Privacy Policy

When you create a Grovli account we collect basic profile information (name, email address) via Auth0 authentication. We also store:

• Dietary preferences, allergies, and calorie/macro targets
• Meal plans, saved meals, and pantry items you create
• Usage analytics (pages visited, features used) to improve the product
• Device and browser information for compatibility and security
• Health & fitness data (steps, active calories, exercise minutes, resting heart rate) — read-only from Apple HealthKit when you opt in. This data is processed entirely on your device to adjust nutrition targets and is never sent to our servers
• Coarse location — used only for grocery store proximity reminders and restaurant discovery, when you grant location permission
• Family member profiles — names, ages, and dietary preferences of family members you create. These are stored under your account and visible only to your household

• Generate personalized meal plans and recipe suggestions tailored to your profile using Grovli Intelligence, our intelligent recipe engine (your dietary preferences, allergies, macro targets, and pantry items are processed to generate recipes)
• Manage your account, subscription, and billing
• Improve Grovli Intelligence and overall service quality — we may use anonymized, aggregated usage patterns (with hashed user IDs, never personal information) to improve meal recommendation quality
• Send transactional emails — receipts, account updates, and security alerts
• Provide customer support and respond to inquiries
• Connect you with grocery delivery via Instacart — when you use the "Order Ingredients" feature, your grocery list items are shared with Instacart to create a shopping link. No personal information beyond the ingredient list is shared

Your data is stored securely on Google Cloud Platform infrastructure with industry-standard encryption in transit (TLS 1.3) and at rest (AES-256). Payment processing is handled entirely by Stripe — we never store, see, or have access to your credit card details. Access to production systems is restricted via IAM policies and audit-logged.

We use the following third-party services, each governed by their own privacy policies:

Grovli uses Google Gemini, a generative AI service provided by Google LLC, to power core features including meal plan generation, food photo analysis, and the nutrition advisor.

Data we send to Google Gemini:

• Dietary preferences, food allergies, and ingredient exclusions
• Calorie targets and macronutrient goals
• Health and fitness goals (e.g., weight loss, muscle building)
• Meal plan history and food log entries
• Food photographs captured within the app for analysis
• Text messages sent to the nutrition advisor feature

Purpose: This data is sent solely to generate personalized meal plans, analyze food photographs for nutritional content, and provide contextual nutrition guidance.

Data protection: Google processes this data under the Google Cloud Data Processing Addendum. All data is encrypted in transit (TLS 1.2+) and at rest. Your personal data is not used by Google to train, improve, or develop generative AI models.

Nutrition data: Nutritional information is sourced from the USDA FoodData Central database. AI-generated estimates are cross-referenced against USDA data where available.

Your choices: You may manage AI data processing consent at any time through the app's Settings → Privacy → AI Data Processing. Disabling AI data processing will prevent core features (meal plan generation, photo analysis, nutrition advisor) from functioning. Previously generated meal plans will remain accessible.

Data retention: Google retains API input/output data for up to 30 days for abuse monitoring purposes, after which it is deleted. Grovli does not independently store copies of data sent to Google beyond what is needed to display your meal plans and food logs.

You have the right to:

• Access — request a copy of all personal data we hold about you
• Correct — update or fix inaccurate information at any time
• Delete — request complete deletion of your account and associated data
• Export — download your data in a portable format
• Withdraw consent — opt out of non-essential data processing

To exercise any of these rights, email hello@grovli.com. We respond within 30 days.

We use essential cookies only — for authentication and session management. No third-party advertising or tracking cookies are used. No cookie banner needed because we don't track you for ads.

We may update this privacy policy from time to time. Material changes will be communicated via email or an in-app notification at least 14 days before they take effect. Continued use of the service after changes constitutes acceptance.

For privacy-related inquiries, data requests, or concerns, email hello@grovli.com.