Privacy Policy

Grove is a discovery platform for student-built projects, operated by VioniX — a student-led product studio. VioniX is the controller of the personal data described here.

This policy explains what personal data we collect when you use Grove at https://grove.vionixonline.in, why we collect it, who we share it with, how long we keep it, and what you can require us to do with it. It applies to the website and every feature on it.

If anything here is unclear, or you want to exercise a right described in section 9, write to us at vionix37@gmail.com. A person reads every message.

We collect three kinds of information: what Google gives us when you sign in, what you choose to put on the platform, and the technical records that come from operating a website.

• Account data. When you sign in with Google we receive your name, email address and profile picture. We check that the email belongs to the campus domain the platform is currently open to. We never receive your Google password.
• Profile data. The username, display name, avatar, banner, headline, biography, campus, skills, availability status and external links (GitHub, LinkedIn, personal site and similar) that you add yourself.
• Content you post. Projects and their titles, taglines, descriptions, highlights, categories, tech and tags; cover images, gallery images and video links; comments and replies; teams you create or join; and the contributors you credit.
• Engagement data. Likes, bookmarks, follows, views recorded against projects, and collaboration requests you send or receive, including the message they carry.
• Settings. Your notification and privacy preferences, and your theme choice.
• Technical and usage data. Your IP address, browser and device type, the pages you request, timestamps and referring pages — the records any web server keeps. IP addresses are also used transiently for rate limiting so that one client cannot overwhelm the service.
• Cookies and local storage. See section 6.

Grove is a discovery platform, so most of what you put on it is meant to be seen. Being clear about which parts is more useful than any setting.

• Public to anyone, signed in or not: your projects and everything on their pages, including the contributors credited on them, comments and reply threads, team pages, and the engagement counts on each project.
• Visible to signed-in members only: builder profiles and the builder directory. Profiles are deliberately behind sign-in — students joined to share projects, not to be enumerated by anyone who fetches a page — and builder URLs are excluded from our sitemap for the same reason.
• Private to you: your bookmarks and library, your notification and privacy settings, your dashboard analytics, and your email address, which is never displayed on the platform.
• Private to two people: collaboration requests and their messages, visible only to the sender and the recipient.
• Assume anything you post publicly may be seen, screenshotted, cached by a search engine, or archived by a third party beyond our control. Deleting it here does not delete those copies.

We use personal data only for the purposes below. We do not sell it, we do not share it with advertisers, and we do not use it to build advertising profiles.

• To provide the Service: authenticate you, render your profile and feed, publish your projects, deliver likes, comments, follows, team invitations and collaboration requests.
• To personalise what you see: your feed, your library, and the notifications you have asked for.
• To produce the analytics on your own dashboard, such as how many people viewed a project you posted.
• To keep the platform safe and working: rate limiting, abuse prevention, debugging, and investigating breaches of the Terms or Guidelines.
• To communicate with you about the Service — notifications you opted into, and occasional operational messages about changes, outages or policy updates.
• To comply with legal obligations and to establish, exercise or defend legal claims.

Where data-protection law requires us to identify a legal basis, ours are these.

• Performance of a contract: everything necessary to give you an account and run the Service you asked for.
• Legitimate interests: keeping the platform secure and free of abuse, understanding how features are used so we can improve them, and defending our legal rights. We balance these against your interests, and you may object under section 9.
• Consent: optional things you switch on, such as notification preferences. You can withdraw consent at any time, which does not affect processing already carried out.
• Legal obligation: retention and disclosure that the law requires of us.

We use only what the platform needs to function. We do not use advertising or cross-site tracking cookies, and we do not run third-party analytics or advertising scripts.

• Authentication cookies, set by our authentication provider, keep you signed in and are refreshed as you browse. Without them you would be signed out on every page load.
• Local storage on your device holds your theme preference and a short-lived cache of the feed, so returning to it after opening a project is instant.
• Security and rate-limiting mechanisms process your IP address for the duration of a request.
• Blocking these in your browser will sign you out and may stop parts of the platform from working.

We share personal data only as described below, and only to the extent needed for each purpose. Every provider is bound to process data on our instructions.

• Other users: whatever is public under section 3, which is what makes the platform work.
• Google, for authentication. Google processes your data under its own privacy policy at policies.google.com/privacy.
• Supabase, which provides the database, authentication infrastructure and file storage that hold your account, your content and your uploads.
• Our hosting and content-delivery provider, which serves the site and processes request logs.
• Law enforcement, regulators or courts, where we are legally required to disclose, or where disclosure is necessary to protect our rights, your safety or the safety of others.
• A successor, if VioniX or the Service is ever transferred to another organisation. We would tell you before your data became subject to a different policy.

Your data is held by the providers named in section 7, on infrastructure that may be located outside your country. Where data is transferred internationally, we rely on our providers' safeguards for those transfers, including standard contractual clauses where they apply.

• We keep account and profile data for as long as your account is open, and content for as long as you keep it on the platform.
• Deleting a project, comment or your account removes it from the platform. Copies may persist for a limited period in routine backups, and content others have already shared or that we must keep for legal reasons may remain.
• Technical logs and rate-limiting records are short-lived and kept only as long as they are useful for security and debugging.
• Aggregate statistics that no longer identify you may be retained indefinitely.
• Security measures include encryption in transit (HTTPS with strict transport security), row-level access rules in the database so one account cannot read another's private data, a content security policy, restrictions on which hosts may serve images and scripts, and rate limits on sensitive routes.
• No system is perfectly secure. If a breach affects your personal data and is likely to put your rights at risk, we will notify you and any regulator we are required to inform, without undue delay.

You can exercise most of these yourself from your settings and dashboard. For anything else, write to us and we will act on it.

• Access: ask what personal data we hold about you and get a copy.
• Rectification: correct anything inaccurate. Profile fields are editable directly.
• Erasure: delete individual content, or your entire account, from your settings — or ask us to do it.
• Portability: ask for an export of the data you provided, in a machine-readable form.
• Restriction and objection: ask us to pause processing, or object to processing we carry out on the basis of legitimate interests.
• Withdraw consent: turn off anything you opted into, at any time.
• Complain: raise a concern with your local data-protection authority. We would rather you came to us first so we can put it right.
• To exercise any of these, email vionix37@gmail.com from the address on your account. We respond to every request, normally within 30 days, and we will not charge you or treat you differently for making one.

The Service is intended for university students and is not directed at children. You must be at least 13 years old to hold an account, and accounts are in any case restricted to a campus email domain.

If you believe a child has given us personal data, contact vionix37@gmail.com and we will delete it.

Projects link out to repositories, demos, videos and writeups hosted elsewhere, and profiles link to accounts on other platforms. Following one of those links takes you to a site we do not control and that has its own privacy policy.

We are not responsible for how third-party sites handle your data. Read their policies before giving them anything.

We will update this policy when what we collect, why we collect it, or who we share it with changes. The current version is always on this page, with the date at the top reflecting when it last changed.

For material changes we will give reasonable notice through the Service, by email, or both, before they take effect. Continuing to use the Service after that means you accept the revised policy.

For any question about this policy, about the data we hold, or to exercise a right in section 9: vionix37@gmail.com.

Telling us which account you are writing about, and what you want us to do, gets it resolved fastest.