Legal Information

Welcome to Gror. In this policy, 'we', 'us', and 'our' refer to Gror ApS, the provider of this app. We are deeply committed to your privacy and want to be upfront right from the start: we never sell your data, and we use secure, industry-standard infrastructure to keep it protected. This policy outlines exactly how we collect, use, and safeguard your information. We've written this to be as clear and transparent as possible, in line with strict regulations like the GDPR. By using our app, you agree to these practices.

What Data We Collect

To provide and improve our service, we collect the following information:

• Account Information: Your email address. We do not store passwords. Authentication is handled securely through magic links sent to your email or via your Google Account.
• Profile Information: Your anonymous username, the answers to your profile questions, selected tags, spoken languages, and your selected location (country and municipality).
• Connection Data: Information about the connection requests you send and receive, and the status of those connections.
• Chat Data: The content of messages you send and receive in your chats.
• Usage Data: We automatically collect technical information such as your IP address, browser type, device information, and timestamps of your logins and key activities.
• Campaign Information: If you arrive through an ad or another tagged link (like an invite link), we store which one brought you (so-called UTM parameters and ad click IDs). It is stored with your account, or deleted after 7 days if you don't finish signing up.

Why We Use Your Data

We use your data for specific purposes:

• To Operate the Service: Your profile information is used to facilitate connections with other users. Your email is used for authentication and account management.
• To Suggest Connections: To enhance your experience, our service uses your profile information to power an algorithm that suggests other users you might find interesting. This matching process is based on shared tags, location proximity, profile answers, recent user activity, and profile creation date.
• To Provide Chat: To enable one-to-one conversations, we use user and connection data to correctly route messages between you and your connected users.
• To Ensure Community Safety and Investigate Reports: We do not actively monitor private conversations. However, if a user is reported for violating our guidelines (e.g., harassment, abuse), we may access the chat history between the involved users to investigate the claim and take appropriate action, including banning the user. This is critical for maintaining a safe and respectful platform.
• For Transparency and User Experience: To help you make meaningful connections, we display an indicator of when a user was last active. This lets you know if a user is engaged with the app before you decide to spend a token on a connection request, and it helps you direct your attention on frequently visiting users.
• To Keep the App Safe and Reliable: We use technical data (like IP addresses and login times) to guard against spam, abuse, and other security risks. This data also help us fix technical problems so the app runs smoothly for everyone.
• To Improve the App: We might analyze aggregated and anonymized data to understand how our service is used and how to make it better.
• To Reach New Members: Gror is run by one person on a small budget, and ads on Meta (Facebook/Instagram) and Reddit are how new people find it. To see which ads bring people who actually use Gror, we tell those platforms when someone arrives from one of their ads and if they sign up.

Data Processing & Third Parties

We do not sell your data. We use the third-party services below. The first three only process data on our behalf to run the app. The advertising and analytics services also use the data under their own privacy policies:

• Google Firebase: Used for database hosting (Firestore), authentication, and cloud functions. Your data is stored and processed on servers located within the European Economic Area (EEA) to comply with GDPR standards.
• Typesense: Used to provide fast and relevant search results for user profiles. Your profile data is indexed in Typesense.
• Stripe: Used to process payments for tokens. We do not store your credit card details; they are handled directly and securely by Stripe.
• Meta (Facebook/Instagram) and Reddit: Used to measure our ads. They are told when you arrive from one of their ads, start signing up and complete sign-up, together with a hashed (one-way encrypted) email address (to see if they have a matching hash), your IP address, browser information and their own attached cookie and click IDs. They are never told anything about what you do inside the app: not your profile, username, tags, answers, messages, connections, age, gender or location.
• Google Analytics: Used for our own usage statistics (page views and sign-up steps). It uses a cookie ID, your IP address and browser information, but never your email address or profile.

Data Retention & Deletion

We retain your data as long as your account is active. If you choose to delete your account, we will permanently delete your personal data from our primary databases and search indexes through our automated deletion process. To prevent spam and abuse of the platform, your email address will be kept in a separate, isolated list for a cooldown period of 3 months, after which it is also permanently deleted. During this period, the email cannot be used to create a new account.

Your Rights Over Your Data

Under laws like GDPR, you have rights over your data.

• Right to Access & Correct: You can review and edit most of your profile information directly on the 'Profile' page.
• Right to Deletion ('Right to be Forgotten'): You can permanently delete your account and all associated data at any time. To do this, go to the 'Other' menu, select 'Delete your account', and follow the instructions. This action is irreversible.
• Right to Object: You have the right to object to our processing of your data, though this may require you to stop using the service.
• Right to Data Portability: You have the right to request an export of your personal data in a structured, machine-readable format (like JSON). We have made it possible for you to download all the data we have about you. To do so, click here.

Cookies & Browser Storage

Our app is a Progressive Web App (PWA) and uses browser storage (like Local Storage) and cookies. Essential: to keep you logged in and run the app. Ads and statistics: the Meta pixel (_fbp, _fbc), the Reddit pixel (_rdt_uuid) and Google Analytics (_ga) set cookies, and we keep the ad that brought you in Local Storage for up to 7 days. This is how an ad click is connected to a sign-up. The app works the same without these, so you can block or delete them in your browser or with a tracker blocker. You can also manage ad use of your data in your Facebook/Instagram and Reddit ad settings.

Anonymity and Its Limits

While we designed the app around anonymity, it is not absolute. Your username is anonymous to other users, but your account is linked to your email address in our secure database. We will not share this link publicly, but we must clarify that we may be legally required to disclose data to law enforcement if presented with a valid warrant or court order.