No selling. Your child's data is never sold, rented, or traded to anyone. Ever.
Self-hosted. Data lives in an encrypted, private database. Not shared with ad networks.
Delete anytime. One click to export or permanently delete all your data.
Optional research. Anonymous aggregated data for research only with your explicit consent.
GrowChart ("we", "us", "our") is a child growth tracking platform operated by Fayez Ahmed, a sole proprietor based in Bangladesh. Our service is available globally at www.growchart.app and www.growchart.app.
For the purposes of the General Data Protection Regulation (GDPR), we act as the Data Controller for personal data collected through GrowChart. For users in the European Economic Area, we comply with GDPR. For users in California, we comply with CCPA. For users globally, we apply the highest applicable standard.
Contact: For any privacy matter, email [email protected]. We respond within 72 hours.
This is the most sensitive category. You provide this voluntarily to use the core service:
⚠ Medical note: GrowChart is not a medical device. Growth data you enter is used only to compute WHO/CDC standard scores for educational purposes. We do not transmit clinical health data to any electronic health record (EHR) system unless you explicitly configure an integration.
| Purpose | Data Used | Legal Basis (GDPR) |
|---|---|---|
| Providing the growth tracking service | Account + child health data | Contract performance (Art. 6(1)(b)) |
| Computing WHO/CDC z-scores and percentiles | Child age, sex, measurements | Contract performance (Art. 6(1)(b)) |
| Generating PDF growth reports | All child data for selected child | Contract performance (Art. 6(1)(b)) |
| Sending transactional emails (alerts, invitations) | Email address | Legitimate interest (Art. 6(1)(f)) |
| Processing subscription payments | Email, subscription status | Contract performance (Art. 6(1)(b)) |
| Anonymous research dataset (opt-in only) | Age in months, sex, measurements (de-identified) | Explicit consent (Art. 6(1)(a)) |
| AI Growth Advisor (Premium) | Child's measurements, z-scores, feeding/sleep logs | Contract performance + consent |
| Security and fraud prevention | IP address, usage patterns | Legitimate interest (Art. 6(1)(f)) |
| Legal compliance | Account data | Legal obligation (Art. 6(1)(c)) |
AI Advisor: When you use the AI Growth Advisor (Premium feature), your child's growth context (age, measurements, z-scores, feeding summary) is sent to an AI API for response generation. No raw photos are sent. You can disable the AI Advisor at any time in Settings → AI Features.
Your data is stored in a self-hosted, private PostgreSQL database on secured infrastructure. Database files are encrypted at rest using AES-256. All data in transit is protected by TLS 1.3.
| Data Category | Retention Period |
|---|---|
| Active account data (children, measurements, logs) | Until you delete your account |
| Deleted account data | Permanently purged within 30 days of deletion request |
| Backup copies | Overwritten within 30 days |
| IP address logs | 7 days |
| Anonymised research data (if consented) | Indefinite (cannot be re-linked to you) |
| Payment records | 7 years (legal requirement) |
We do not sell your data. We share data with the following trusted processors, under contractual data processing agreements, only to the extent necessary to provide the service:
| Processor | Purpose | Data Shared | Privacy Policy |
|---|---|---|---|
| LemonSqueezy / Paddle | Payment processing | Email, subscription plan | Their respective policies |
| Resend | Transactional email delivery | Email address, email content | resend.com/privacy |
| Anthropic / Google (AI providers) | AI Growth Advisor responses (Premium only) | Child growth context (no PII, no photos) | Respective privacy policies |
| Backblaze B2 | Encrypted file storage | Encrypted files only | backblaze.com/privacy |
We may disclose data if required by law (e.g. a court order or regulatory requirement) in the jurisdiction where we operate. We will notify you of any such disclosure unless legally prohibited from doing so.
| Type | Name / Key | Purpose | Duration |
|---|---|---|---|
| Session Cookie | sb-auth-token | Authentication — keeps you logged in | Session / 7 days |
| LocalStorage | theme, language, unitWeight, unitHeight | Your app preferences | Until cleared |
| IndexedDB | offlineQueue | Offline measurement queue (PWA) | Until synced |
We use zero advertising cookies and zero cross-site tracking cookies. No third-party analytics scripts run on our app pages.
Public marketing pages (www.growchart.app) may display Google AdSense banners in the future. These are limited to public calculator pages and are never shown inside the authenticated app.
GrowChart is operated by adults — parents, guardians, and healthcare professionals — on behalf of children. We do not knowingly collect data directly from children under the age of 13.
If you believe a child under 13 has created an account directly, contact us at [email protected] and we will delete the account immediately.
Depending on your jurisdiction, you have the following rights regarding your personal data:
Request a copy of all data we hold about you.
Correct inaccurate or incomplete data at any time in-app.
Delete your account and all associated data permanently.
Export all your data as JSON or CSV at any time.
Opt out of processing for research or legitimate interest purposes.
Request that we pause processing your data while a dispute is resolved.
To exercise any of these rights, email [email protected] or use the in-app Data & Privacy settings. We will respond within 30 days. EU/UK residents may also lodge a complaint with their national supervisory authority.
GrowChart is operated from Bangladesh. If you are located in the European Economic Area (EEA), United Kingdom, or other jurisdictions with data transfer restrictions, please note:
We may update this Privacy Policy to reflect changes in our practices or for legal compliance. When we make material changes, we will:
Your continued use of GrowChart after the effective date of an updated policy constitutes acceptance of the new terms.
We take privacy seriously. Reach out and we will respond within 72 hours.