Privacy at Grove.
Effective November 4, 2026. Version 2026-11-04-2. Grove Markets is individually operated. This notice describes the information used for the free pilot. Contact hello@grove.markets with access, correction, deletion, or privacy questions. We check on weekdays and aim to reply within two business days.
What we collect
Username, private email, account-password hash, email-confirmation and security records, adult attestation, policy acknowledgment versions and submission times, notification preferences, town/ZIP, profile and eligibility information, listings, requests, conversations, saved searches, reports, and moderation records. Security records include encrypted authenticator information and hashed recovery codes.
Grove does not request medical preferences, date of birth, government-ID uploads, or a structured home address. People may voluntarily share contact or pickup details in conversations. Avoid sensitive documents and information you do not want recipients to retain.
What others can see
Approved profiles, listings, and requests are publicly readable, showing a username or grower name and approximate location. Private email, credentials, recovery information, review evidence, and conversations are not public. Reviewers can inspect specifically reported messages.
Why we use it
Information supports account access and recovery, discovery, conversations, requested notifications, eligibility review, abuse handling, appeals, and security. Grove does not sell personal information or use behavioral advertising or analytics cookies.
Services and authentication
Hostinger hosts the application and sends account email; MongoDB Atlas stores application records. These providers process the information needed to supply those services. Google and Facebook login are currently unconfigured. Enabling another provider requires review and accurate notice. Instagram links do not give Grove access to Instagram posts or contacts.
Hosting and database providers may process technical and security information, such as IP addresses, request metadata and service events, to operate and protect the service. Provider processing may occur in other countries; a selected server location does not limit all processing to that location. The app cleanup periods described in this notice do not set retention for every provider-held record. Contact hello@grove.markets about access or deletion; provider records may remain where needed for security or applicable legal obligations.
Retention and deletion
Account and profile information is kept while the account is active. Deletion closes access and removes direct details, policy receipts, follows, public visibility, and the member’s message text. Limited pseudonymous references may remain for conversation continuity and abuse handling. Interrupted cleanup is retried, and outages can delay it.
Scheduled cleanup removes delivered/failed email jobs older than seven days, notifications and reviewed reports older than ninety days, and audit records and messages older than 365 days. Open reports remain until resolved.
Recovery copies
The local backup process retains the latest fourteen successful encrypted database copies, not a fourteen-day guarantee. The operator reviews separately stored encrypted recovery copies monthly and removes superseded or unnecessary copies after confirming a valid replacement. Encrypted backups may retain previously deleted information. Deletion requests must be reapplied before a restored database returns to service. Grove cannot erase information another participant already retained. A tested recovery copy does not guarantee uninterrupted backups or a specific recovery time.
Your controls
In account settings, you can export your information, delete your account, manage available notification preferences and sign-in methods, and revoke sessions. Requested account/recovery email remains available. Optional discovery/promotional email remains disabled under the current setup.
Cookies
Essential cookies support sign-in, anti-forgery protection, and short-lived security confirmations. The pilot does not use analytics or advertising cookies.
Contact support about access, correction, deletion, or a privacy concern.