Legal

Privacy Policy

Version 2026-10-03. This policy explains what Grow ("we") collects when you use Grow and why.

1. What we collect

Account data: your email address and a salted hash of your password (we cannot read your password), plus your plan, credit balance, and the date you accepted these terms.
Photos: the photo you upload for each batch and the AI-generated images created from it, plus the style you chose and when. These are linked to your account so you can see your history.
Technical data: the IP address used when you sign up and in server logs (used for abuse prevention such as limiting free accounts per network), and basic request logs.
Payment data: handled by Stripe. We store your Stripe customer ID, subscription status and renewal dates, but never your full card details.

2. How we use your photos

Your uploaded photo is used only to generate the images you asked for. It is sent over an encrypted connection to our AI image-generation provider (currently Atlas Cloud, which runs image models from model developers such as ByteDance and Google) so the images can be created. We do not use your photos to train our own models, do not post anything on your behalf, and do not show your photos or results to other users. Please review our provider's own terms for how they handle API inputs. Only upload photos you have the right to use (see the photo consent and acceptable use rules).

3. Why we use your data

To provide the Service (accounts, credits, generating and storing your batches), to take payment, to send service emails (email verification, password reset, receipts), to keep the Service secure and prevent abuse, and to meet legal obligations.

Only service providers that help us run the Service: the AI image provider above; Stripe (payments); our email provider (Resend or an SMTP provider) for service emails; and our hosting and network providers (including Cloudflare). We do not sell your personal data. We may disclose data if required by law or to protect against abuse.

5. Cookies

We use one strictly necessary cookie (sid) that keeps you logged in. It is httpOnly and lasts up to 30 days. We do not use advertising or analytics cookies. Stripe may set its own cookies on its hosted checkout and billing pages.

6. How long we keep data

We keep your account, uploaded photos and results until you ask us to delete them or delete your account, so your history stays available. Payment records are kept as long as the law requires. Password-reset and email-verification links are single-use and expire after 1 hour and 48 hours respectively.

7. Your choices and rights

You can ask us at any time to access, correct, export or delete your data (including your uploaded photos and results) by contacting the support contact shown on your payment receipt or in your account. Depending on where you live (for example the EU/UK or California) you may have additional legal rights, and you may also complain to your local data protection authority. Cancelling a subscription is done from your account page.

8. Security

Passwords are hashed, sessions use httpOnly cookies, photos are only served to the account that owns them, and traffic is encrypted in transit. No system is perfectly secure, so please use a strong, unique password.

9. Children

The Service is for people aged 18 and over. Do not upload photos of children. If you believe a child's data has been submitted, contact the support contact shown on your payment receipt or in your account and we will delete it.

10. Changes and contact

We will update this page if our practices change and revise the version date above. Questions: the support contact shown on your payment receipt or in your account.