Privacy Policy

Version 1.0 (draft) — last updated: November 6, 2026

Version française

Translation provided for information only; only the French version is legally binding.

Draft version, pending legal review before final publication.

This policy explains which personal data the Grow mobile app (the “Service”) processes, why, with which providers, for how long, and how to exercise your rights. It is drawn up in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act (loi Informatique et Libertés).

In short: we only process data needed for the Service; your notes are private; we do not sell your data; Grow shows no ads, does not track you across apps and does not use your device's advertising identifier; you can delete your account and data at any time from the app.

1. Controller

• ELISEE NELSON BANGYA NOUPET, publisher of the Grow app;
• postal address: [TO BE COMPLETED];
• contact: contact@wegrowtoday.com.

2. Data we process

2.1 Account and sign-in

• Email address and password (the password is managed by Firebase Authentication and is never stored in clear text by Grow); or Apple or Google sign-in identifier and the associated email address (possibly hidden by Apple).
• Technical account identifier (uid) assigned by Firebase.

2.2 Profile (optional)

• Display name, first name, last name, short bio, city, country, profile photo, preferred translation language.
• Church or community, if you provide it (see § 2.8).
• New-video notification preference.

2.3 Your content

• Channels, videos, links and playlists you add; books and files you import, with their annotations and summaries; book catalogs you add.
• Sermon notes and their exports, video frame captures.
• Tracker: actions to put into practice, themes and reminders.
• Private transcripts of your files, and content reports you send.

2.4 Artificial intelligence processing

• To produce summaries, translations and written sermons, the relevant text (transcript of a teaching, excerpt from a book, instructions) is sent to Google's Gemini model (Vertex AI, through Firebase AI Logic).
• To transcribe a video without captions or a file, its audio may be processed by our servers (Cloud Run, Cloud Functions) and by Gemini; transcription may also be done directly on your device.
• Transcripts and summaries of public teachings (public videos) are cached and shared between users, without any link to your account.

2.5 Subscription

• Premium subscription status (plan, dates, renewal, billing issue) and technical transaction identifiers provided by Apple, Google and RevenueCat; free trials used and processing quotas.
• We never receive your payment card details: payment is processed by Apple or Google.

2.6 Device and technical data

• Notification token (Firebase Cloud Messaging), if you allow notifications.
• App integrity attestations (Firebase App Check: App Attest on iOS, Play Integrity on Android), which protect our services against calls from outside the app.
• Server technical logs (date, time, IP address, request, error), without the content of your notes.

The following stay on your device and are not sent to us: the local database (cache and search), your settings, downloaded reading voices, on-device translation (ML Kit) and text recognition of scanned pages.

2.7 Audience measurement (optional, with your consent)

If you accept (prompt at the end of the introduction, “Optional usage measurement” setting in your profile), Grow measures app usage with Growth OS, our own measurement tool: screens viewed, journey steps (introduction completed, account created, channel added, content processed, summary viewed, Tracker application added or checked, Premium offer shown, purchase started or confirmed) and technical information (app version and build, platform, OS version, language, environment).

• A random installation identifier, generated on the device and renewed at sign-out, when you change accounts or when you withdraw your consent.
• Account pseudonym: when you are signed in, our servers compute it from your Firebase account identifier, verified through the ID token (SHA-256 hash with a secret salt). Neither your account identifier, nor your email, nor your name is stored in the measurement. This pseudonym links your usage to your subscriptions (RevenueCat data processed under the same pseudonym) to understand what leads to a subscription.
• Never sent: the text of summaries and notes, titles, URLs, video, book or channel identifiers, your contact details, amounts paid.

Without your consent, no event is sent. Declining has no effect on your use of Grow. You can withdraw your consent at any time in your profile: sending stops, and the pending event queue and the installation identifier are erased from the device.

2.8 Sensitive data

The “Church” field, your notes and the teachings you follow may reveal your religious beliefs (special category of data, Article 9 GDPR). This field is optional; this data stays private and is never used for advertising or sold. [TO BE VALIDATED: legal basis adopted, see § 4.]

3. Purposes

• Creating and securing your account, signing you in.
• Providing the Service: playing teachings, transcription, summaries, translation, notes, Tracker, library, sync across your devices.
• Managing the Premium subscription and free trials.
• Sending you the notifications you have chosen (new videos from your channels, summary ready, trials renewed, Tracker reminder).
• Ensuring the security of the Service, preventing fraud and abuse, handling reports and your support requests.
• Measuring audience and app usage, with your consent, to improve it and understand the journeys that lead to a subscription (internal statistics, no advertising or resale).
• Complying with our legal obligations.

4. Legal bases

• Performance of a contract (Art. 6(1)(b) GDPR): account, Service, sync, subscription, service notifications.
• Consent (Art. 6(1)(a), and Art. 82 of the French Data Protection Act for reading and writing information on the device): notifications (your device's permission), optional profile fields, Growth OS audience measurement. You can withdraw it at any time, without affecting your use of the Service.
• Legitimate interest (Art. 6(1)(f)): security, abuse prevention (App Check, quotas), technical logs.
• Legal obligation (Art. 6(1)(c)): answering authorized authorities.
• Data revealing religious beliefs: [TO BE VALIDATED after legal advice: explicit consent, Art. 9(2)(a)].

5. Providers (processors) and recipients

We do not sell or rent your data. It may be disclosed to authorities when required by law.

6. Transfers outside the European Union

Some providers (RevenueCat, Google, Apple) may process data in the United States or elsewhere outside the EU; Gemini models are called on the Vertex AI global endpoint. These transfers are governed by the EU–US Data Privacy Framework for certified companies or by the European Commission's standard contractual clauses. [TO BE VALIDATED.]

7. Retention periods

• Account, profile and content: as long as the account exists. When the account is deleted, the data linked to your account (Firestore and Storage: profile, notes, library, Tracker, captures, devices, subscription, quotas, reports sent) is erased immediately by our servers, then the account is deleted.
• Backups: [TO BE COMPLETED: rotation period, if applicable].
• Notification tokens: removed at sign-out or account deletion.
• Temporary media (audio downloaded for server transcription): deleted after processing or when they expire.
• Technical logs: 30 days (Cloud Logging default period).
• Growth OS audience measurement: 25 months from collection [TO BE VALIDATED], then deleted or aggregated anonymously. On the device, the queue and the installation identifier are erased when you withdraw your consent. You can ask us to erase events already received at contact@wegrowtoday.com [TO BE VALIDATED: automatic erasure upon account deletion].
• Shared caches of transcripts and summaries of public videos: kept without any link to an account.
• Subscription data held by RevenueCat, Apple and Google: according to their own policies and accounting obligations.

8. Your rights

You have the rights of access, rectification, erasure, restriction, portability and objection, the right to withdraw your consent at any time and the right to set instructions regarding the fate of your data after your death.

• In the app: edit your profile, your notifications, or delete your account (My profile → Delete my account; see Account deletion).
• By email: contact@wegrowtoday.com.

We answer within one month, extendable by two months for a complex request. We may ask you to confirm your identity. Deleting your account does not cancel your subscription: cancel it in your store settings.

You may lodge a complaint with the CNIL (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr) or with the data protection authority of your country.

9. Minors

The Service is intended for people aged 15 and over [TO BE VALIDATED]. Younger users need the consent of a holder of parental authority. If a minor has sent us data without this consent, contact us: we will delete it.

10. Security

Encrypted connections (HTTPS/TLS), Firestore and Storage access rules restricting each account to its own data, App Check against calls from outside the app, no logging of the content of your notes. Since no system is perfectly secure, we will inform you, as well as the competent authority, in the event of a breach presenting a risk.

11. Trackers

The app uses no cookies or advertising trackers. It stores on your device the items needed for it to work (session, settings, cache, last campaign of an opened wegrowtoday.com link, with no personal data) and, only with your consent, the installation identifier and the queue of the Growth OS audience measurement (§ 2.7). This website sets no cookies.

12. Changes

We may change this policy; the date of the last update appears at the top. In the event of a significant change, we will inform you in the app before it takes effect.

13. Contact

ELISEE NELSON BANGYA NOUPET — contact@wegrowtoday.com — [TO BE COMPLETED: postal address].