Legal

Privacy Policy

Effective October 8, 2026

1. What we collect

Account data - email address, display name, password-less authentication identifiers, and (if you sign in with Google or Apple) the basic profile fields those providers share with us.

Profile data you provide - name, location, bio, headline, profession, company, social handles, links, profile photo, and similar fields you choose to fill in. You control whether to provide these and can remove them at any time from your settings.

Private profile data - birthday and email-marketing preferences are stored separately and visible only to you and our admins; other members cannot see them.

Payment data - card details are collected and stored by Stripe, Inc., our payment processor. We never see or store full card numbers; we receive only a customer ID, the last four digits, and the subscription status from Stripe.

Usage data - pages you visit, features you use, approximate location derived from your IP, browser and device metadata, and event timestamps. We use this to operate and improve the Service.

Referrals - if you arrive through someone’s affiliate link and agree to credit them, we record who referred you. That person sees your display name, the date you joined and whether you are a paying member. They never see your email address or the amount you pay. If you join the affiliate program yourself, your payouts are sent through Stripe, and Stripe (not Groopy) collects and holds your identity and tax details.

Content you create - posts, comments, messages, RSVPs, and reactions you submit through the Service.

2. How we use it

To provide the Service (accounts, content, events, messages, billing); to communicate with you about your membership; to improve and secure the Service; to enforce our Terms of Service; and to comply with legal obligations.

3. Sub-processors we share data with

We use a small set of trusted vendors to run the Service. We share only what each needs to do its job, and each is contractually required to protect your data.
  • Supabase - primary database and authentication. Hosted in the United States.
  • Vercel - web hosting, serverless compute, and request logging.
  • Stripe - payment processing, billing, and subscription management.
  • Upstash - rate-limiting and ephemeral cache.
  • Google - calendar and video-meeting links for member events; OAuth sign-in (if you choose it).
  • Apple - OAuth sign-in (if you choose it).
  • PostHog - product analytics: which pages are viewed and how quickly they load. It does not record what you type, the text on the page, or your screen.
  • Resend - sending account and event emails.
  • Meta, Google, Reddit and X - the advertising networks we buy ads from. When you open or start a community on Groopy they receive that you did, and for the moment you start or pay, a one-way scrambled (hashed) form of your email address (never the address itself), your IP address, your browser’s user agent and the ad click identifier that brought you. We do this only to measure which ads bring people who start a community, so we can stop paying for the ones that do not. We delete the IP address and browser details from our record after 7 days and keep the hashed event record for 25 months. It never runs when your browser sends a Global Privacy Control signal, and in the UK, the EU and EEA, Switzerland, Brazil and Quebec it runs only if you choose Accept in our cookie notice. Elsewhere you can turn it off at any time with Cookie choices.
  • Daily - live video rooms for online events, and recordings of a session when its host turns recording on.
  • Cloudflare - storage and playback of video, including recordings of sessions.
  • OpenAI - automated safety checks on uploaded images and video, and written summaries of recorded sessions (it receives the session’s transcript to write them).

4. Cookies & similar technologies

We use first-party cookies and similar storage, such as your browser’s local storage, to keep you signed in, remember your preferences, protect against abuse, and measure how the Service is used through PostHog. In the UK, the EU and EEA, Switzerland, Brazil and Quebec nothing is stored for analytics or advertising until you choose Accept in our cookie notice. Elsewhere it runs unless you opt out, and never when your browser sends a Global Privacy Control signal. Your choice is kept in your browser and in one first-party cookie so our servers can honour a decline. You can turn it off, or change your choice, here at any time: . The exception to first-party storage is the ad networks’ pixels listed above, which set their own cookies when they run. You can clear cookies and site data at any time in your browser; doing so will sign you out.

5. How long we keep your data

Account and profile data are retained for as long as your account is active. If you delete your account, we remove or anonymize personally identifying data within 90 days, except where we are required to retain it for tax, accounting, fraud prevention, or legal obligations (typically up to 7 years for billing records).

6. Your rights

You have the right to access, correct, export, or delete your personal data. You can update most fields directly in your settings. To request export or full deletion, email our support page. If you are in the EEA, UK, or California, you also have rights under the GDPR, UK GDPR, and CCPA respectively, including the right to object to or restrict processing.

7. Children

The Service is not directed to anyone under 18. We do not knowingly collect personal data from children under 18. If you believe a child has provided us data, contact us and we will delete it.

8. International transfers

Our infrastructure is primarily hosted in the United States. If you use the Service from outside the U.S., you understand that your data will be transferred to and processed in the U.S., which may have different data-protection laws than your home country. We rely on appropriate safeguards, such as standard contractual clauses, where required.

9. Security

We use industry-standard safeguards: TLS in transit, encrypted storage at rest, server-side authorization with row-level security on user data, scoped service-role keys, and structured audit logging on sensitive operations. No system is perfectly secure; we will notify affected users without undue delay if a breach affects their data.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email or by a prominent notice in the Service. The effective date at the top reflects the latest revision.

11. Contact

Questions or requests? Email us at our support page. Groopy is operated by Animor Studios, Inc., which is responsible for your data.
Animor Studios, Inc.our support page