What we collect

When you sign in, we receive your name, email address, and profile photo from Google. We never receive or store a password, because we do not have passwords.

When you take part in the programme, we store the structure of it: who you are matched with, when sessions were scheduled and held, and the amount, date, currency, and receipt image for each donation you report.

When you write to us through a public form, we store what you sent and the email address you gave us so that we can reply.

What we cannot read

Message content between a coach and the person they coach is encrypted so that only those two people can read it. No GrowForward administrator holds a key that opens it, there is no escrow, and there is no override.

The same applies to assessment results and 360 feedback responses: they are readable by the person they are about, and by their current coach while the match is active.

If you report a concern, you choose which messages to include. Only those messages are shared with us, re-encrypted by your own device for the administrators who will read the report. The original conversation is untouched.

The honest limit: your keys are wrapped by a cloud key-management service inside our cloud project, so someone holding administrative control of that project retains a theoretical ability to unwrap them. That is a different thing from an administrator reading your messages through the application, which nobody can do. We will describe this the same way if the arrangement ever changes.

How we use it

To run the programme: match you, schedule sessions, verify receipts, and report totals in aggregate.

To contact you about your own participation. We do not sell data, we do not share it with advertisers, and there is no advertising or analytics tracking on the signed-in parts of this service.

What is published

Impact figures on this site are aggregate totals across everyone. We never publish an individual donation amount, a donor name, or any kind of leaderboard or tier.

A coach profile is published only if that coach chooses to publish it and an administrator has approved it. It comes down immediately if the coach is suspended or asks us to remove it.

Where it is stored

Our database and file storage are hosted in the United States. Sensitive fields are encrypted by our application before they are written, so our database provider holds them as data it cannot read.

Whether personal data belonging to users in India and the Philippines may be stored in United States regions is a question our counsel is reviewing, and the answer may change where this data lives.

How long we keep it

Retention windows for assessments, 360 responses, and concern reports are being set with counsel. Deletion of that content is cryptographic and irreversible — once the key is destroyed, the data cannot be recovered by us or by anyone else.

Applications that we do not accept are retained rather than deleted, so that we have a record of the decision.

Your rights

You can ask us what we hold about you, ask us to correct it, and ask us to delete it. Write to us and a person will handle it.

The specific rights available to you depend on where you live, and the final version of this policy will set them out per jurisdiction.

Who else is involved

We use third-party providers for hosting, content delivery, database, identity, and email. Each one is listed by name in the final version of this policy, along with the signed data-processing agreements behind them.

Contact

Questions about any of this: write to us.