GruKit Privacy Policy

Account authentication. If you sign in with Apple, Google Sign-In, or Firebase Authentication, we receive and store your user ID, email address, and display name so we can create and secure your account and keep your data connected to the correct user.

Discogs connection data. If you connect your Discogs account, we store OAuth credentials such as request tokens and access tokens so GruKit can sync your Discogs collection and related metadata at your request.

Collection data. GruKit stores the records you add or import, including releases, tracks, storage locations, shelves, equipment, sales listings, and maintenance logs. This is the core app content needed to provide collection management, organization, and sync features.

Subscription and purchase data. We process StoreKit transaction identifiers, your current plan tier, and entitlement status so we can verify purchases, unlock paid features, prevent fraud, and restore access across your devices.

Camera and photo library. With your permission, GruKit can access the camera or your photo library for sleeve scanning, barcode capture, and visual search. Images may be processed on-device and may also be sent to our backend when needed to match artwork or release information.

Microphone. With your permission, GruKit can access audio input for record identification and audio fingerprinting features. Audio is used only when you start that feature.

Motion sensor data. GruKit may read accelerometer or similar motion data for turntable calibration and vibration monitoring. This data is processed on-device only and is never transmitted to Granu Lab or third parties.

Device and app integrity data. We use Firebase App Check tokens and the app bundle identifier to authenticate requests to our backend and protect the service against abuse.

Remote configuration. We use Firebase Remote Config to deliver feature flags and app behavior settings without requiring every change to ship in a new app update.

Push notifications. If you enable notifications, Firebase Cloud Messaging may process the push token needed to deliver alerts and service messages to your device.

Analytics. GruKit does not use Firebase Analytics at this time.

On your device. Your collection and app data are primarily stored locally on your device in a SQLite database so the app can work quickly and preserve your library.

In iCloud. If you use sync features, relevant collection data is synced through Apple CloudKit using your iCloud account.

On our backend. Authentication records, purchase verification records, API security data, and any images or request payloads needed for server-side matching or entitlement checks may be processed and stored on backend systems operated for Granu Lab.

We use reasonable administrative, technical, and organizational safeguards to protect data, but no system can be guaranteed completely secure.

GruKit may use the following third-party services to operate app features: Firebase Authentication, Firebase Remote Config, Firebase App Check, Firebase Cloud Messaging, Discogs API, Apple Sign in with Apple, Apple StoreKit, Apple CloudKit, and Google Sign-In.

These providers process only the data needed for the services they support, and their handling of data is also governed by their own privacy terms and policies.

We do not sell your personal information and we do not share your collection data with data brokers or third-party advertisers.

We share data only when needed to provide the service you asked for, such as authenticating your account, syncing data with iCloud, connecting to Discogs, sending notifications, verifying purchases, or responding to lawful requests.

Motion sensor data used for calibration and vibration monitoring stays on your device and is not transmitted.

GruKit offers an auto-renewable subscription billed monthly through Apple's App Store.

Payment is charged to your Apple account. Apple manages billing, renewals, and cancellation. You can manage or cancel your subscription at any time in your iPhone or iPad Settings under your Apple ID subscriptions.

We receive subscription status, transaction identifiers, and entitlement information needed to verify your plan and unlock paid features. We do not receive your full payment card details.

Additional subscription terms are available at /subscription-terms.

You can request access to your data, ask for an export where available, or request deletion of your account and associated backend data by emailing info@granulab.xyz or by using the in-app deletion flow described at /account-deletion.

You can also control permissions for camera, photos, microphone, notifications, and iCloud from iOS Settings at any time.

We keep personal data only for as long as needed to operate GruKit, maintain your account, provide syncing and purchase restoration, comply with legal obligations, resolve disputes, and enforce our agreements.

Local collection data remains on your device until you delete it, remove the app, or clear the relevant app data. Synced CloudKit data remains subject to Apple's iCloud systems and your account settings.

When you request deletion, we will delete or anonymize the backend data we control within a reasonable period, except where retention is required for legal, tax, fraud-prevention, security, or accounting purposes.