Data Privacy and Security: What GrowApps Does With Your Data

Where your project is stored.

Checked against our code on 20 October 2026. This is how GrowApps works at that date.

Your app and its files: The source code of each app, and any images or files you upload to it, are stored as ordinary files in a folder for that project on our production server. The server is a dedicated machine in Helsinki, Finland. Each project builds in its own container.
Your chat with the builder: The conversation is saved with the project on that server. A log of each build session, with the messages and what the agents did, is kept there too.
Your requests and replies: A copy of each request you send and the reply is also saved in Google Firestore, in our Firebase project, together with the steps the agents took and how many credits it used.
Logos and feedback screenshots: Project logos and screenshots you attach to feedback are saved in Google Cloud Storage, in the same Firebase project.
Your account: Sign-in is handled by Firebase Authentication. Your name, email, plan and credit history are stored in Firestore.
Keys you add to your app: API keys you paste into the Keys panel are saved in your project folder on our server, in the app's .env file. They are left out of the code download. Anyone who can open the project, collaborators and staff included, can read them.
Monitoring tools: Traces of what the agents do can be sent to our monitoring services, Grafana Cloud and LangSmith. By default they include the text of the messages.
The web app itself: The growapps.ai pages are served by Firebase Hosting.

Which AI companies see your prompts.

GrowApps is built on third-party AI models. Your messages, the conversation so far and the project files the agents read are sent to the model that is working on your request.

Google (Gemini): The default for planning, writing code, naming your app and summarising long chats. Google also generates images, video, speech and music in Media Studio.
OpenAI: Receives the audio when you dictate a message by voice. Some requests are also sent to OpenAI models, for example quick text edits, or when Google is busy.
Anthropic and Amazon Bedrock: Our staff can set an account to use models from these providers instead of Google.
Tavily: When an agent searches the web or reads a web page, the search it writes is sent to Tavily.
ElevenLabs and Meshy: Used in Media Studio: ElevenLabs for music and sound effects, Meshy for 3D models.

What each provider keeps, and whether it learns from what it receives, is set by that provider's own terms, not by us. Read them here: Google Gemini API terms, OpenAI on API data. We do not state on this page how any provider treats your data, because we do not control it.

Who can see your project.

You, and people you invite

You can open your own projects. Anyone you add as a collaborator can open the same project, including its files, chat and keys, and can invite others.

GrowApps staff, for support

A short list of GrowApps staff accounts can open any project from our admin tools, for example to reproduce a broken preview. Staff do not appear in your collaborator list. Each time one attaches to a project, our servers log which staff account did it, which project, and when. Reading requests in the dashboard is not logged.

Staff reading requests

The admin dashboard lets staff read the prompts and replies of requests, for support and to find problems.

Taking your work out, or deleting it.

Export your code

In the builder, choose Export source code. You get a ZIP of the complete Flutter project, your uploaded files, and your whole chat as a text file. The ZIP leaves out the .env file with your keys, the build output, the git history and Android signing keys. The download link contains your project's id and does not ask for a sign-in, so anyone who has it can download your code and chat. Do not post it.

Delete your account

My Account, then Delete account, then type your email. It runs straight away, cannot be undone, and cancels your subscription first.

What deleting your account removes

Your sign-in account.
Each app you created that is on your apps screen: its container, source code, git history, live preview, published site and the project record that holds the chat. People you invited lose access to those apps.
The requests and replies of those apps, your credit history, plan record and feedback in Firestore.
The images and screenshots you stored with us in Cloud Storage, and your place on our mailing list.
Your saved payment cards at Stripe. The card details are detached from your Stripe customer record.

What it does not remove

Your Stripe customer record, with invoices and refunds, which we keep for our accounts.
Your address on the list of people who asked not to be emailed, so you are not emailed again.
Apps you only collaborated on. They belong to their owner.
Apps you created and earlier took off your apps screen with Remove app. That button only hides them.
The data that the end users of a published app have saved in it.
Operational copies that the deletion does not cover: server logs, backups, the build session logs that hold a full copy of the chat, internal support records, and what PostHog, Google Analytics, Meta, Grafana and LangSmith have already received.

The step by step is on the account deletion page.

Payments.

Payments run on Stripe's hosted checkout page. Your card number goes to Stripe and never reaches GrowApps; we only see the card brand, the last four digits and the expiry date that Stripe returns. When you pay by card, Stripe keeps it on your customer record for renewals and automatic top-ups.

What we measure on growapps.ai.

PostHog (EU): Product analytics on PostHog's EU servers. It records screen sessions as well. The app draws its whole screen as one picture, so a recording can show what was on your screen in the app, chat included. When you sign in we attach your name and email to your profile there.
Google Analytics: Page and usage statistics through Firebase Analytics.
Meta: The Meta Pixel and our server send Meta events such as sign-up, checkout and purchase, to measure our ads. They carry your email and name in hashed form, your IP address and browser details.

What we do not claim.

A page like this should say what it leaves out. We have not been able to confirm these, so we do not make them.

This page describes how GrowApps works. It is not a certification, a contract or a legal opinion.

We do not promise that a provider never keeps or learns from your prompts. See their terms above.
We do not promise that projects are isolated from each other beyond having their own container on a shared server.
We do not state where Firestore and Cloud Storage keep their data, or that all of your data stays in the EU.

Questions from your team or your lawyer?

Write to hello@growapps.ai with questions. The legal documents are on the legal page.

What happens to your project data.