement data imported in CSV format — it is processed in your browser, and only the rows you confirm for import ever reach the server;
- bank connection transactions — only if you connect a bank yourself and approve access in your own online bank (how it works — see 6.1.1).
2.4. Technical and session data
- Session records — for each device you sign in from: the device type and the time of last activity. They let you see your active sessions in settings and revoke any of them individually.
- Settings — your chosen theme, language and similar preferences.
- Rate-limit counters — short-lived request counters that protect the sign-in forms from password-guessing attacks.
2.5. What we do NOT have
- We do not have your online banking credentials and will never ask for them.
- We do not have your payment card numbers — card data goes only to the payment processor (see section 6), never to our server.
- We do not build advertising profiles and do not collect browsing history.
3.Purposes and legal basis
In short: we process data only so that the app works, stays secure and complies with the law. For marketing — only with your separate consent.
| Purpose | Data | Legal basis (Article 6 GDPR) |
|---|---|---|
| Providing the service — account, budget, goals, XP (experience points) calculations, reports | Account data, financial data, settings | Performance of a contract — 6(1)(b) |
| Account security — sign-in, 2FA, session management, protection against attacks | Account data, session data, rate-limit counters | Performance of a contract — 6(1)(b) and legitimate interests — 6(1)(f) |
| Anonymous product statistics — how many users, in which groups | Aggregated numbers with no identity | Legitimate interests — 6(1)(f) |
| Announcements to the email list | Email address | Consent — 6(1)(a) |
| Marketing emails (news, offers) | Email address | Separate consent only — 6(1)(a); by default we DO NOT send them |
| Compliance with legal obligations (e.g. accounting for subscriptions) | Billing records | Legal obligation — 6(1)(c) |
We never process your data in order to sell it, rent it out or pass it to advertisers. We have no such purpose and never will.
4.How your data is protected — honestly
In short: personal fields are encrypted, your password is never stored in the clear, and the database cannot be reached from the internet. We technically can access the data — and we say so honestly instead of pretending we cannot.
4.1. Encryption
- Personal fields — transaction titles, notes, wallet addresses and similar free-text content — are stored in the database encrypted with field-level encryption (Fernet, an AES-128-based symmetric scheme with integrity checking).
- Bank connection identifiers — the account IBAN and access session identifiers — are stored encrypted with the same field-level scheme.
- Amounts and dates are stored in the clear — deliberately: without them no calculation would work, neither budget totals nor debt projections. An amount without context ("−23.40") does not by itself reveal what it was for.
- The encryption key is kept on the server separately from database backups — a backup on its own, without the key, does not expose the personal fields.
- All data exchanged between your browser and the server travels only over an encrypted HTTPS connection.
4.2. What we deliberately do NOT claim
Many services claim: "we cannot access your data". We will not say that, because it would not be true. The encryption key lives on the server — otherwise password recovery by email would not work, and your data would be irretrievably lost along with a forgotten password. That means: technical access to the data does exist for the controller. Our commitment is this: access to data content happens only by the controller in person and only for support purposes at the user's own request — never out of curiosity, for analytics or for marketing. The honest promise is: encrypted, never sold, deletable in one click — no more, but also no less.
4.3. Passwords and access
- Passwords are stored only as bcrypt hashes.
- Two-factor authentication (TOTP) is available — we recommend turning it on.
- Sessions are tied to a device; you can revoke each one individually in settings.
- The sign-in forms are protected by rate limits that stop password-guessing attacks.
- In its sign-in and password-recovery responses, the system does not reveal whether an account with a given email exists.
4.4. Infrastructure
- The database is not reachable from the internet — only the application itself, from the same server, can access it.
- The application runs in a restricted environment without administrator privileges.
- Every administrator action in the system is written to an audit log.
- The admin panel is technically separated from users' financial data — it sees only aggregated numbers, never content.
5.Where your data physically lives
In short: on a server in Germany, in the European Union. Data is not moved outside the EU/EEA.
All Groworth data is stored on a Hetzner Online GmbH server in Germany — that is, in the European Union, where the GDPR applies directly. No data is transferred to countries outside the EU/EEA. If that ever changed, we would first update this policy and announce it (see section 13).
6.Who we share data with
In short: no one, except our technical processors — EU hosting, email delivery and, only if you connect a bank yourself, the bank data connection. Price sources see only instrument symbols. Your data is never sold — not ever, not to anyone, not in any form.
6.1. Current processors
| Processor | Role | What data it receives |
|---|---|---|
| Hetzner Online GmbH (Germany, EU) | Server hosting | All data physically lives on this server (see sections 4 and 5 on encryption and location) |
| Resend | Email delivery (password recovery, security notifications) | The recipient's email address and the content of the message being sent |
| Enable Banking Oy (Finland, EU) | Bank data connection (PSD2 AISP) — only if you connect a bank yourself | Your chosen bank and the account's transaction list (date, amount, payee, description) that the bank returns after your approval in your online bank. See 6.1.1 below. |
6.1.1. The bank data connection — how it works
Connecting a bank is a choice, not a default — without it Groworth works fully with manual entry and CSV import. If you do connect a bank:
- You give consent in the bank itself. You are redirected to your bank's authorisation (Smart-ID or the bank's app). Groworth never sees your online banking password — authorisation happens on the bank's side, and we receive only read-only access to the transaction list.
- What we receive: account transactions (date, amount, currency, payee name, payment description) and the account identifier (IBAN). The IBAN and session identifiers are stored encrypted in our database (see 4.1). We cannot make payments — access is read-only (AISP); payment initiation has not been requested and is not possible.
- Legal basis: performance of a contract (Article 6(1)(b) GDPR) — reading in your transactions is a feature you request yourself. The intermediary is Enable Banking Oy, a licensed account information service provider (AISP) in Finland, EU.
- The consent expires on its own no later than after 180 days (a PSD2 limit) — then the bank has to be approved again. You can revoke it at any moment: Settings → Banks → "Disconnect", or directly in your online bank. When you disconnect, the transactions already read in stay in your account — they are your data and can be deleted like any other record.
- Imported rows do not become the truth on their own. Every bank transaction arrives unconfirmed and waits for your confirmation — you choose the category yourself.
6.2. Price data sources — no personal data
To show current prices in your portfolio, the server periodically queries public price sources: CoinGecko (crypto-assets), DexScreener (decentralised exchange tokens — by contract address), Yahoo Finance (securities) and the European Central Bank (exchange rates). These sources are sent only instrument symbols or token contract addresses (for example, "BTC", "VWCE" or a token address) — never your name, email, quantities or anything else that identifies you. The server fetches each price once and shares it across all users, so it is impossible to deduce from the queries which user holds which asset.
6.2.a. Public crypto wallet addresses
If you add a crypto wallet's public address in the Portfolio, we store it encrypted like other personal fields and periodically ask public blockchain nodes (Solana RPC, Ethereum RPC, Blockstream Bitcoin API) for its balance. Those nodes receive only the address itself — it is already public on the blockchain. We never ask for private keys or seed phrases, and they never enter this app. You can delete the address at any time, and its fetched balances disappear with it.
6.3. Payment processing — Stripe
- Stripe (Stripe Payments Europe, Ltd., Ireland) — the payment processor and an independent controller of payment data. Your card number never reaches our server — only Stripe sees it, in its own payment environment. From Stripe we receive only the customer and subscription identifiers, the payment amount and its status.
6.4. When the law requires it
We may disclose data to public authorities only where applicable law requires it and the request has a legal basis. Unless the law forbids it, we will inform you of such a request.
6.5. What we do not do
- We do not sell or rent out data — neither individual nor aggregated.
- We do not send data to advertising networks or data brokers.
- We do not show ads and do not embed ad trackers.
7.Cookies and tracking
In short: there are no tracking cookies — neither ours nor third parties'. The only cookie is your language choice, and it is strictly necessary, which is why there is no cookie banner. Your session lives in your browser's local storage, and visit statistics are anonymous, with no IP addresses.
7.1. Cookies
Groworth uses one cookie — lang — and only if you
pick a language (LV/EN) on the home page yourself. It stores two letters
("lv" or "en"), lives for 12 months and serves one purpose: opening the
page in your language next time. It is a functional cookie, not tracking,
and the law requires no consent for it — which is why our pages have no
cookie banner. There are no advertising, analytics or third-party
cookies.
7.2. Browser local storage (localStorage)
After you sign in, your session key is kept in the browser's local storage (localStorage) on your device. This is technically necessary for you to stay signed in — the app cannot work without it. The key is sent nowhere except our own server, and it disappears when you sign out or delete your browser data.
7.3. Visit statistics
We count home-page visits in two ways, and both are anonymous. First, an anonymous daily total — a single number in our database. Second, Umami, open-source visit statistics that run on our own server, use no cookies and store no IP address: it sees how many people opened which page and from which country, but not who you are, and it cannot link two of your visits. During sign-up it likewise notes, anonymously, which step a person reached (for example “questionnaire, step 3”), without e-mail, name or amounts; after sign-up it measures nothing inside the app. Nothing leaves our server. There is no Google Analytics or any other third-party analytics on our pages.
7.4. Bot protection
To protect forms against bots we use a mathematical puzzle that your browser solves by itself ("proof of work") — no third-party services, no tracking, no image-puzzle solving. No data about you reaches us from it.
8.Email sign-up on the landing page
In short: if you leave your email on the landing page, we will send you one thing — Groworth announcements. Nothing else. Marketing emails only if you separately consent to them.
On the landing page you can join the email list by giving nothing but an email address. We use that address for one single purpose: to send you Groworth announcements. The landing page promises "We will send nothing else" — and that promise is also legally binding: any other emails (news, offers) would require your separate, freely given consent, which we would ask for openly, never assume silently.
You can leave the list at any moment by writing to support@groworth.xyz or using the link in the email — the address will be deleted. For retention periods, see section 9.
9.How long we keep data
In short: for as long as your account is active. When you delete your account, the data disappears from the working database immediately, and from the encrypted backups no later than within 30 days.
| Data | Retention period |
|---|---|
| Account and financial data | While the account is active. After account deletion — from the working database immediately and irreversibly; from the encrypted backups, as they rotate, no later than within 30 days. |
| Session records | Until the session ends or is manually revoked; never longer than the account exists. |
| Email list addresses | 12 months after the last announcement, or until you unsubscribe — whichever comes first. |
| Anonymous aggregated statistics | No time limit — it contains no personal data, so GDPR retention limits do not apply to it. |
| Billing records | For the period set by accounting legislation (in Latvia normally 5 years) — a legal obligation that remains in force even after the account is deleted. |
10.Your rights and how to use them
In short: for every GDPR right we have a concrete button, not a form and a wait. Export — one click. Deletion — one click. Rectification — everything is editable in the app itself.
The GDPR guarantees you rights over your data. For each of them we have built a mechanism directly into the app, so that using them never requires writing formal requests:
| Right | How to use it in Groworth |
|---|---|
| Access (Art. 15 GDPR) and portability (Art. 20) | In settings, download a full export of your data in machine-readable JSON format with one click — everything you have entered. |
| Rectification (Art. 16) | All content is editable in the app itself — transactions, categories, goals, accounts, assets. Correct it yourself at any moment, without going through us. |
| Erasure (Art. 17) | In settings, delete your entire account with one click — all content, irreversibly. There is no "pause" archive and no hidden shadow profile. For timelines, see section 9. |
| Restriction of processing (Art. 18) and objection (Art. 21) | Write to support@groworth.xyz — we will review it and reply no later than within one month. |
| Withdrawal of consent (Art. 7) | Wherever processing rests on consent (for example, the email list), you can withdraw it at any moment — with the same ease with which you gave it. Withdrawal does not affect the lawfulness of processing carried out before it. |
| Complaint to the supervisory authority (Art. 77) | You always have the right to turn to Datu valsts inspekcija (the Latvian Data State Inspectorate) — dvi.gov.lv. We would, though, be grateful if you first gave us the chance to solve the problem ourselves. |
11.Automated decisions and profiling
In short: no algorithm makes decisions with legal consequences for you. XP, levels and projections are arithmetic on your own numbers, not a judgement about you.
Groworth performs no automated decision-making within the meaning of Article 22 GDPR — the kind that would produce legal effects for you or similarly significantly affect you. The app's calculations (XP, levels, debt payoff projections, budget totals) are simple arithmetic on data you entered yourself, and they serve only you, as information. We do not build user profiles for advertising, creditworthiness assessment or any kind of selection.
12.Age restriction
In short: Groworth is intended for adults — aged 18 and over.
The service is intended for persons aged 18 and over, and by registering you confirm that you are an adult. We deliberately collect no data about minors. If we learn that an account was created by a person under 18, the account and its data will be deleted.
13.Changes to this policy
In short: we will announce material changes by email at least 14 days in advance. Quiet, unnoticeable changes to the points that matter — will not happen.
This policy may change — for example, when the processors or the app's features change. Material changes — ones that change the scope of data processed, the processors, or your rights — will be announced to your account email at least 14 days before they take effect. Each version's effective date and number is shown at the top and bottom of the page. Editorial corrections (typos, wording clarifications with no change of substance) may happen without a separate announcement.
14.Contact and complaints
In short: write to us — we will reply no later than within one month. If the answer does not satisfy you, you always have Datu valsts inspekcija (the Latvian Data State Inspectorate).
For questions about this policy and the processing of your data:
- Controller: SIA Appmeway, reg. No. 40103588483, Mēness iela 16-8, Riga, LV-1013, Latvia
- Email: support@groworth.xyz
- Supervisory authority: Datu valsts inspekcija (the Latvian Data State Inspectorate), dvi.gov.lv