Privacy Policy
We take your family's privacy seriously. This policy explains what we collect, how we use it, and how we protect it.
We take your family's privacy seriously. This policy explains what we collect, how we use it, and how we protect it.
What changes on December 18, 2026. We are updating this policy for the next version of GrowTide (GrowTide 2.0). We collect the new kinds of information below only from December 18, 2026, and only once the feature that uses them is available in your family's version of the app. In this policy they are marked (2.0). In short:
What does not change: we never show ads in the app, never sell data, never build behavioral profiles of children, and never use a child's name or anything a child does in the app to sell GrowTide Pro.
This Privacy Policy applies to the GrowTide mobile application and the growtide.app website (together, the "Services"), owned and operated by Manus Labs LLC ("we," "us," or "our"), a limited liability company registered in Utah, USA. By using the Services, you agree to the practices described in this policy.
Questions? Contact us at support@growtide.app.
GrowTide is a family chore and rewards application designed for families: parents and their children. The Services are operated by:
For purposes of the EU and UK General Data Protection Regulation (GDPR / UK GDPR), Manus Labs LLC is the "data controller" of the personal information processed through the Services. This means we determine the purposes and means of processing your data and are responsible for handling your privacy rights requests. Where we use third parties to process data on our behalf — such as Google Firebase and RevenueCat — those parties act as our "data processors" and are bound by written data processing agreements (see Section 6).
Data minimization principle: We only collect personal information that is reasonably necessary to provide the Services. We do not condition a child's participation in the Services on the disclosure of more personal information than is reasonably necessary. This principle is required under 16 CFR § 312.7 (the COPPA Rule) and applies to all data we collect from or about children.
What we do NOT collect: GrowTide does not collect biometric identifiers of any kind — including facial recognition data, voiceprints, fingerprints (beyond local device biometric unlock, which never leaves the device), retinal scans, gait patterns, or any other biometric data. We do not collect geolocation data from child accounts. We do not collect audio or video recordings. These categories of Personal Information, as defined under the 2026 amendments to the Children's Online Privacy Protection Act, are outside the scope of our data collection entirely.
New in GrowTide 2.0. Items marked (2.0) belong to the next version of GrowTide. We collect them only from December 18, 2026, and only once the feature that uses them is available in your family's version of the app. For a family that already uses GrowTide, the children's items also wait until a parent agrees to the updated notice (Section 7). Everything not marked describes what the app does today.
All child profiles are created and managed exclusively by a parent or guardian. We collect the following data for each child profile:
When you visit growtide.app, we may collect:
Marketing emails are consent-based. We send marketing emails only where you have provided consent, and you may withdraw that consent at any time by using the unsubscribe link in any email or by emailing support@growtide.app. Where required by applicable law, we obtain your consent through a clear affirmative action (such as checking an unchecked box) before sending marketing communications. We do not pre-tick consent boxes. Subscribing to the GrowTide blog is itself the affirmative action that grants consent to receive new blog posts by email. Requesting the printable chore chart does not subscribe you to the blog; only the unticked box on that form does.
Personal feedback emails are not list emails. The occasional feedback emails our founder may send to a parent who has a GrowTide account (Section 4) are written to one parent at a time and are never sent to a mailing list. Receiving one never adds you to the blog list, a newsletter, or any other list. We rely on legitimate interests for them rather than consent (Section 10), and you can stop them at any time by replying "stop".
Website tracking does not extend into the GrowTide app. The app and the website are separate environments with separate data practices.
The growtide.app website is directed at parents, not children. The website is a marketing and informational site intended for parents considering the app. Child profiles exist only inside the app itself, which has no advertising pixels, no website tracking, and no external analytics for child-linked devices.
The table below sets out which data elements are required to use the Services, why we need them, and what happens if you choose not to provide them. This disclosure is provided under GDPR Article 13(2)(e):
| Data type | Required? | Why we collect it | If not provided |
|---|---|---|---|
| Parent email address | Required | Account login, password reset, family invitations | Cannot create or access an account |
| Parent password | Required for email sign-up (not used with Google or Apple sign-in) | Account authentication via Firebase Authentication | Cannot create or access an account |
| Family name or label | Optional | Display label inside the app | A default label is used |
| Child first name or display name | Required for each child profile | Identifies the child profile inside the app | Cannot create a child profile |
| Child date of birth; (2.0) replaced by an age band (6–7, 8–10, 11–13, 14–17) | Optional | Birthday display and age-appropriate features; (2.0) age-appropriate defaults, such as the child's home layout | Profile still works; no age-based defaults applied |
| Child avatar | Optional (default provided) | Visual identification of the child profile | A default avatar is used |
| Child avatar photo | Optional (GrowTide Pro; parent-approved) | Lets a child use a photo of themselves as their profile avatar, displayed only within the family | Built-in avatars are used |
| Job completion photos | Optional | Proof of completion if the parent requires it for a given job | Job can still be submitted without a photo when not required |
| Push notification token | Optional (granted at the OS level) | Reminders, approvals, screen time alerts | No push notifications; in-app features still work |
| (2.0) Notification settings and children's reminder times | Optional (defaults apply) | Send each grown-up only the notifications they want, and remind a child at the time a grown-up chose | Default settings are used; reminders to children stay off |
| (2.0) "How did you hear about GrowTide?" answer (grown-ups only) | Optional (skippable) | Understand which channels bring families to GrowTide | Nothing changes in the app |
| (2.0) Email tips and GrowTide news opt-in (grown-ups only, in the app) | Optional (unticked box, confirmed by email) | Send tips and GrowTide news by email, if you ask for them | No marketing emails; the app works the same |
| Child PIN (shared-device profile switching) | Optional | Profile separation on a shared family device | Profile switching is immediate without a PIN |
| Parent PIN | Optional | Protects parent dashboard access on a shared device | Dashboard opens without a PIN prompt |
| Subscription / payment data | Required only for paid features | Process subscription via the App Store / Google Play and RevenueCat | Free-tier features remain available; paid features are gated |
| Blog subscription email (growtide.app website) | Optional | Send new blog posts by email, if you subscribe | No marketing emails; you can still browse the site |
| Printable chore chart email (growtide.app website) | Optional | Tell you when the printable chore chart changes or a new printable comes out | No update emails; the chart still downloads on the page |
Where required by law in certain jurisdictions — currently including Texas, Utah, and Louisiana in the United States, and Brazil — app stores provide age-related signals to help developers meet age-verification and parental-approval obligations. When you use GrowTide on a device in one of these jurisdictions, Google Play may provide us with the following age signals about the Google account on that device:
These signals concern the Google account on the device — in the overwhelming majority of GrowTide installations, the parent who downloads and sets up the app. We store the verification status, age range, and install identifier on the family record solely as a record of compliance. On Android, if Google Play reports that a supervised account's parental approval is pending or has been denied, or that the account's age status is unknown, the app shows a screen that blocks access until that is resolved. We use these signals for nothing else. We do not use age signals for advertising, profiling, or any purpose other than legal compliance. Outside the applicable jurisdictions, and on devices not installed through Google Play, no age signals are returned and none are stored.
Apple devices. Apple offers developers a similar signal, the Declared Age Range. GrowTide does not currently request it, and we receive and store no age signal from Apple. If we start using it, we will update this section — saying what we receive, what we store, and that it is used only for legal compliance — and give notice under Section 17 before we do.
The website hosts a public feedback board at growtide.app/feedback.html where visitors can post feature requests and problems and upvote other people's posts. It is part of the marketing website and is not part of the GrowTide app; no app or child data is connected to it, and no sign-in is required to read, post, or vote.
Moderation. Posts appear on the board immediately, and we review them afterwards. We remove anything profane, abusive, off-topic, spam, or containing personal information about a child. We may also mark a post with a status (for example, Planned or Shipped) so the board doubles as a public roadmap.
Removing your post. Email support@growtide.app with the wording of your post and we will delete it and its votes. Because posts are anonymous, please contact us from the email address you supplied with the post where possible, or quote the post so we can identify it.
If a partner, blog, newsletter or podcast gives you a GrowTide promo code, you redeem it at growtide.app/redeem rather than inside the app. The page asks for two things: the email address of your existing GrowTide account, and the code. We then email that address a one-time confirmation link, and GrowTide Pro is switched on only after you open the link and confirm.
GrowTide is designed for shared family use. Adults in the same family — parents, legal guardians, and other adults a parent invites, for example a grandparent or a nanny — have equal visibility into that family's activity. Any adult in the family can help manage jobs, approvals, and rewards. Under our Terms of Service, only a parent or legal guardian may give consent for a child, add a child profile, hold the Owner role, or delete the family (Section 7). This section describes what information is shared between those adults, and what is shared with children.
Visible to every adult in the same family:
Visible to children in the family:
The Owner role, described in our Terms of Service, determines which adult manages the family's subscription and roster. It does not change what any adult or child can see within the family.
(2.0) Messages that adapt to your family's progress. The messages GrowTide shows grown-ups — banners, tips, empty screens, notifications, and offers of GrowTide Pro — are picked for where your family is. For example, a tip about linking a child's device appears only to families that have not linked one yet, and a reminder to approve a job appears only when a job is waiting. To pick them, the app reads your family's own data, including the jobs your children did. The choice is made on the device from a fixed set of rules and written messages; it is not a profile, it is not sent to anyone, and it never changes what a child can do. Messages and notifications in the app are never written by an AI.
Automatic approval. A grown-up can turn on automatic approval for a child, so that child's jobs are approved without waiting for a person. It is off until a grown-up turns it on. (2.0) The grown-up also picks a waiting time (for example, 24 hours), and automatic approval follows only the rules that grown-up set: jobs that need a photo, or that a grown-up marked to always check, keep waiting for a person. When a job is approved automatically, the coins, XP, or allowance amounts a grown-up set for that job are credited. (2.0) The job is labeled as approved automatically, and any grown-up in the family can send it back for 7 days, which reverses what was credited. A grown-up can turn automatic approval off at any time in Settings.
Feedback emails from our founder. Now and then, GrowTide's founder may email a parent who has a GrowTide account to ask how the app is working for their family. The email asks a few short questions that you can answer by replying to it. It may offer a GrowTide benefit, such as free Pro access or keeping your current price, as a thank-you for your feedback. The benefit never depends on what you say, good or bad.
Support emails. When you write to support@growtide.app or hello@growtide.app, our founder may use the same AI assistant to help read your message and draft the reply (Section 6h). Our inbox itself is provided by Google (Section 6i). He reviews every reply and sends it himself; no reply is sent automatically. Please include only what we need to help you.
We may run paid ads on platforms such as Meta (Facebook/Instagram) and Google to reach parents who may benefit from GrowTide. We do not load any third-party advertising tracking script on growtide.app. The website loads no third-party analytics script either: we measure it only through the tracked-link records and daily totals described in Sections 2d and 2g, none of which holds an identifier, and through standard web server logs. For app install attribution we rely only on the platforms' own privacy-preserving mechanisms and first-party reporting; no personal data is shared with these platforms for attribution.
Separate consent for any future targeted advertising: If we ever introduce any form of targeted advertising that would involve a child's personal information, we would be required under the 2026 amendments to the Children's Online Privacy Protection Act to obtain separate, specific, verifiable parental consent — distinct from general consent to the Services. We have no present or planned use case that would require this, but we disclose the safeguard for transparency.
We use the third parties listed below to operate the Services. Each acts as our data processor (processing data only on our written instructions and only for the purposes set out below) except where noted as an independent controller or as a provider that acts under its own terms (Sections 6c, 6f, 6h and 6i). None of these parties is permitted to use your data for their own marketing or to sell it. Each processor is bound by a written data processing agreement that obligates them to maintain appropriate technical and organizational safeguards for the personal information they handle on our behalf.
We remain responsible for the processing of your personal data by our service providers acting on our behalf.
assets.mailerlite.com domain in connection with that submission; we do not set MailerLite cookies on the growtide.app domain — MailerLite Privacy PolicyThe growtide.app website does not load Meta Pixel, Google Ads tags, Google Analytics, Google Tag Manager, or any other third-party advertising or analytics SDK. If we ever add such a tool, we will update this Section and Section 13 before it goes live.
We do not sell your data to any third party. We do not use any advertising SDK inside the GrowTide app. We rely on the written assurances of each processor named above as part of our compliance with COPPA, the GDPR, and other applicable data protection law.
GrowTide is designed for families. A parent or legal guardian decides, at their discretion, which children to add. Every child under 13 is covered by this section: nothing is collected before verifiable parental consent. A parent may add a child aged 18 or older only if that person agrees; their data is handled like a child's in the family, and they can ask us directly to see or delete it.
We collect personal information about children only after obtaining verifiable parental consent. Children cannot create GrowTide accounts on their own. All data about a child is provided and managed by an authenticated parent or legal guardian who has set up the family account.
The consent mechanism we use is: a parent first creates an account through Firebase Authentication, either with an email address and password or by signing in with Google or Apple, and is then shown a non-dismissible direct notice describing what we collect from children, how we use it, and the parent's rights. The parent must affirmatively proceed past that notice before any child profile can be created. This combination of parent-only authentication plus an affirmative direct-notice acknowledgment is the verifiable parental consent on which we rely.
Confirmation email. From December 18, 2026, after a parent agrees to the direct notice — before the family's first child profile is created, and on the one-time in-app card that asks existing families to agree to new kinds of child data — we email that parent a confirmation. It sets out what they agreed to and how to withdraw consent at any time: in the app, delete your child's profile (Settings, then Children, then the menu on your child's card, then Delete) or the whole family (Settings, then Delete Family or Delete Account), or email support@growtide.app. The email does not include a child's name.
Who can give consent. Under our Terms of Service, only a parent or legal guardian may agree to the direct notice, add a child profile, or delete the family. Other adults a parent invites into the family, for example a grandparent or a nanny, may help manage chores, approvals, and rewards, but may not give consent for a child; those steps are for a parent or legal guardian.
We use reasonable methods designed to ensure that consent is provided by a parent or legal guardian. No identity-verification method is infallible; we have selected a method that, in light of available technology and the limited categories of data we collect, is reasonably calculated to ensure consent comes from a parent or legal guardian.
Depending on the circumstances and risk of the processing, we may require additional verification steps to confirm that consent is provided by a parent or legal guardian.
We do not use children's personal information for behavioral advertising or profiling.
If at any point we discover that a child has provided personal data to us without verifiable parental consent, we will delete that data promptly.
GrowTide collects limited personal information from children as part of parent-managed family accounts. We comply with the Children's Online Privacy Protection Act (COPPA).
If your family enables photo avatars, your child may take or choose a photo to use as their profile avatar. Every photo your child submits is held privately until you — the parent — approve it; it is not displayed to anyone, including other family members, before your approval. You may also set a child's avatar photo directly, and you may replace or remove it at any time.
Avatar photos are used for one purpose only: displaying your child's profile within your own family's account. They are never public, never shared outside your family, never used for advertising, and never subjected to facial recognition, face analysis, or any other form of automated analysis. We do not use avatar photos to train artificial intelligence or machine learning models.
All metadata — including any location (EXIF/GPS) information — is stripped from every photo on the device, before the photo leaves the device. Avatar photos never reach our servers with embedded location data.
Avatar photo retention. We keep avatar photos no longer than necessary, under the following rules (these also appear in Section 14, our Written Data Retention Policy):
When an avatar photo is deleted under any of these rules, residual copies may persist in encrypted backups and soft-delete storage for a limited period — no longer than 30 days — before being permanently purged. We never restore deleted photos from backups except in a disaster-recovery scenario, and in that scenario any previously deleted photo is re-deleted as soon as the restore is verified.
If you believe a child profile was created without proper parental consent, contact us immediately at support@growtide.app and we will delete it promptly.
We use industry-standard safeguards to protect your data, including:
GrowTide maintains a written children's personal information security program — covering periodic risk review, designation of a responsible person, and documented technical and organizational safeguards — as required by 16 CFR § 312.8.
No method of transmission over the internet is 100% secure. While we implement industry-standard protections, we cannot guarantee absolute security.
Breach notification: In the event of a personal data breach that is likely to result in a risk to your or your child's rights and freedoms, we will notify affected users without undue delay and, where feasible, within 72 hours of becoming aware of the breach. Notifications will include a description of the breach, the categories of data affected, the likely consequences, the measures we have taken in response, and steps you can take to protect yourself. We will also notify supervisory authorities as required by applicable law, including under GDPR Article 33 for EU/UK users.
If you are a parent or legal guardian of a child whose personal information is held in GrowTide, you have the following rights under the Children's Online Privacy Protection Act (COPPA). These rights apply regardless of your location, and are in addition to any rights you may have under GDPR, CCPA, or other applicable law.
To exercise any of these rights, use the in-app controls in Settings or contact us at support@growtide.app. We will take reasonable steps designed to verify your identity as the account-owning parent before processing requests (typically by confirming control of the registered account email). We respond within the time set out in Section 15.
Filing a complaint with the FTC: If you believe GrowTide has violated COPPA or mishandled your child's personal information, you may file a complaint with the Federal Trade Commission at reportfraud.ftc.gov or by calling 1-877-FTC-HELP. We would appreciate the opportunity to address your concerns directly first — please email support@growtide.app.
If you are located in the EU or UK, the following table sets out, for each processing activity, the lawful basis on which we rely under Article 6 of the GDPR (and, for children, Article 8). This disclosure is provided under Articles 13 and 14 of the GDPR / UK GDPR.
| Processing activity | Lawful basis |
|---|---|
| Creating and operating a parent account; running the chore, reward, and approval features | Contract — Art. 6(1)(b) |
| Collecting and processing child profile data within a family account | Consent — Art. 6(1)(a), with parental authorization under Article 8. For U.S. users, COPPA verifiable parental consent applies separately. |
| Subscription billing and entitlement management (RevenueCat, App Store, Google Play) | Contract — Art. 6(1)(b) |
| Sending push notifications about jobs, approvals, reminders, and screen time | Consent — Art. 6(1)(a). Granted at the OS level when you enable notifications; can be revoked in device settings at any time |
| Crash reporting from grown-ups' devices (Firebase Crashlytics) and abuse / security monitoring (Firebase App Check, rate limiting) | Legitimate interests — Art. 6(1)(f) — keeping the Services stable and protecting users from abuse. |
| (2.0) Crash reporting from children's devices (Firebase Crashlytics, crash details only, with the limits in Section 2c) | Consent — Art. 6(1)(a), with parental authorization under Article 8, given by a parent through the direct notice described in Section 7. |
| Recording the app version, platform and last app start of each family device, to turn features on only when every device can handle them (Section 2c) | Legitimate interests — Art. 6(1)(f) — keeping a family's devices working together across app versions. For a child's device, this is part of running the child profile under the parental consent above. |
| (2.0) Picking which message, tip, or reminder a grown-up sees from the family's own progress (Section 4) | Legitimate interests — Art. 6(1)(f) — helping families get value from the app. The child data it reads is used under the parental consent above, on the device, and is not sent anywhere. Grown-ups can turn reminders off in the app's notification settings and can object at any time (Section 12). |
| (2.0) Testing versions of the app's design and comparing them as totals (Section 4) | Legitimate interests — Art. 6(1)(f) — improving the app. Only grown-ups' devices send analytics; children's devices send none. |
| Automatic approval of a child's jobs, if a grown-up turns it on (Section 4) | Contract — Art. 6(1)(b) — a feature the grown-up chose, run under the rules they set. |
| (2.0) The optional "How did you hear about GrowTide?" answer, and tips and GrowTide news by email for grown-ups who opted in inside the app | Consent — Art. 6(1)(a). Answering is optional; the email opt-in is an unticked box confirmed by email, and you can unsubscribe at any time. |
| Anonymized parent-side analytics for app improvement | Legitimate interests — Art. 6(1)(f). Disabled entirely on child-linked devices. |
| Retaining billing and tax records | Legal obligation — Art. 6(1)(c) |
| Responding to a legal request or enforcing our Terms | Legal obligation — Art. 6(1)(c) and/or legitimate interests — Art. 6(1)(f) |
| Blog email marketing and the printable chore chart list on growtide.app | Consent — Art. 6(1)(a). You may withdraw consent at any time by unsubscribing. |
| Publishing feedback-board posts you submit, and de-duplicating votes (Section 2g) | Consent — Art. 6(1)(a) for the content and the optional email address you choose to submit; legitimate interests — Art. 6(1)(f) — for the pseudonymous hash used solely to prevent repeat voting and spam. Email support@growtide.app to have a post removed. |
| Sending you a service email you asked for — delivering a data export, or a promo code confirmation link (Section 6d) | Contract — Art. 6(1)(b). For delivery of a data export, also legal obligation — Art. 6(1)(c), because it fulfills your access and portability rights. |
| From December 18, 2026, emailing a parent a confirmation of the consent they gave for their child, with how to withdraw it (Sections 6d and 7) | Legitimate interests — Art. 6(1)(f) — giving the parent a record of their consent and an easy way to withdraw it. |
| Reading and answering the emails you send us, with the help of an AI assistant (Sections 6h and 6i) | Legitimate interests — Art. 6(1)(f) — answering your questions and requests. Where the email is about your account or a request you made under these rights, also contract — Art. 6(1)(b) — or legal obligation — Art. 6(1)(c). |
| Counting tracked-link clicks, download-button taps and download-page visits on growtide.app (Section 2d) | Legitimate interests — Art. 6(1)(f) — understanding which of our posts and channels bring parents to GrowTide, using minimal records with no identifiers; click records are deleted after 13 months and daily totals are kept only as counts. |
| Occasional personal feedback emails from our founder to parent account holders, and any benefit offered with them (Section 4) | Legitimate interests — Art. 6(1)(f) — improving GrowTide with feedback from the parents who use it. We balance this against your interests by writing to one parent at a time, sending at most three emails about one request unless you reply, never using anything a child entered or did in the app, and honoring a reply of "stop" permanently. You can object at any time (Section 12), and we will always stop. In Brazil, the equivalent basis is legitimate interest under LGPD Article 7, IX. |
| Publishing a quote you approved from a founder feedback email (Section 4) | Consent — Art. 6(1)(a). You may withdraw it at any time, and we stop using the quote from then on. |
| Emailing grown-ups a notice about changes to this policy or our Terms of Service (Sections 6d and 17) | Contract — Art. 6(1)(b), because our Terms of Service and this policy promise you that notice; and legitimate interests — Art. 6(1)(f) — telling everyone who uses GrowTide what is changing before it takes effect. |
You have the right to withdraw consent at any time where consent is the lawful basis. Withdrawal does not affect the lawfulness of processing already carried out before withdrawal. Where we rely on legitimate interests, you have the right to object — see Section 12.
No automated decision-making: Under Article 22 of the GDPR, you have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. GrowTide does not engage in any such automated decision-making or profiling. All parental controls — approvals, rewards, and account decisions — are made by the parent. The one automatic step, automatic approval of a child's jobs (Section 4), happens only if a grown-up turns it on and follows the rules that grown-up set; (2.0) it can be sent back by any grown-up in the family for 7 days.
For children under 16 in the EU, parental consent is required before account creation. GrowTide enforces this by design — only parents can create accounts and child profiles.
UK Age Appropriate Design Code (Children's Code). We design the child side of GrowTide with the Children's Code in mind. On a child's device there is no advertising, no analytics, no advertising identifier, no location data, and no profiling. Nothing a child does is public, and a child cannot contact anyone outside their own family through the app. Grown-ups in the family can see the child's jobs, notes, photos and progress (Section 3). This is part of how the app works, and parents decide which features are on.
Right to lodge a complaint: If you are located in the EU or UK and believe we have not handled your personal data in accordance with applicable data protection law, you have the right to lodge a complaint with your local data protection supervisory authority. For example, the UK Information Commissioner's Office (ICO) at ico.org.uk, France's CNIL at cnil.fr, Germany's data protection authority for your federal state, or the equivalent authority in your country. We would appreciate the chance to address your concerns first — please contact us at support@growtide.app before filing a complaint, and we will respond within the time set out in Section 15.
If you are in Brazil, the Lei Geral de Proteção de Dados (Law No. 13,709/2018, "LGPD") applies to our processing of your and your children's personal data.
We do not sell or share personal information as defined under the California Consumer Privacy Act (CCPA), including for purposes of cross-context behavioral advertising.
We do not use or disclose sensitive personal information, including children's data, for purposes other than providing the Service. Under CPRA § 1798.121, this means we do not use sensitive personal information to infer characteristics about a consumer or for any secondary purpose beyond what is necessary to deliver the Services you have requested.
If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives you the following rights regarding personal information we collect about you or your children:
To exercise these rights, contact us at support@growtide.app. We will take reasonable steps designed to verify your identity before processing the request and respond within the time set out in Section 15. Verification may include confirming ownership of the registered account email.
You may designate an authorized agent to submit requests on your behalf. The agent must provide written authorization signed by you.
Nevada residents: Under Nevada Revised Statutes § 603A.340, Nevada consumers have the right to submit a verified request directing a covered operator not to sell certain categories of covered personal information. GrowTide does not sell your personal information as the term "sale" is defined under Nevada law, and we have no plans to do so. If this changes in the future, we will update this policy and provide Nevada residents with a clear opt-out mechanism. To submit a Nevada opt-out request or ask questions about this right, contact us at support@growtide.app.
Other US states. Several US states give residents rights over their personal data and add protections for minors. Wherever you live in the United States, we do not sell personal data, we do not use any child's or teenager's data for targeted advertising, and we do not profile children. You may ask us to access, correct, or delete your personal data, or to appeal a decision we made about such a request, by emailing support@growtide.app. We respond within the time set out in Section 15.
Depending on your location, you may have the following rights:
To exercise these rights, use the in-app controls or contact us at support@growtide.app. Where we rely on legitimate interests, you may object to that processing. You may also ask us to restrict processing in the cases data-protection law allows, for example while you contest the accuracy of your data or while an objection is considered. We respond within the time set out in Section 15.
A note on cached and backup data: When you delete data, we remove it from our active systems immediately. However, copies may remain briefly in encrypted backups, server logs, and caches for operational and security purposes before being overwritten in the ordinary course. We never restore deleted data from backups except in a disaster-recovery scenario; in such a scenario, any personal information you previously deleted would be re-deleted as soon as the restore is verified.
The GrowTide app does not use cookies. The growtide.app website uses only essential cookies and similar storage:
The website sets no analytics or advertising cookies and loads no third-party analytics script. growtide.app does not load Meta Pixel, Google Ads tags, Google Analytics, Google Tag Manager, MailerLite Universal, Hotjar, FullStory, Segment, Mixpanel, or any other behavioral-advertising or third-party-analytics SDK. We measure the website only through the tracked-link records and daily totals described in Sections 2d and 2g, none of which holds an identifier or sets a cookie, and through standard web server logs, so the website does not show a cookie-consent banner.
On the website, MailerLite is contacted only at the moment you submit the GrowTide blog subscription form. When you submit that form, your browser sends your email (and first name, if provided) directly to MailerLite to add you to the relevant list. MailerLite may set its own cookies on the assets.mailerlite.com domain in connection with that submission; we do not set MailerLite cookies on the growtide.app domain.
We do not use cross-site advertising tracking and do not allow third parties to collect personally identifiable information about your activity on growtide.app for their own advertising purposes.
This section constitutes GrowTide's Written Data Retention Policy as required under 16 CFR § 312.10 (Children's Online Privacy Protection Rule, 2026 amendments). It sets forth, for each category of data we collect, the purpose for which the data is retained and the timeframe after which the data is deleted.
We do not retain personal information — including personal information collected from or about children — for any period longer than is reasonably necessary to fulfill the purposes for which it was collected, or as required by law. Indefinite retention of children's personal information is prohibited and we do not engage in it.
The specific retention period for each data category is as follows. In this table, "account deletion" means deleting the whole family account (Section 12): Delete Account by the only parent in the family, or Delete Family by the Owner. A parent who leaves a family, or whose access is removed, does not trigger it; that parent's own account data and push tokens are deleted when their own account is deleted.
| Data type | Retained until |
|---|---|
| Family and parent account data | Family data: account deleted. A parent's own account data: when that parent's account is deleted (other parents keep theirs when a family is deleted) |
| Child profiles | 14-day grace period after deletion, then permanent purge |
| Job history | Account deleted |
| Child-written job notes | Kept with the job history; deleted when the child's profile is purged (14 days after a parent deletes it) or the account is deleted |
| Job ideas and reward ideas a child sends for approval | Kept after the parent decides; deleted when the child's profile is purged (14 days after a parent deletes it) or the account is deleted |
| Job completion photos | Job photos: 90 days after the parent approves the job, or 90 days after upload if never approved; deleted when the child profile is purged (14 days after a parent deletes it) or immediately on account deletion. Bonus-task photos: 90 days after upload, or immediately on account deletion |
| Avatar photos — approved | Until replaced, removed by a parent, or the child's profile is deleted |
| Avatar photos — rejected by a parent | Deleted immediately on rejection |
| Avatar photos — pending, never approved or rejected | Deleted after 30 days |
| Avatar photos — after GrowTide Pro access ends | Deleted after a 60-day grace period (display stops immediately when Pro access ends) |
| Avatar photos — interrupted or incomplete uploads | Cleaned up within 30 days |
| Custom badge images | Until the badge is deleted, or immediately on child/account deletion |
| Child PIN and parent PIN (stored only as a hash) | Until changed or removed; a child's PIN is deleted when the child's profile is purged, and every PIN when the account is deleted |
| FCM push tokens | Device unlinked or account deleted |
| Security and rate-limit logs | 90 days |
| Billing records | 7 years (US tax law requirement) |
| Website server logs | Up to 90 days (rotated by hosting provider). |
| Linked device records (platform, model name, link date) | Retained for audit integrity; deleted when the associated child profile is purged (14 days after a parent deletes the child) or when the parent account is deleted |
| Blog subscriber email addresses | Until you unsubscribe |
| Age verification signals (status, age range, install identifier) | Refreshed on each check; deleted when the family account is deleted |
| Promo code redemption record (which family redeemed which campaign code, and for how long) — no child data | Deleted when the family account is deleted |
| Promo code confirmation links — a one-time link emailed to you when you redeem a code on growtide.app, stored only as an irreversible hash | Expires one hour after it is sent and can be used once; the record is deleted within 90 days |
| Promo code request rate limits — an irreversible hash of the email address entered on growtide.app, used only to stop the form being abused. We cannot recover the address from it, and it is stored whether or not the address has a GrowTide account | Counts reset after one hour; the record is deleted within 90 days |
| Service email delivery metadata held by MailerSend — whether a data export notice, a consent confirmation, a promo code confirmation, a notice about changes to this policy or our Terms, or a founder feedback email was delivered, bounced, or failed. We do not keep a separate copy of the message body. | Retained by MailerSend for a limited period in accordance with MailerSend's documented data-retention practices; not stored separately by us |
| Tracked-link click records (time, referring domain, approximate country, device type) — no IP address or identifier | Deleted automatically 13 months after the click |
| Daily download-button totals per tracked link and store, and daily download-page totals per channel, video and device type — counts only, no identifier | Kept as aggregate statistics; they contain no personal data |
| Subscription event log (purchase, renewal and cancellation notices from RevenueCat) — no child data | Deleted after 90 days |
| Photo-avatar decision records (which parent approved or rejected a photo, and when; the photo itself is not kept here) | Until the child profile is purged or the account is deleted |
| Founder feedback emails (Section 4) — our messages, your replies, the random unsubscribe code in our emails to you (with the email's language, held in Cloudflare D1; it contains no name or address), and any quote you approved with the record of your approval. No child data | Messages and replies: deleted 12 months after our last message to you, or sooner if you ask. The unsubscribe code: deleted 12 months after the last email it went into, unless you used it to unsubscribe (then it is kept with your opt-out). An approved quote and the record of your approval: until you withdraw permission or we stop using the quote |
| Founder feedback selection list — the account details and counts described in Section 4, used to decide whom to write to | Replaced each time it is rebuilt from current data; deleted no later than 12 months after it was last rebuilt |
| Opt-out from founder feedback emails — a note on your account that you opted out, and the date; if you used the unsubscribe link, the date is also kept against that link's random code in Cloudflare D1 | Kept for as long as we need it to make sure we never email you for this purpose again |
| Child date of birth a parent entered, and (2.0) the child's age band | Until a parent changes or removes it, or the child's profile is purged (14 days after a parent deletes it) or the account is deleted |
| (2.0) Weekly streak and the record of which recent days a child sent a job | The day record keeps only the recent days the weekly streak needs, and older days are overwritten; the streak counts are deleted when the child's profile is purged or the account is deleted |
| How a job was approved (by which grown-up or automatically), and (2.0) any send-back of an approval | Kept with the job history; deleted when the child's profile is purged or the account is deleted |
| (2.0) Celebration record on a job (scene, character, skipped or not) | Kept with the job history; deleted when the child's profile is purged or the account is deleted. The totals we study cover groups of at least 20 families and hold no personal data |
| (2.0) Stickers and sticker-chest counters | Until the child's profile is purged or the account is deleted |
| (2.0) A child's reactions to jobs and requests for help | Kept with the job history; deleted when the child's profile is purged (14 days after a parent deletes it) or the account is deleted |
| (2.0) A child's home-layout choice | Until changed, or the child's profile is purged or the account is deleted |
| (2.0) Notification settings and children's reminder times | Until changed, or the grown-up's account (or, for a child's reminders, the child's profile) is deleted |
| Device installation records (installation identifier, platform, last app start; (2.0) app version, whether a home-screen widget is on, and, on grown-ups' devices, whether recent reminders went unanswered) | Overwritten each time the app starts; deleted when the device is unlinked or the account is deleted |
| Crash reports (Firebase Crashlytics), from grown-ups' devices and, (2.0) with crash details only, children's devices | Kept by Google for 90 days, after which Google starts removing them from its live and backup systems |
| (2.0) Which version of the app's design a family is shown, when that was decided, and the country used | Account deleted |
| Analytics from grown-ups' devices (Google Analytics for Firebase), including (2.0) the "How did you hear about GrowTide?" answer | Deleted under our Google Analytics data-retention setting, at most 14 months after collection |
| (2.0) In-app email opt-in: the consent record (wording and version shown, language, date, confirmation date) and the MailerLite contact — no child data | MailerLite contact: deleted within 30 days of unsubscribing or deleting your account. Consent record: kept for 3 years after you unsubscribe or delete your account, only as proof that you consented, then deleted |
| Emails you send us and our replies, in our inbox (Section 6i), and the copies our AI assistant handled while helping draft a reply (Section 6h) | Inbox: deleted no later than 24 months after the last message in the conversation, or sooner if you ask. Copies held by Anthropic: kept under Anthropic's own retention rules for the plan described in Section 6h |
If you believe we are retaining your or your child's personal information longer than reasonably necessary, contact us at support@growtide.app. We review this policy at least annually and update retention periods to reflect the minimum necessary for each purpose.
GrowTide is operated by Manus Labs LLC, based in Utah, United States. The Services run on Google Cloud / Firebase infrastructure hosted in the United States. Google acts as our processor on our written instructions.
The growtide.app website is separate from the app: it is hosted by Cloudflare, Inc. on Cloudflare's global network, and the public feedback board described in Section 2g stores its posts, together with the website's daily totals (Sections 2d and 2g) and the unsubscribe codes in founder feedback emails (Section 4), in a Cloudflare D1 database. Cloudflare acts as our processor on our written instructions. No app data and no child data is stored there.
Service emails — the data export notice, the consent confirmation (from December 18, 2026), the promo code confirmation link, notices about changes to this policy or our Terms, and founder feedback emails, all described in Section 6d — are delivered by MailerSend, Inc., which stores message data in data centers in the European Union; it may also process it in the United States (Section 16). No child data is sent to MailerSend, and a feedback email never contains anything a child entered or did in the app.
MailerLite — the blog emails it delivers (Section 6g) — stores data in data centers in the European Union. No child profile data is sent to MailerLite.
If you use the Services from outside the United States, your personal data — including any personal data about your children — is transferred to, processed in, and stored in the United States on Google Cloud. We rely on the safeguards described in Section 16 (International Data Transfers), which include the European Commission's 2021 Standard Contractual Clauses (and, for UK transfers, the UK International Data Transfer Addendum). Where applicable, our providers may additionally be certified under the EU–U.S. Data Privacy Framework; we treat that certification as a supplementary safeguard, not a sole legal basis for the transfer.
Retention. We retain personal data only as long as necessary to provide the Services and fulfill the purposes set out in this policy. In particular: child profiles are deleted within 14 days of a parent's deletion request, after a short grace window during which the parent can restore the profile; after that, the data is permanently and irreversibly purged. Full account deletion is immediate and irreversible — the entire family account, including every child profile and all family data, is removed when the Owner confirms Delete Family in the app, or when the only parent in the family deletes their account, and it cannot be restored; other parents keep their own accounts. One record can outlive the account: if the family has an active paid subscription at the moment of deletion, the subscription record held by our payment processor is removed once that subscription period ends rather than on the day you delete, because erasing it while the store subscription is still live would break your ability to restore or dispute that purchase with Apple or Google. It is deleted automatically, without any further action by you. Separately, and as required by US tax law, we keep the billing records described in Section 14 for seven years; those records are financial records of a transaction and are not part of your family account. For category-by-category retention periods (including photos, security logs, and billing records), see Section 14 (Written Data Retention Policy).
Your rights regarding stored data. You can download a copy of your family's data yourself in the app (Settings, then Privacy & Security, then Download my family's data; see Section 12). You may also request access to, correction of, deletion of, or withdrawal of consent for your personal data. Requests can be sent to support@growtide.app. How quickly we respond: we answer every privacy request — under COPPA, the GDPR, the LGPD, the CCPA or any other law — within 30 days of receiving it. If a request is unusually complex, we may extend that once, by no more than the law that applies to you allows (for example, two more months under the GDPR or 45 more days under the CCPA), and we will tell you why within the first 30 days. This is the response time every other section of this policy refers to. For full details of your rights, see Section 9 (Parental Rights under COPPA), Section 10 (GDPR), Section 11 (California Privacy Rights), and Section 12 (Your Rights).
Manus Labs LLC is established in the United States. As a result, your personal data — including, where applicable, personal data about children — will be transferred to and processed in the United States, where our principal processors are located:
If you are located in the EU, the UK, or another jurisdiction with cross-border data transfer restrictions, we rely on the following safeguards under Articles 44–49 of the GDPR (and the corresponding UK GDPR provisions):
Transfer impact assessment (Schrems II): We assess the legal frameworks of recipient countries and implement supplementary technical and organizational measures where necessary to ensure an equivalent level of data protection. This assessment considers, among other factors, the law and practices of the destination country, the categories of data being transferred, and the safeguards already implemented by our processors.
Not yet covered: our email inbox (Section 6i) and, until our move to a commercial account is done, our AI assistant for email replies (Section 6h) operate under those providers' own terms. We do not yet have Standard Contractual Clauses with them for this use.
You may request a copy of the SCCs in place by emailing support@growtide.app.
We may update this Privacy Policy from time to time. When we make significant changes, we post the updated policy on this page with the date it takes effect and a summary of what changes, and we tell existing parents through the app or by email at least 14 days before the changes take effect. The "Last updated" date at the top of this page reflects the most recent revision.
Changes that add a new kind of data about children get two steps: the 14 days' notice above, and then, inside the app, a parent in each existing family is shown the updated direct notice and asked to agree before we collect the new data (Section 7). If no parent in the family agrees, the new features that would collect it stay off for that family.
Changes that only reduce what we collect take effect as soon as we publish them, because waiting would only delay a protection.
Change history
For privacy questions, data requests, or concerns: