Privacy Policy

Grove holds information about you — the account you signed up with — and information about your clients, which you put in yourself while running your business.

The distinction matters. Your account information is between you and us. Your client information is yours: you decide what to record, we store it and show it back to you, and we do not use it for anything else. You are responsible for having the right to record it and for what you share with a client through their portal.

When you create an account, Grove stores:

• your name and email address
• your business profile — business name, contact details, address and logo, if you add them
• your settings: invoice numbering and tax defaults, notification preferences, and appearance choices
• which workspace you belong to, and your role in it

This is the bulk of what Grove holds, and all of it is entered by you:

• clients and leads — names, contact details, company details, status and the notes you write
• projects, tasks, milestones, deliverables and revisions
• proposals, contracts and the signatures recorded against them — a signer's name, the typed signature, and when it was signed
• invoices, line items and the payment records you mark against them
• meetings, calendar entries and time entries
• activity history and notifications generated as you work

Grove keeps a record of who each item belongs to so that one workspace’s data can never appear in another’s. Notes you mark as internal are never shown in a client portal.

Files you attach to a client or a project — documents, deliverables, images — are stored in a private storage bucket. They are not publicly listed and are not readable by an anonymous request; access goes through your signed-in session, or through a portal link for a file you have chosen to share with that client. Deleting a file in Grove removes it from storage.

Sign-in is handled by Supabase Auth. It holds your email address and a hashed version of your password — Grove never stores or sees your password in plain text — along with the tokens used to confirm your email address or reset your password, and timestamps for events like your last sign-in.

Client portal links are stored as a hash rather than as the link itself, together with when the link expires, whether it has been revoked, and when it was last used.

When you send an invoice, proposal, contract or portal invitation, Grove passes the recipient’s email address and the contents of that message to Resend, which delivers it. Grove records in your workspace that the message was sent, to which client, and when.

Grove’s own server logs deliberately exclude the recipient’s address, the portal link and the message body — a portal link is a credential, so it is never written to a log.

Grove sends transactional email only: messages you trigger to your own clients, and account email such as confirmation and password resets. It does not send marketing email, and it does not sell or share your list.

Grove’s own database does not store IP addresses or browser fingerprints against your account. Ordinary web request data — IP address, browser type, the page requested, timestamps — is handled by the infrastructure Grove runs on, as it is for any website, and is used for delivering the service, diagnosing faults and protecting it from abuse.

Grove includes no analytics package, no advertising pixels and no third-party tracking scripts. Fonts are served from Grove’s own domain, so loading a page does not call out to another company.

Everything above is used to provide Grove to you. Specifically:

• to sign you in and keep your session going
• to store, display and connect the records you create — so an invoice knows its client, and a report knows its invoices
• to send the messages you ask Grove to send, and the account email you need to use it
• to keep the service running: diagnosing errors, fixing faults, and protecting it from abuse
• to reply to you when you contact support

Your data is not used to train machine-learning models, is not used to build a profile of you, and is not used for advertising.

Grove does not sell your data to advertisers or data brokers, and does not share it for advertising purposes. It is shared only with the infrastructure providers that make the service work:

Each of these providers publishes its own privacy terms and processes data on Grove’s instructions. We may also disclose data where the law requires it. If we ever add another provider that handles your data, this list is where it will appear.

No payment processor is connected to Grove, so no card details are collected or handled anywhere in the product. Google Calendar synchronisation is not enabled in production, so no data is exchanged with Google.

Grove is built so that a workspace can only reach its own records:

• every table has row-level security, and every query runs as your signed-in user under those rules
• file storage is private, and file access is authorised per request
• the administrative key that can bypass those rules is server-side only, and is used in a small number of audited places where there is no signed-in user to act as — such as resolving a client portal link
• portal links are stored hashed, expire, and can be revoked
• traffic to Grove is encrypted in transit, and passwords are stored hashed by the authentication provider
• isolation between workspaces is covered by an automated test suite that runs against both the local and the hosted database

No system is perfectly secure, and we do not claim otherwise. Grove is not certified under any security or privacy standard, and this page should not be read as a claim of compliance with any particular regulation. If we become aware of a breach affecting your data, we will tell you.

Grove uses browser storage for two things, and nothing else:

• a cookie that holds your sign-in session, so you stay signed in as you move between pages — without it you could not use Grove at all
• local storage for interface preferences, such as whether the sidebar is collapsed and how you have arranged the Blueprint

There are no advertising cookies, no analytics cookies and no third-party trackers, so there is nothing here to consent to or opt out of. If you open the public demo workspace, that demo data is kept in your own browser and never reaches our database.

Your data is kept for as long as your account is open, because it is the working record of your business. You can remove individual records — projects, invoices, files and the rest — from within Grove at any time, and removal takes effect immediately. A few records are archived rather than deleted while other work still references them; a client with projects attached is archived, so the history of that work stays intact.

Grove does not yet have a self-service “delete my account” button. To have your account and everything in it deleted, email hello@usegrove.space from your account address and we will remove it. Deletion is permanent — export or copy anything you need first. Backups held by our infrastructure providers may retain a copy for a short period before they age out.

You can ask us to:

• tell you what data Grove holds about you
• give you a copy of it
• correct anything that is wrong — most of it you can edit yourself in Settings
• delete your account and its data

Email hello@usegrove.space from your account address and we will respond as quickly as we reasonably can. You may also have rights under the law where you live; this page does not limit them.

If a request concerns one of your clients rather than you, we will point them back to you: the data is in your workspace, and you are the one who can act on it.

Grove is in early access and is still being built. When what it does with data changes, this page changes with it and the effective date at the top is updated. Material changes are announced to account holders by email or in the product. The Terms of Service sit alongside this policy.