Privacy Policy

Cache00, an independent app studio in Toronto, Ontario, Canada, is the controller of the personal data described here. You can reach us at contact@cache00.com.

Four things, and nothing else.

• Your account. Your email address, and a display name if you set one. Handled through Supabase, our authentication provider.
• What you hand over. The tasks you write, the files and photos you upload, the sources behind a study set or course, and your messages in a chat. Plus what Groply produces from them.
• Usage counts. How many requests and builds you have made, so the plan limits can be applied. Counts, not content.
• Payment records. Which plan you are on and whether it is active. Card details go to Stripe and never reach us.

There are no third party analytics or advertising trackers on this site or in the app. We do not build a profile of you and we do not sell anything about you to anybody.

Groply sets a session cookie when you sign in, which is what keeps you signed in. That is ordinary and unavoidable.

It also sets one identifier cookie for people who are not signed in. It holds a random value and nothing else, and it does two jobs: it keeps the work you do signed out attached to you rather than pooled with every other anonymous visitor, and it lets the daily free allowance be counted per person. It lasts up to 400 days. Clearing it means starting again with a fresh, empty account, and any work made under the old value stops being reachable.

There are no advertising or analytics cookies.

• To provide the service you asked for, which is the performance of our contract with you.
• To apply plan limits fairly and to stop abuse, which is our legitimate interest in the service continuing to work.
• To take payment and keep the records tax law requires us to keep.

Only the companies that make Groply run, each doing one job, and none of them are allowed to use your material for their own purposes.

• Vercel, which hosts the application and serves this page.
• Supabase, which holds the accounts and the database your work is stored in.
• Stripe, which takes payments. They hold your card details; we do not.
• Google, whose Gemini API is the engine behind the Flash 4.0 model. The content of a task run on Flash 4.0 is sent to it to be worked on.

Groply's larger models sign in with a personal subscription on a person's own machine rather than running on our servers. Where that is how your work runs, it does not pass through us at all.

We will also disclose data if the law genuinely requires it, and we will tell you unless we are forbidden from doing so.

Your runs, reviews, outputs, study sets, courses and chats are kept until you delete them or close your account. That is deliberate: everything you make stays available on every plan, including the free one, and nothing is deleted to push you into upgrading.

Delete a chat, a run or a study set and it goes, along with what it contained. Close your account and we remove your personal data within 30 days, apart from records we are legally required to keep, such as invoices.

We are in Canada, and the providers above operate in Canada, the United States and the European Union, so your data is processed outside your country and may be subject to the laws there. Where transfers out of the UK or EEA happen, they rely on the standard contractual clauses those providers publish.

• A copy of what we hold about you.
• Correction of anything wrong.
• Deletion of your account and its contents.
• A machine readable export of your work.
• That we stop processing your data, or that you object to us doing so.

Email contact@cache00.com and we will answer within 30 days. If you think we have handled your data badly you can complain to your local data protection authority, and in Canada to the Office of the Privacy Commissioner.

Groply is not intended for children under 13 holding their own account. We do not knowingly collect personal data from them. If you believe a child has given us data without a parent, guardian or school behind the account, email us and we will delete it.

Traffic is encrypted in transit, accounts are separated so one person cannot reach another's work, and payment details never touch our systems. No service can promise it will never be breached, and we are not going to. If a breach affects you, we will tell you.

If this policy changes, the date at the top moves, and we will tell you in the app or by email if the change is significant.