AutoGrow ("we," "us," "our") is committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, who we share it with, and what rights you have regarding your data. By using AutoGrow, you agree to the practices described here.

If you have any questions, contact us at support@autogrow.app.

1. Information We Collect

1.1 Information You Provide

• Account information: Email address, password (stored as a hash — we never see your plaintext password), and optionally your phone number.
• Social media session cookies: When you connect a social media account through AutoGrow, we store encrypted session cookies that allow us to automate actions on your behalf. We do not collect or store your social media passwords.
• Automation configuration: Target hashtags, usernames, action types, comment templates, and daily limits you configure for each session.
• Payment information: Billing is handled entirely by Stripe. We do not store your credit card number or payment details. We receive only a Stripe customer ID and subscription status.

1.2 Information Collected Automatically

• Action logs: A record of every automated action performed on your behalf (platform, action type, target, status, timestamp). This data powers your analytics dashboard.
• Usage data: Pages visited, features used, and session activity for the purpose of improving the service.
• Device and technical data: IP address, browser type, and operating system collected when you log into the AutoGrow web application.

2. How We Use Your Information

Purpose	Data used
Provide and operate the AutoGrow service	Email, session cookies, automation config
Process payments and manage subscriptions	Email, Stripe customer ID
Send SMS verification codes and session alerts	Phone number (if provided)
Send transactional emails (welcome, receipts, alerts)	Email address
Display analytics and action history	Action logs
Detect fraud and enforce our Terms of Service	IP address, usage patterns
Improve and debug the service	Usage data, error logs

We do not sell your personal data to third parties. We do not use your data for advertising purposes. We do not share your social media credentials with any third party.

3. How We Store and Protect Your Data

• Social media cookies are encrypted at rest using AES-256-GCM before being stored in our database. The encryption key is stored separately from the data.
• Passwords are never stored in plaintext. Authentication is managed by Supabase Auth using bcrypt hashing.
• Data in transit is protected by TLS/HTTPS on all connections.
• Database access is restricted to application-level service accounts with minimal permissions. No direct public access to the database is permitted.
• Our infrastructure runs on Railway (application hosting) and Supabase (database), both of which maintain SOC 2 compliance programs.

4. Third-Party Services

We use the following third-party services to operate AutoGrow. Each has its own privacy policy.

Service	Purpose	Privacy Policy
Supabase	Database and authentication	supabase.com/privacy
Stripe	Payment processing	stripe.com/privacy
Twilio	SMS verification and alerts	twilio.com/legal/privacy
Railway	Application hosting	railway.app/legal/privacy
Rewardful	Affiliate program tracking	rewardful.com/privacy

AutoGrow also automates actions on third-party social media platforms (TikTok, Instagram, YouTube, Twitter/X, Facebook, Spotify) using your credentials. Your use of these platforms remains subject to their own terms of service and privacy policies.

5. Cookies and Tracking

The AutoGrow web application uses the following cookies:

• Authentication cookies: A JWT token stored in localStorage to keep you logged into the AutoGrow dashboard. This is not a tracking cookie.
• Affiliate tracking: If you arrive via an affiliate link, a Rewardful cookie is set to attribute your referral. This cookie does not track you across unrelated websites.

We do not use advertising cookies, third-party trackers, or analytics platforms that share your data with others (e.g., Google Analytics).

6. Data Retention

• Account data is retained until you delete your account.
• Action logs are retained for 90 days by default, then automatically purged.
• Social media cookies are deleted when you disconnect an account or delete your AutoGrow account.
• Billing records may be retained for up to 7 years as required by applicable tax and financial regulations.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the data we hold about you.
• Correction: Request correction of inaccurate data.
• Deletion: Request deletion of your account and all associated personal data. To delete your account, contact support@autogrow.app or use the account settings page.
• Portability: Request your action logs and account data in a machine-readable format.
• Objection: Object to processing of your data in certain circumstances.

To exercise any of these rights, email us at support@autogrow.app. We will respond within 30 days.

8. Children's Privacy

AutoGrow is not intended for users under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has created an account, contact us immediately at support@autogrow.app and we will delete the account.

9. International Users

AutoGrow is operated from the United States. If you access the service from outside the United States, your data will be transferred to and processed in the United States. By using AutoGrow, you consent to this transfer. We apply the same privacy protections to all users regardless of location.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page and notify users by email for material changes. Continued use of the service after notification constitutes acceptance of the updated policy.

11. Contact Us

For any privacy-related questions, requests, or concerns, contact us at:

AutoGrow
Email: support@autogrow.app