Privacy Policy

Last updated: September 27, 2026

This policy explains what personal data GROTD Commerce LLC ("we", "us") processes when you visit grotdcommerce.com or use our apps, why we do it and what rights you have. We keep data to the minimum our products need.

1. Who is responsible

GROTD Commerce LLC, 539 W. Commerce St #5752, Dallas, TX 75208, USA. Email: contact@grotdcommerce.com. For all privacy questions, write to this address.

2. This website

Hosting and server logs

The website is hosted on a server of Hetzner Online GmbH in Germany. When you open a page, the server technically processes your IP address, the page requested, date and time, and your browser type. We use this only to deliver the site and keep it secure. The website itself stores no access logs; any technical logs are deleted within 14 days. Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).

No cookies, no tracking

We do not set cookies and do not use analytics, advertising or social media plugins on this website. Fonts and scripts are served from our own server, so no data is sent to third parties such as Google.

Email

If you email us, we use your address and message only to answer you. Our mailbox is hosted by Zoho Corporation in its EU data center. We delete messages when they are no longer needed, unless we must keep them for legal reasons.

3. Our apps

This section covers our iOS apps, currently Carebud. We update it whenever the app changes.

Data stored on your device

Your routines, tasks, streaks, journal and pet live on your iPhone. They are shared only with Carebud's own widgets and Live Activities on the same device. We do not upload them to our servers. Reminders are scheduled on your device by iOS.

Anonymous app ID

Carebud has no sign up and no password. When the app starts, it creates a random anonymous ID with our backend provider Supabase (EU, Frankfurt). This ID is not linked to your name, email or Apple ID. We use it to check your subscription, to apply fair use limits to the brain dump and to group analytics events. The same ID is used with RevenueCat and PostHog.

AI brain dump

When you use the brain dump, the text you type or dictate is sent through our server (Supabase) to OpenAI (OpenAI, L.L.C., USA), whose GPT model turns it into tasks and sends the result back. Neither we nor OpenAI use your content to train AI models, and we ask OpenAI not to store the request. We do not store or log the text. To prevent abuse we keep daily usage counts per anonymous ID and a salted hash of your IP address (never the address itself), and delete them after two days. OpenAI may keep requests for up to 30 days for safety and abuse monitoring under its API terms, never for training. Voice input is converted to text by Apple's speech recognition, on your device where your iPhone supports it; otherwise Apple processes the audio under Apple's privacy policy. Before the first brain dump, the app asks for your consent. You can withdraw it anytime in the app settings ("Withdraw AI consent for brain dump"); after that no text is sent until you agree again.

Subscriptions

Purchases are handled by Apple. We never see your payment details. We use RevenueCat to check whether your subscription is active; it receives the anonymous app ID and your purchase status from Apple.

Product analytics and crash reports

To understand which features help and where the app breaks, we collect pseudonymous usage events (for example "routine completed" or "paywall shown") and crash reports with PostHog, using its EU hosting. Events contain the anonymous app ID, the app version, device model, iOS version and language. They never contain the text of your routines, tasks or brain dumps, or your pet's name. PostHog discards your IP address and does not determine your location. We do not record your screen. Analytics only run if you agree: the app asks you once during setup, and nothing is sent before you answer or if you say no. You can change your choice in the app settings at any time.

Deleting your data

"Delete all data" in the app settings removes everything on your device, deletes your anonymous ID and usage counts on our server and your subscription record at RevenueCat, and starts a new analytics ID. If you are offline, the app finishes the deletion the next time it connects. Your subscription keeps running until you cancel it in your Apple account settings.

Legal bases

We process app data to provide the features you use (Art. 6(1)(b) GDPR) and, for analytics and crash reports, based on your consent (Art. 6(1)(a) GDPR), which you can withdraw in the app settings at any time. For the AI brain dump we ask for your consent before any text is sent.

4. Service providers and transfers

We only work with providers that need data to run our products: Hetzner (website hosting, Germany), Zoho (email, EU), Supabase (app backend, EU), OpenAI (AI model for the brain dump, USA), RevenueCat (subscription status), PostHog (analytics and crash reports, EU) and Apple (App Store). Some of them may process data outside the EU, for example in the USA. Where this happens we rely on the EU Standard Contractual Clauses or an adequacy decision. Each provider is bound by contract to protect your data at least as well as described in this policy and to use it only to provide its service to us.

5. Your rights

You can ask us for access to your data, correction, deletion, restriction of processing and data portability, and you can object to processing based on legitimate interests. If you are in the EU, you may also complain to a data protection authority. California residents have similar rights under the CCPA. We do not sell or share personal information for advertising. To use any right, email contact@grotdcommerce.com.

6. Children

Our website and apps are not directed at children under 13 (under 16 in the EU), and we do not knowingly collect their data.

7. Changes

We will update this policy when our products change. The date at the top always shows the latest version.