Privacy Policy

Last updated July 20, 2026

Grove is a desktop app that runs on your machine. Your notes, your code, and your conversations with agents live in local files on your own disk. Grove has no account requirement, no cloud sync, and no server that your work passes through by default. This policy covers the narrow set of cases where data does leave your machine.

What stays on your machine

Everything, unless a section below says otherwise. Specifically, Grove never transmits:

• The contents of your notes, files, or source code.
• Your prompts, agent conversations, or terminal output.
• File paths, repository names, branch names, or git remotes.

Grove’s own bookkeeping — workspace state, chat transcripts, and settings — is stored in a .grove/ folder inside the vault you choose, and in your browser-local app storage. It is not uploaded.

Anonymous usage analytics

Grove sends anonymous product analytics through Aptabase, a privacy-focused analytics service. This is limited to event names and low-cardinality properties — for example, that a workspace was created, or that the settings panel was opened. Aptabase stores no IP address and no device fingerprint, and rotates session identifiers, so there is no stable per-user identifier on either side.

We use this only to understand which features get used and whether the app is working. It is never sold, shared, or used for advertising.

You can turn it off.Settings → Privacy has a single toggle that disables analytics entirely. Builds you run from source with GROVE_NO_ANALYTICS set never register the analytics plugin at all.

Published notes and link sharing

Grove can publish a note or a folder as a shareable link. This is strictly opt-in and happens only when you explicitly choose to publish. When you do:

• The content you published is uploaded to our hosting provider (Supabase) and served from share.getgrove.sh.
• Anyone holding the link can read it. The link contains a random capability token — it is unguessable and not indexed, but it is not password-protected. Treat a share link as the credential it is.
• You can unpublish at any time from within Grove, which revokes the token and removes the content from the viewer.

Publishing requires a Grove account, which is a sign-in through GitHub or Google. We receive your email address and account identifier from that provider, and use them solely to establish who owns which published document. We never receive your password.

GitHub access

Grove uses GitHub in two separate ways.

For pull requests — listing them, opening one, merging one — Grove has no GitHub app and never asks you to authorize one. It shells out to the GitHub CLI (gh) that you installed and authorized yourself, under GitHub’s own first-party application. Grove never sees, stores, or transmits a GitHub token, and only performs write actions in direct response to a click. Notes containing :grove-github directives are restricted to read-only queries and cannot merge, close, or delete anything. You can revoke gh’s access in your GitHub settings at any time, independently of Grove.

Publishing a share link requires a Grove account, and signing in with GitHub does authorize a Grove application. It requests one permission beyond your email address: read:org, which reads which organizations you belong to so that org-restricted share links work. Grove does not request the repo scope and has no access to your code, issues, settings, webhooks, or deploy keys through this sign-in. You can revoke it at github.com/settings/applications.

Agent CLIs and third parties

Grove launches agent CLIs that you install and authenticate yourself — Claude Code, Codex, or opencode. When you talk to an agent, your prompts and the file context that agent reads are sent to that provider under theirprivacy policy, not through Grove’s servers. Grove is the surface you drive them from; it is not an intermediary and does not retain copies. Review the policy of whichever agent you use.

Updates are fetched from GitHub Releases, which means GitHub sees the request. The getgrove.sh website uses Vercel Analytics for aggregate page-view counts.

Data retention and deletion

Published documents are retained until you unpublish them or delete your account. Analytics events are retained in aggregate by Aptabase and cannot be tied back to you, so they cannot be individually deleted. To delete your Grove account and everything published under it, email hello@getgrove.sh and we will action it.

Children

Grove is a developer tool and is not directed at anyone under 13. We do not knowingly collect information from children.

Changes

If this policy changes materially, the updated date above will change and the change will be noted in the release notes for the version that introduced it.

Contact

Questions about privacy: hello@getgrove.sh.