Data Protection

1. Data Controller

The data controller for the GroMe application ("App") and the website grome.live is:

GroMe
Website: grome.live
Email: hello@grome.live

We are committed to protecting your data in accordance with the General Data Protection Regulation (GDPR) and applicable data protection laws.

For any data protection enquiries, please contact us at: hello@grome.live

2. Data We Process

GroMe processes minimal personal data. Most user data is stored locally on the device and never leaves it.

Data Stored Locally on Your Device Only

The following data is stored on-device using AsyncStorage and is not transmitted to our servers:

Challenge reflections (your written answers)
Goal progress and milestone details
Transaction history and vault records
App preferences, settings, and Parent Zone PIN

Data Processed by Our Server

Some data is periodically synced to our server for the purposes described below. This data is transmitted securely over HTTPS.

Data	Purpose	Legal Basis	Retention
Parent email address	Welcome emails, weekly progress reports, withdrawal notifications	Consent	Until consent is withdrawn
Teen name and age	Personalising progress reports sent to parents	Consent (parental)	Until consent is withdrawn or data deletion is requested
Progress data (challenges completed, mindset points, level, streak, vault balance)	Generating weekly progress reports for parents and improving the app experience	Consent (parental) and Legitimate interest	Until data deletion is requested
Device identifier	Linking progress data to the correct profile for reporting	Legitimate interest	Until data deletion is requested
Unlock code	Verifying purchase and granting app access	Contract performance	Duration of service

Weekly Progress Reports

If a parent email is provided during onboarding, GroMe sends automatic weekly progress report emails every Sunday. These reports contain the teen's name, challenge progress, mindset points, level, streak, and vault balance. Reports are enabled by default and can be disabled at any time via the Parent Zone in the app or by clicking the unsubscribe link in any report email.

3. Third-Party Data Processors

We use the following third-party services that may process limited personal data on our behalf:

Service	Purpose	Data Shared
Stripe	Payment processing for unlock code purchases	Payment details (handled directly by Stripe, we do not store card data)
Resend	Email delivery	Parent email address
Revolut	Optional method for parents to manually send approved withdrawal amounts	No data shared by GroMe; parents use their own Revolut accounts independently

Each third-party processor operates under their own privacy and data protection policies. We have ensured appropriate data processing agreements are in place.

4. Legal Basis for Processing

We process personal data based on the following legal grounds under GDPR Article 6:

Consent (Art. 6(1)(a)): Parent email for communications, teen name and age for personalised reports - freely given and withdrawable at any time via the Parent Zone or the unsubscribe link in emails
Contract performance (Art. 6(1)(b)): Processing unlock codes to provide the purchased service
Legitimate interest (Art. 6(1)(f)): Device identifier and aggregated progress data to improve the app experience, balanced against user rights

5. Children's Data Protection

GroMe is designed for teenagers aged 12-18. We take extra care to protect the data of young users:

Users under 16 require parental consent for data processing (in line with GDPR Article 8)
We collect the absolute minimum data necessary for the App to function
The majority of data remains on-device and is never transmitted
We do not profile children or use their data for marketing purposes
Parents can review, manage, and delete all data through the App at any time
We do not sell or share children's personal data with third parties

6. Your Rights Under GDPR

As a data subject, you have the following rights:

Right of access (Art. 15): Request a copy of the personal data we hold about you
Right to rectification (Art. 16): Request correction of inaccurate data
Right to erasure (Art. 17): Request deletion of your personal data ("right to be forgotten")
Right to restrict processing (Art. 18): Request limitation of how we process your data
Right to data portability (Art. 20): Receive your data in a structured, machine-readable format
Right to object (Art. 21): Object to processing based on legitimate interest
Right to withdraw consent (Art. 7(3)): Withdraw consent at any time without affecting prior processing

To exercise any of these rights, contact us at hello@grome.live. We will respond within 30 days.

7. Data Deletion

You can delete all locally stored data at any time through the App: Settings > Delete Account. This permanently removes all profiles, progress, points, and transaction history from the device.

To request deletion of any server-side data (email address, analytics), contact us at hello@grome.live.

8. Data Security

All server communications are encrypted using HTTPS/TLS
We do not store payment card details - these are handled directly by Stripe (PCI DSS compliant)
Server access is restricted and monitored
We do not use cookies or tracking technologies within the App
On-device data is sandboxed within the App and inaccessible to other applications

9. International Data Transfers

Our servers and third-party processors may be located outside the European Economic Area (EEA). Where data is transferred outside the EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) where applicable.

10. Data Breach Notification

In the unlikely event of a personal data breach, we will:

Notify the relevant supervisory authority within 72 hours where feasible (GDPR Article 33)
Notify affected individuals without undue delay if the breach poses a high risk to their rights (GDPR Article 34)

11. Changes to This Policy

We may update this Data Protection policy from time to time. Material changes will be communicated through the App or via email to registered parents. Continued use of the App after changes constitutes acceptance of the updated policy.

12. Complaints

If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local data protection supervisory authority.

See also our Privacy Policy and Terms of Service.

Last updated: March 2026