Privacy Policy

1. Scope

This Privacy Policy applies to the Gru AI application and the services it connects to (collectively, the “Service”). By using the Service, you acknowledge the practices described in this policy.

2. Information we collect

Depending on the features you use, we may collect or process:

• Account and identity information, such as your display name, account identifier, profile image, email address, or information supplied by an authentication provider such as Telegram or Google.
• Financial and portfolio information that you provide, connect, create, or choose to view through the Service, including holdings, ideas, notes, monitors, and related activity.
• Content and communications, including prompts, conversations, messages, uploaded documents, images, audio recordings, and other materials you submit.
• Device and app information, such as operating system, app version, device or installation identifiers, language, and push-notification tokens.
• Diagnostics, such as crash reports and technical error information. Where enabled, crash reporting is configured to avoid sending default personally identifying information and to redact sensitive telemetry.
• Connected account data, such as Gmail messages or Slack messages, when you connect a Google account or Slack workspace to an assistant. See Connected accounts.

3. Device permissions

The app may request access to the following device features only when needed:

• Microphone to record a voice message you choose to send.
• Photos and files to attach content you choose to upload.
• Notifications to deliver alerts and updates you enable.
• Biometrics to unlock the app’s encrypted local cache. Biometric templates remain under the control of your device; Gru AI receives only the device authentication result.

You can manage these permissions in your device settings.

4. How we use information

We use information to:

• Provide, operate, secure, and maintain the Service.
• Authenticate users and preserve account sessions.
• Display requested financial information and synchronize app content.
• Process messages, attachments, voice recordings, and other requests.
• Send notifications that users enable.
• Diagnose failures, prevent abuse, and improve reliability and functionality.
• Comply with applicable legal obligations and enforce our agreements.

5. How information is shared

We may share information with service providers that help operate the Service, such as cloud hosting, authentication, push-notification, error-reporting, and artificial-intelligence providers. These providers receive information only as reasonably necessary to perform services on our behalf or fulfill a feature you request.

We may also disclose information when required by law, to protect users or the Service, in connection with a corporate transaction, or with your direction or consent. Third-party services you choose to connect are governed by their own privacy policies.

Data from connected Google and Slack accounts is subject to additional limits. See Connected accounts.

6. Connected accounts (Google and Slack)

On the Connections page at app.gru.ai, you can connect a Google account or a Slack workspace to one of your Gru AI assistants. Each connection belongs to one assistant, and an assistant can only use the accounts connected to it.

What we access.

• Google: your email address and basic profile, to show which account is connected, and read-only access to Gmail (https://www.googleapis.com/auth/gmail.readonly), so the assistant can search your mail and read the messages you ask about.
• Slack: read-only access to the public and private channels you belong to, their message history, and search over the messages you can see.

Gru AI cannot send, change or delete your email or Slack messages.

How we use it. Only to do what you ask. When you ask your assistant in your private Gru AI conversation, it searches or reads your connected account and uses the result to answer you. Connected accounts are not available in group chats, when the assistant handles an incoming email, or in other apps.

How it is stored. OAuth tokens are encrypted with AES-256-GCM and stored on Gru AI servers. They are never given to the assistant. Content retrieved for a request is passed to your assistant and to the AI model provider that writes the answer, and becomes part of that conversation’s history.

Sharing. We do not sell Google or Slack data, use it for advertising, or use it to train generalized AI or machine learning models. We share it only with service providers needed to deliver the feature you asked for (cloud hosting and AI model providers, under terms that prohibit them from using it for their own purposes), or when required by law. Our staff do not read your Gmail or Slack content, except with your explicit permission for specific messages, when necessary for security purposes, or to comply with applicable law. Our diagnostic logs keep only the structure of conversations that use a connected account, not their content.

Disconnecting and deletion. You can disconnect a connection on the Connections page at any time. This deletes its stored tokens and stops further access. Deleting an assistant disconnects all of its connections. You can also remove Gru AI’s access in your Google Account (myaccount.google.com/permissions) or in your Slack workspace settings. To delete conversation history that contains retrieved content, email privacy@gru.ai.

Google API Services User Data Policy. Gru AI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Gru AI does not use data obtained through Google Workspace APIs to develop, improve, or train generalized or non-personalized AI and/or ML models.

7. Local storage and security

Gru AI may store session credentials using the secure storage provided by your device. Cached financial content and recent messages are stored in an encrypted local database. We use reasonable administrative, technical, and organizational safeguards, but no method of storage or transmission is completely secure.

8. Data retention and deletion

We retain information for as long as reasonably necessary to provide the Service, maintain security, comply with legal obligations, resolve disputes, and enforce our agreements. Retention periods vary based on the type of information and why it was collected.

Logging out removes locally stored session credentials and clears the app’s user cache. To request deletion of your Gru AI account or associated server-side personal data, contact us using the address below. We may need to verify your identity before completing a request, and we may retain limited information where legally permitted or required.

For how to disconnect a connected Google or Slack account and delete its data, see Connected accounts.

9. Your choices and rights

You may update device permissions, disable notifications, disconnect third-party services, or stop using the Service at any time. Depending on where you live, you may have rights to request access to, correction of, deletion of, or a copy of your personal information, or to object to or restrict certain processing. Contact us to make a request.

10. Children’s privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact us so we can take appropriate action.

11. International processing

Information may be processed in countries other than the country where you live. Where required, we use appropriate safeguards for international transfers of personal information.

12. Changes to this policy

We may update this policy as the Service changes. We will post the revised policy at this location and update the “Last updated” date. Material changes may also be communicated through the Service or by another appropriate method.

13. Contact us

For privacy questions or requests, email privacy@gru.ai.