growthdata.dev Privacy Policy

Effective date: October 31, 2026

growthdata.dev ("growthdata", "we", "us") is a company-data service run by Teammate Ventures LLC. You can use it through our REST API (https://growthdata.dev/v1) or our MCP server (https://growthdata.dev/mcp), which AI assistants connect to after you sign in at auth.growthdata.dev. This policy explains what personal data we collect, why, and what we do with it.

What we collect

When you sign in (at auth.growthdata.dev, shared by sites in the data.dev network):

Google sign-in. We request the openid, email and profile scopes. We store your Google account ID and your email address (only if Google reports it as verified). We do not store your Google profile name or photo, and we do not keep your Google access token after sign-in.
GitHub sign-in. We request read:user and user:email. We store your GitHub user ID and the public email on your GitHub profile, if you have one. We do not keep your GitHub access token after sign-in.
Apple sign-in (planned). We request name and email. We store your Apple user ID, your email (which may be an Apple private relay address) if Apple reports it as verified, and the name Apple shares the first time you sign in.

From this we create a user account, an organization ("org") that you own, and a membership linking the two. If you sign in with a second provider using the same verified email, we link it to the same account.

When you connect an app (OAuth). When you approve an app such as an AI assistant, we store an authorization grant that records the app, the scopes you approved (growthdata:read, growthdata:watch, offline_access), and your user and org IDs. We also store the access and refresh tokens issued to that app, in a form that lets us verify them.

API keys. We issue REST API keys (starting gd_live_) to an org. We store only a SHA-256 hash of each key, a short prefix so you can recognize it, when it was created, when it was last used, and whether it was revoked. We cannot see or recover your full key.

Purchases. When you buy credits, our payment processor, Stripe, collects and handles your card and billing details under Stripe's Privacy Policy. We do not see or store your full card number. We keep a record of each purchase (amount, credits, date, and the processor's transaction reference) linked to your org.

Usage records. When you call a tool or endpoint, we record a task (the tool name, your org ID, the idempotency key you sent, its status, and the credits it would charge), per-org daily credit totals, and per-minute request counters for rate limiting. If you create a watch, we store the company domain you are watching, the cadence, and your org ID.

Logs. Our service runs on Cloudflare Workers with logging turned on. Like most web services, requests are processed with technical data such as IP address, user agent, request URL (which can include a company domain you looked up), and timestamps.

Cookies. We use only cookies that are needed for sign-in. We do not use advertising or analytics cookies.

Cookie	Set on	Purpose	Lasts
`auth_login`	auth.growthdata.dev	Signed, short-lived state that protects the sign-in round trip with Google, GitHub or Apple	10 minutes
`auth_session`	auth.growthdata.dev	Signed session that keeps you signed in while you approve apps	12 hours
`__Host-oauth-…`	auth.growthdata.dev	Protects the app-approval step from forgery	10 minutes

How we use it

To sign you in and keep your account, org, and connected apps working.
To authenticate API and MCP requests, apply rate limits and daily credit caps, and track and deduct credits.
To process credit purchases, keep purchase records, and meet tax and accounting obligations.
To run watches you set up.
To secure the service, debug problems, and prevent abuse.
To contact you about your account or important changes, using the email we have on file.

We do not sell your personal data. We do not use it for advertising. We do not use it to train AI models.

Google user data

growthdata.dev's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, we use Google sign-in data (your Google account ID and verified email) only to sign you in and operate your growthdata account. We do not transfer it to others except as needed to provide the service (for example, our hosting provider), to comply with law, or as part of a merger or acquisition with notice to you. We do not use it for advertising, we do not sell it, and no human reads it except with your permission, for security purposes, or to comply with law.

We use these service providers. Each gets only what it needs to do its job:

Cloudflare hosts the service, its databases (D1), key-value storage (KV), file cache (R2), queues, and logs.
Stripe processes credit purchases and card details. See Stripe's Privacy Policy.
Google, GitHub and Apple handle sign-in when you choose them. Their own privacy policies apply to what you share with them.

We may also disclose data if required by law, or to protect the rights, safety, or property of our users, the public, or us.

Where our company data comes from

The company data growthdata serves (company profiles, growth timelines, and annotations) comes from third-party data providers and publicly available sources. It is about companies, not about you. When you look up a company domain, we may send that domain to a data provider to fetch results, and we cache the results to avoid repeat requests.

How long we keep it

Account, identity, org, and membership records: while your account exists.
Access tokens: expire after 1 hour.
Refresh tokens: expire after 30 days.
Apps that registered themselves with our sign-in server: registration expires after 90 days.
API keys: kept until deleted; revoked keys stop working immediately.
Usage, task, and credit records: 12 months.
Purchase records: as long as tax and accounting law requires.
Logs: kept by our hosting provider for up to 7 days, then deleted.
Cookies: see the table above.

When you ask us to delete your account, we delete your account, identity, org, membership, API key, grant, and watch records within 30 days, except where we must keep something to comply with law (such as purchase records).

Your choices and rights

Disconnect an app by revoking it in that app, or ask us to revoke its grant.
Revoke an API key by asking us.
Access, correct, export, or delete your data by emailing us at the address below. Depending on where you live, you may have more rights under local law, and we will honor them.
You can also remove growthdata's access from your Google account, GitHub settings, or Apple ID settings.

Security

API keys are stored only as hashes. Sign-in cookies are signed and marked HttpOnly and Secure. All traffic uses HTTPS. No system is perfectly secure, so please keep your API keys private and tell us right away if you think one has leaked.

Children

growthdata is a tool for developers and businesses. It is not meant for children under 16, and we do not knowingly collect their data.

Changes

If we change this policy, we will update the date at the top. If a change is significant, we will give notice on this page or by email before it takes effect.

Contact

Teammate Ventures LLC Email: privacy@growthdata.dev Mail: 914 E Douglas, Wichita, KS