Privacy Policy

Last updated: 31 July 2026 · Applies to the iOS app “GrowHub Cultivation Club”

1. Who is responsible for the app

Kasimir Gritz, Berlin, Germany · kasimirgritz@gmail.com

2. The essential point: where the data lives

GrowHub stores no data with the app provider. The app is a client for a server that each cultivation association runs itself. All operational and member data stays on that server, under the association's control. The app provider has no access to it and receives no copy.

Under the GDPR the association is therefore the controller (Art. 4 (7)) for its members' data and answers requests under Art. 15 ff. GDPR.

3. What is stored on the device

Data	Where	Why
Server address	App settings	so the app can reach the association's server
Access token	iOS Keychain	staying signed in without storing the password
Last loaded readings	Memory	display only; discarded when the app quits

The password itself is never stored. Signing out removes the token and the server address from the device.

4. Connections the app makes

• To the association's server. Only to the address entered on the sign-in screen. It carries credentials, setpoints and the entries recorded during operation.
• To Apple (APNs). Only if notifications are enabled. A device token is created and handed to the association's server so it can deliver alerts. The content of each alert is produced by that server, not by Apple.

The app contains no analytics, tracking or advertising libraries. No data is shared with third parties, no usage profiles are built, no advertising identifier is used, and there is no tracking in the sense of Apple's App Tracking Transparency.

5. Growlink

The link to the growing equipment runs through Growlink Inc.'s interface. That connection is made by the association's server using the association's own Growlink account — not by the app. Growlink's own privacy policy governs the processing on their side.

6. Legal bases

• Art. 6 (1) (b) GDPR — use of the app under the association's membership or usage agreement.
• Art. 6 (1) (c) GDPR together with § 26 KCanG — the quantity records are required by German law.
• Art. 6 (1) (a) GDPR — consent, where notifications are enabled; withdrawable at any time in iOS Settings.

7. Retention

The statutory records under § 26 KCanG are retained by the association; retention periods follow the requirements of the competent state authority. Because the ledger is hash-chained, corrections are booked as reversals rather than by overwriting — itself a legal requirement for traceability.

8. Your rights

Access, rectification, erasure, restriction, portability and objection under Art. 15 to 21 GDPR. Since the data sits with the individual association, please address these rights to its board. You may also lodge a complaint with a supervisory authority — in Berlin, the Berlin Commissioner for Data Protection and Freedom of Information.

9. Changes

Changes to this policy are published here with a new date.

← Back