A question asked in the Grow app leaves the phone. It has to — the model that answers it is not on the handset. It is also kept afterwards, in a database, under an account created for you without asking. This page says exactly where all of that goes and how to get rid of it.
Applies to the Grow Android app and to this website. Last updated 26 July 2026.
The rest of this page is the same three things said slowly. If you only read one part, read this one.
An earlier version of this page said Grow kept no copy of anything and had no accounts. That was true then and is not true now. It changed because a programme that cannot see what it costs cannot be funded, and because a history you can reopen is worth more than one that vanishes when the app closes — but the honest way to make that trade is to say so on the page, before it ships, which is what this is.
Four hops, three companies, three countries. This is the whole path.
the phone→
grow-api · Google Cloud Run · us-central1→
Alibaba Cloud Model Studio · ap-southeast-1→
Supabase · ap-southeast-2
When you send a message, the app posts that message and the earlier
turns of the same conversation to grow-api, a service run
by Grow on Google Cloud Run in Google's us-central1 region
in the United States. The app talks to nothing else. It holds no
credential and knows nothing about which model answers.
grow-api adds Grow's standing instructions to the model and
forwards the whole thing to Alibaba Cloud Model Studio in the
ap-southeast-1 region in Singapore, which runs a model from
the Qwen family. The answer streams back the same way. This is a
transfer of your text to a third party, in another country, and it
happens on every question — there is no version of using the app that
avoids it.
What that provider does with the text it receives is governed by its own terms, not by this page. Grow does not use questions or answers to train any model, and does not permit that on its side of the arrangement.
As each answer finishes, grow-api writes the question, the
answer and an accounting row to a Postgres database hosted by Supabase,
a third company, in its ap-southeast-2 region in Sydney,
Australia. The accounting row is what the answer cost: the model used,
how many tokens went in and came out, how long it took, and whether it
failed. Everything is attached to your account and, by a rule enforced
inside the database rather than by the app, readable by no other one.
The model's private scratchpad — the "thinking" some models stream before they answer — is deliberately not stored. It is not what you were shown, and keeping it would double the record for no one's benefit.
The first time the app opens it creates an account for you and signs you in, with no form and no prompt. That account is a random identifier and nothing else: no name, no email, no phone number, no device identifier. It exists so your history is yours and so Grow can see what the service costs, which is the difference between a programme that can be funded and one that cannot.
You can attach an email to it from the account screen. That is optional, and its only purpose is recovery — reaching the same history from a second handset, or after reinstalling. If you never add one, Grow never learns an address, and nothing on the account can be traced back to you by anyone holding the database.
Google Play requires apps like this to let you report a bad answer. A report is not just another stored message: it is text flagged for a human being to read — so the app asks first, every time.
Long-pressing a reply offers to report it. The app then shows a confirmation dialog before anything is sent, and nothing leaves the phone unless you choose a reason on that dialog.
A report is stored in the same database as everything else, in its own table, with your account against it and a status showing whether anyone has looked at it yet. A copy also goes to Google Cloud Logging, so that a report is not lost if the database write fails — a report that exists only where the write just failed is a report that does not exist.
No name or device identifier travels with a report, because there aren't any. The ordinary server request log records the network address it was sent from, as it does for every request. No retention period shorter than the log store's own default has been set yet. That is a gap rather than a decision, and it is being fixed rather than defended.
Reporting is still worth a moment's thought before you tap it. Everything else you type is kept under an account with no name on it; a report is text you are specifically asking a person to read.
Some things arrive whether or not anyone asked for them. Leaving them out of a privacy policy is the oldest way to write a true one that misleads.
Like any web service, grow-api is fronted by infrastructure
that records that a request happened: the network (IP) address it came
from, the time, the path, the response status and size. That is Google
Cloud's standard request logging and it is not message content. The same
address is held briefly in memory to enforce a rate limit, so that one
handset cannot exhaust a shared budget, and is discarded after ten idle
minutes.
The accounting row saved with each answer can also carry that address — but only as a one-way scramble of it, salted with a secret the database does not hold. That is enough to notice a single source flooding the service and not enough to work out where anyone was. If the salt is not configured, nothing is recorded at all rather than something weaker.
The signed-in session is stored in the app's own private storage on the handset, so you stay signed in between launches. Other apps cannot read it. Anyone with the unlocked phone can open Grow and read the history, the same as any other app on it — there is no separate passcode.
The app can update its own code without a new install. On launch it asks
Expo's update service — u.expo.dev, run by Expo, a separate
company — whether a newer version exists. That request carries a random
identifier created when the app was installed, the platform, and the
app's runtime version, along with the network address it came from. It
carries no conversation text. The identifier is per-installation, is not
linked to you or to anything else Grow holds, and is regenerated if the
app is reinstalled.
The site sets no cookies and runs no analytics. It does load its two typefaces from Google Fonts, which means your browser makes a request to Google when a page here loads, and Google therefore sees the address it came from. The site's own server logs the same ordinary request details described above.
A chat app that needed the camera roll would be telling you something. This one needs the network and nothing else it can do without.
The app needs internet access to reach Grow's server, and the ability to see whether the phone is online so it can tell you when it isn't. It does not use the camera, the microphone, your location, your contacts, your calendar or the files on your phone — there is no code in it that touches any of them, and there is no photo or voice input today whatever the home page's illustrations suggest is coming.
The home page states the programme's boundaries. These are the ones that are specifically about your data, restated here so this page can be held to them on its own.
No training on what people ask. Questions and answers are not used to train a model. Not aggregated, not de-identified, not "for research".
No selling, renting or brokering. Nothing collected here is sold, shared for advertising, or passed to a data broker. There is no advertising in the app and no analytics code in it.
No profiles. Questions are linked to each other by the account that asked them — that is what a history is. They are not linked to a person, not enriched from anywhere else, and not used to infer anything about you. Nobody is scored, segmented or targeted.
No surveillance work. Not identification, not tracking, not profiling — for any government, donor or partner, at any price, however the request is framed.
No quiet expansion. If the app starts collecting something it doesn't collect today, this page changes first and says so, rather than after the fact.
There is an account now, so the usual questions do apply. Here are the real answers to them.
Everything typed into the app is sent to the model provider in order to be answered. Names, patient details, addresses, anything a colleague told you in confidence — the app cannot tell those apart from the rest of a question, and neither can the model. Ask about the situation without the identifying detail wherever the answer doesn't depend on it.
Deleting the account deletes the conversations with it — every question and every answer, removed by the database itself rather than by a job someone has to remember to run. What survives is the accounting: the token counts and timings, with the account identifier stripped off them. Those rows are what the service cost and are kept for that reason alone; once detached they say nothing about who asked what.
Ask at the address below. If your account has no email on it there is nothing to prove you are you, so say roughly when you first used the app and what you asked about, and it can be found. Signing out of an account with no email attached is also final in the other direction — there is no way back into it, which the app warns about before it lets you. See delete-account.html for the full walkthrough of what happens after you ask.
Grow is built for adults doing frontline work — extension officers, teachers, health workers. It is not directed at children, it is not designed for them, and it should not be handed to one to use unsupervised.
The app explains, translates and recalls. It does not diagnose, and no answer it gives should be acted on in a clinical, legal or safety-critical situation without a qualified local professional confirming it first. In an emergency, seek local emergency help before asking anything here.
A policy that can't be questioned isn't worth much, and one that changes quietly is worth less.
The date under the headline is when this page was last edited. If the app begins collecting something it doesn't collect today — or if the provider or the region behind it changes — this page is updated before that ships, not after, and the change is described rather than merely dated.
Questions about this page, a request to delete your account and its history, or a challenge to anything asserted here can be sent to hello@fantail.ai. A person reads it. You will be told what was deleted and what was kept, rather than left to assume.