GrowMate

Privacy Policy

Last updated: 4 September 2026

GrowMate is a small, self-hosted strength-training app run by one person (Daan) on a single server (VPS) — not by a company, and not on a big cloud platform. This page explains, in plain language, what personal data GrowMate processes, why, on what legal basis, for how long, who can see it, and what rights you have. It is written to meet the requirements of the EU General Data Protection Regulation (GDPR — in Dutch: AVG).

Who is responsible for your data

Daan Kingma is the controller for GrowMate. Reach him at daankingma27@gmail.com for anything in this policy — a question, a correction, or a complaint. GrowMate is a personal project, not a registered company, so there is no separate business address or Chamber of Commerce number.

What we process, why, and on what legal basis

Data	Purpose	Legal basis
Email address, name, username, password (as a scrypt hash, never the plain text)	Create and secure your account, let you sign in on any device, send account emails (activation, password reset)	Performance of a contract — you asked for an account, this is what makes it work
Phone number (optional)	Let people who already have your number find you on GrowMate	Performance of a contract (you choose to add it when you register)
Workouts, sets, weights, reps, body measurements, your plan, progress photos	The core of the app: track and plan your training	Performance of a contract
Groups, posted sessions, friend list	Train together, share sessions with people you choose	Performance of a contract
Hashes of phone numbers/emails from your phone's contacts	Find which of your contacts already use GrowMate, so you can add them as GrowMates	Your explicit consent, asked for every time, right before your phone's contact picker opens — see "Find GrowMates in your contacts" in the app
Session cookie, CSRF token, sign-in IP address (kept only in short-lived, in-memory rate-limit counters, never written to disk)	Keep you signed in, protect the login/registration/password-reset forms against abuse	Performance of a contract, together with our legitimate interest in keeping the service secure and available

Where it lives

Everything is stored on the one VPS that runs GrowMate, in plain files under /root/GROWMATE/data/ — never at Google, Meta, Amazon, or an advertising network, and never shared with, sold to, or profiled for anyone else.

How long we keep it

Account and training data — for as long as your account exists. Delete your account from the app ("Delete my account for good") and your account, sessions, training data and photos are removed immediately, the same second.
Password-reset and account-activation links — expire automatically after 1 hour, or immediately after use, whichever comes first.
Contact-matching hashes — never stored. They exist only for the length of that one request, to compare against existing accounts, and are discarded straight after.
Outgoing account emails — while there is no mail server configured yet, activation and reset emails are written to a local outbox file instead of being sent; those files are deleted once a mail server is set up and are not kept beyond that transition.

Who else can see it — processors

Nobody processes your data on our behalf except:

Ourselves — Daan runs and administers the server GrowMate lives on. No other person or company has access.
Let's Encrypt — issues the TLS certificate that makes the connection to GrowMate secure (https). Let's Encrypt only ever sees the domain name being requested, never any of your account or training data.

Google Fonts is not used or contacted: as of 4 September 2026 the two typefaces this site and the app use are hosted on this same server (assets/fonts/), so no font request — or any other request — leaves this server when you use GrowMate.

Your rights

Under the GDPR/AVG you have the right to:

Access — see what we have on you. Use "Download everything I have" in the app, or email us.
Rectification — correct anything that's wrong. Most fields you can edit yourself in the app; email us for anything you can't.
Erasure — have your account and everything in it deleted. Use "Delete my account for good" in the app, or email us.
Data portability — get your data in a portable, machine-readable format. "Download everything I have" exports a JSON file with everything.
Object — object to processing you disagree with, including withdrawing consent for contact-matching at any time (simply don't use that feature again — nothing is stored from earlier uses).

To exercise the rights that aren't self-service in the app, email daankingma27@gmail.com. We aim to respond within a month, as the GDPR requires. If you're unhappy with how we handle your data or your request, you can lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens.

Security

Passwords are stored only as a scrypt hash, never as plain text — not even we can read them back. Data on the server is only readable by the account that runs GrowMate. The connection between your device and the server is encrypted (https).

GrowMate is a personal project, not a commercial service. This policy describes exactly how it works today and will be updated if that changes — the core promise (no tracking, no resale, your data stays on this one server, no outside connections) won't change without this page being updated to say so first.