What we collect: almost nothing, on purpose

Groovy's privacy model fits in one sentence: your records are created on your phone, processed on your phone, and stay on your phone unless you personally switch on encrypted backup. The rest of this page unpacks that sentence, because the details are where trust is actually earned.

What Groovy stores and where

Everything you do in Groovy — rituals ticked, focus sessions logged, habit dots, check-ins that feed the energy curve, the one-line weekly reviews — is written to a local database on your device. The insights you see are computed from that database by code running on the device. There is no server-side copy created as a side effect of using the app, because there is no side-effect pipeline: the app does not call home with telemetry, crash breadcrumbs in identifiable form, or "product analytics" events.

When you do create an optional account, the account itself (an email address, a hashed password, a user identifier) is stored by our infrastructure provider in the European Union. That is the entire server-side footprint of a default installation: one row in an accounts table. If you never create an account, that row does not exist and no personal data of yours is held anywhere beyond your handset.

Backup and sync, explained properly

Optional backup exists because phones fall in lakes. When you enable it, your records are encrypted on the device with a key derived from your account — a key we do not hold and cannot reconstruct — and the encrypted blob is stored with the same EU provider. End-to-end encryption means the blob is opaque to us in any practical sense: we can see that an encrypted object exists and roughly how big it is, and that is the full extent of it.

Sync between your own devices happens through the same encrypted objects. Turning backup off deletes the server-side copies, not merely hides them; deletion completes within thirty days across all redundant storage, and the app tells you when it's done. Leaving Groovy entirely triggers the same deletion for the account row. Your data is not held hostage to a cancellation flow, because the export button is free on every tier and always has been.

What we do not do — the negative space

No advertising SDKs of any kind ship in Groovy, on iOS or Android. We run no third-party analytics, no attribution trackers, no session recorders, no A/B-testing beacons, no "anonymised" event streams to anyone. We do not sell, rent, monetise or broker data in any direction, and we do not have relationships with data brokers — not because such arrangements are illegal (they are regulated, not banned) but because the business model is subscriptions and the attention business is a different, worse business.

We do not ask for health permissions, location, contacts, microphone or camera. The app works fully offline; network access is used only for account authentication, optional backup and sync, and fetching the ritual library's seasonal updates. Reviewing an app's privacy label is tedious; ours is short, which is the advantage of building an app that doesn't want your data.

Children and young people

Groovy is rated for teens and up on both stores. We do not knowingly create accounts for children under 13, and we do not process children's data for any profiling purpose — chiefly because we do not profile at all. A parent who finds a younger child has created an account can write to us and the account and any synced copies will be deleted within the same thirty-day window described above.

Your rights under UK GDPR — in practice

You have the usual package of rights: access, correction, deletion, portability, objection and the right to complain to the Information Commissioner's Office. In Groovy's case most of these are comically short to satisfy, because the primary copy of your data is already in your hand. The in-app export gives you a complete, portable copy of your records at any time — that's your portability right, served in one tap. Deletion of an account (and any synced copies) runs from the app's settings or an email to our privacy address, completed within thirty days. Access requests return the same export plus the account row, because that is genuinely everything.

Where something genuinely needs a human — a complaint, an edge case, a deletion that seems stuck — writing to privacy@groovyinc.app reaches the team, and we answer within one month as the law requires and usually within a week because that's just how long it takes.

Who we are, legally

Groovy Inc Ltd is the data controller for the account and backup data described here. We are a UK-registered company; during the company's demo-website phase we do not print the registration number in the footer, but it will appear here once the entity's public details are finalised. The ICO's registration for any UK organisation handling personal data as controller is a legal requirement we maintain, and our processing rests on legitimate interests (operating the optional account you asked for) and contract (providing the service), not on consent you can't withdraw.

What a support email contains

When you write to support, what you send is what we store: the name you type, your email address, the topic you pick and the message itself, plus the page you wrote from and the time. That is the entire contents of a support enquiry — no device fingerprint, no location, no profile enrichment from "data partners" (we don't have any). Enquiries live in an inbox accessible to the support team and are deleted on the retention schedule described in the privacy policy. We keep them that long for one honest reason: if you write back in eleven months saying "remember this bug?", being able to actually remember it is worth more to us than the storage saving.

Who runs the pipes

The optional account and encrypted-backup storage run with an infrastructure provider in the European Union, under a data-processing agreement that restricts what they may do with anything on our behalf — which is, in practice, storing and serving encrypted objects they cannot read. Email for support and privacy addresses is handled by a mainstream email provider under the same kind of agreement. We deliberately keep the vendor list this short. Every additional subprocessor is another door to guard, and the app's design goal is to need as few doors as possible.

International transfers, stated plainly

Our infrastructure provider stores data in the EU. If, during an incident investigation or a support escalation, data were ever accessed from outside the UK or EU — for example by an on-call engineer — that access would happen under the transfer safeguards the UK GDPR requires (UK addendum to the EU standard contractual clauses) and would be limited to what the incident strictly demands. We do not operate offices or staff in other jurisdictions, so there is no routine overseas access to describe. The short version: your data lives in the EU, is encrypted against us, and crosses borders only under the legal mechanisms written down for it.

Automated decisions: none worth the name

Reminder timing adapts to your responses and the energy curve is drawn from your check-ins — those are automated suggestions about your own behaviour, computed on your own phone. Nothing in Groovy makes a decision with legal or similarly significant effect about you: no scoring, no profiling shared with third parties, no risk grades, no "engagement cohorts" sold onward. If the phrase "automated decision-making" in GDPR guidance has ever made you uneasy, Groovy's answer is the shortest one available: the only automated decisions here are "eight worked better than nine for your nudge" and "Tuesdays look sharp for you".

Security posture, in brief

Encryption in transit is TLS 1.2+ everywhere, including the contact form. Encrypted backups use modern authenticated encryption with keys derived on your device; our servers handle ciphertext. Access to the account store is limited to two engineers on call, audited, with changes logged. We run external penetration tests before major releases and act on findings before shipping. No system is bulletproof, so the design philosophy is defence in depth plus honesty: the least-privileged architecture possible, and a plain-language page like this one telling you exactly what exists to protect.

Changes to this page

If the model ever changes — and we hope the sentence above keeps fitting in one line — this page changes with a date stamp at the top, and material changes are announced in the app at least fourteen days before they take effect, with the option to export and leave first. That's the deal.