Privacy

Everything you enter — meals, weights, sets, recordings, sleep, blood results, notes — is written to storage on your own device. It is not copied to a server, because there is no server. Nobody, including the person who built Grove, can see it.

That has a consequence worth understanding: if you lose the phone and have no backup, the record is gone. Grove can export your whole archive to a file and read it back in again, and you should do that from time to time. Where you keep that file is your decision, and its contents are your responsibility once it leaves the app.

Grove reaches the internet only for the features below, and only after you turn them on. This is the complete list — the app is tested against it, and a tenth address cannot appear without that test failing.

Whoop and Strava require a secret to be held somewhere that is not the app, because a secret shipped inside an app can be read out of it by anyone who downloads it. Grove therefore runs two very small services, one for each, hosted on Cloudflare.

They do exactly one thing: swap a sign-in code for an access token. Specifically, each one:

• Never sees your data. Your runs, sleep, recovery and workouts go between your phone and the vendor directly. Nothing physiological and no route passes through these services, ever.
• Stores nothing. No database, no session, no record of a token. The token pair goes back to your phone and the service forgets it existed.
• Talks to nothing else. Each one can reach its own vendor's token endpoint and no other address on the internet.

Their source code is published, and it is short enough to read in five minutes.

If you allow it, Grove reads from and writes to Apple Health on your device. That exchange happens entirely on the phone under Apple's permissions — you choose each data type, you can see exactly what was granted in Apple's Health app, and you can withdraw any of it at any time. Nothing read from Apple Health is sent anywhere by Grove.

Grove uses your location only while a recording you started is running, including with the screen off, which is the only way an iPhone can record a run from a pocket. It stops the moment the recording ends. The route is saved to your phone; it goes to Strava only if you upload it.

Bluetooth is used only to connect fitness sensors — heart-rate straps, cadence and power meters, smart scales. Grove only ever looks for published fitness sensor types, never for other devices around you, and asks for permission the first time you open the sensors screen rather than at launch.

When you connect Oura, Whoop or Strava, or use the coach, your dealings with those companies are governed by their terms and not by this page. Grove's promise is only about what Grove does — which is why the table above says exactly what is handed over in each case.

Grove is not designed for or directed at children under 13, and is not suitable for them. It gives training and nutrition guidance intended for adults.

Delete the app. Because the record is stored only on your device, removing Grove removes it — there is no account to close and no request to send, because there is no copy anywhere else to delete. Anything you exported yourself, and anything already sitting in Apple Health or in your Strava account, is under your control in those places.

If what the app does changes, this page changes with it and the date at the top moves. The list of addresses above is enforced by a test in the app's own source, so this page cannot quietly drift out of date without that test failing first.

Questions about any of this: chris.b.wilburn@outlook.com.