Privacy Policy · Growney Travel

The short version

• A child can use Growney Travel without any account. Then we collect no personal data at all: the chosen home country, passport stamps, photos taken and postcards stay on the device.
• The app has no ads, no analytics, no tracking and no purchases. Children don't enter data about themselves. A postcard has a ready phrase or a few of the child's own words (up to 120 characters), which go only to the child's family: we don't read them or show them to anyone.
• A grown-up can sign in with a Growney account and choose a child: then the child's progress is kept with the family and shows up on the child's other devices.
• Links that leave the app and signing in are behind a parental gate.

1. Who is responsible for your data

The controller of your personal data is Yevhenii Dryha, ul. Milczańska 18a/22, 61-131 Poznań, Poland, NIP 5273007452, REGON 522367200 (“we”, “us”). Contact: support@growney.app. We have not appointed a data protection officer.

2. Without an account

Without signing in, Growney Travel works entirely on the device. The home country the child picks, the countries visited and finished with their dates, the wonders photographed, the postcards (a photo and a ready phrase or the child's own words), the chosen language and whether sound is on are saved only on that device (in the app's storage, or in the browser on the website). They are deleted when the app is deleted or the browser data is cleared.

To suggest the home country, the app looks at the device's time zone and region settings on the device itself; they are not sent anywhere. The child can pick another country or choose not to say.

The app downloads nothing about the child and sends nothing about the child. The pictures, voice recordings, maps and real photos (from Wikimedia Commons, with their authors and licences shown) are part of the app.

3. With a Growney account

A grown-up can sign in with a Growney account (email and password, Sign in with Apple or Sign in with Google), create a family if there is none and add a child, or pick a child already in the family. The grown-up enters the child's name or nickname, picks an animal avatar and the year of birth. The account, the family and the child's profile are the same as in the Growney app and are described in the Growney privacy policy: chore.growney.app/privacy.

When a child travels as themselves, we keep with their family: the home country, the countries visited and finished with the time of each stamp, the wonders photographed, the postcards sent (which photo, which ready phrase or own words, and when), and when this was last updated.

The device the child plays on is linked like a child's phone in Growney: we keep an identifier the app creates for that device (no email or password), the name “Growney Travel” and the time it was linked. The device appears among the child's devices in the Growney app, where a grown-up can unlink it. A grown-up can also show a one-time 6-digit code to link a child's own device; the code expires after 15 minutes.

4. What we don't do

• We don't show ads, use advertising SDKs or read the advertising identifier.
• The app has no analytics and no crash reporting from other companies.
• We don't track anyone across other companies' apps and websites.
• There are no chats, comments or anything a child can publish.
• We don't ask for a child's email, phone number, location, contacts, photos or voice. The app doesn't use the camera or the microphone.
• We don't sell personal data or share it for marketing.

5. The website

The website travel.growney.app uses no cookies or third-party trackers. We count visits with Cloudflare Web Analytics, which sets no cookies, does not store IP addresses and does not follow anyone across sites: it shows us only totals, such as how many times Italy was opened. Our hosting provider processes IP addresses and request logs to deliver the pages and protect them from abuse.

6. Legal bases

We process personal data under the EU General Data Protection Regulation (GDPR) for the contract with the grown-up who signs in (Art. 6(1)(b)): keeping the child's progress and linking devices; and for our legitimate interests (Art. 6(1)(f)): keeping the service secure, preventing abuse, fixing errors and answering support requests. By adding a child or choosing one, a grown-up confirms that they are the child's parent or legal guardian, or have their permission.

7. Who we share data with

• The child's family: the progress is stored with the family, and grown-ups in the family manage the child's profile and devices in Growney.
• Google Cloud and Firebase (Google Ireland Limited): sign-in, database, server functions and hosting. Database and server functions are in the EU (Belgium); sign-in may also be processed in other countries, including the United States.
• Google Workspace (Google Cloud EMEA Limited): our support email.
• Cloudflare, Inc.: visit counts on the website only.
• Apple and Google: if a grown-up chooses Sign in with Apple or Sign in with Google, that company processes the sign-in under its own privacy policy.
• Authorities: only when the law requires it.

8. Transfers outside the European Economic Area

When a provider processes data outside the EEA, we rely on a European Commission adequacy decision, such as the EU–US Data Privacy Framework for certified companies, or on the Commission's Standard Contractual Clauses.

9. How long we keep data

• Progress on a device without an account: until the app is deleted or the browser data is cleared.
• A child's Travel progress: until a grown-up deletes the child's profile or the family is deleted.
• A linked device: until it is unlinked in Growney or in Growney Travel, or the child's profile is deleted.
• Device codes: 15 minutes.
• Database backups: 7 days. Server logs: up to 30 days. Support emails: up to 2 years after the question is resolved.

10. Your rights

You have the right to access your data and get a copy, to correct it, to have it deleted, to restrict processing, to data portability and to object to processing based on our legitimate interests. Parents exercise these rights on behalf of their children. A grown-up can delete the account and all the family's data in Growney Travel (Me → behind the parental gate) or in the Growney app; for anything else write to support@growney.app. We reply within one month.

You can also complain to a data protection authority. In Poland that is the President of the Personal Data Protection Office (Prezes UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

11. Security

Data is encrypted in transit and at rest. Access rules let a child's device read and write only that child's progress, and it loses access as soon as it is unlinked.

12. Changes and contact

When we change this policy, we update the date at the top and tell grown-ups about significant changes before they take effect. Yevhenii Dryha, ul. Milczańska 18a/22, 61-131 Poznań, Poland, support@growney.app.