Privacy Policy

Effective October 18, 2026

Growcake (“we”, “us”) is operated by Growcake at growcake.co. This policy explains what data we collect when you use Growcake, why, who we share it with, and the choices you have. Questions: [email protected].

What Growcake does

Growcake analyses websites you add, finds search opportunities, prepares briefs and articles, and, when you connect a publishing destination and ask it to, publishes or updates content on your website. Nothing is published without your action or your explicit Autopilot settings.

Data we collect

Your account

When you sign in with Google: your name, email address, profile picture and Google account identifier. We do not receive your Google password.
Your plan, usage counts (for example analyses and generated articles this month) and sign-in times.

Websites you add

The website address and business details you enter or confirm (description, products, audience, goals, competitors, topics to avoid).
Public pages of that website, read by our crawler, which follows the site's robots.txt.
Keyword, search-result and competitor data about the website, retrieved from our search data provider.
Opportunities, plans, briefs, articles, images, quality checks, calendars, activity logs and publish history created in Growcake.

Google Search Console (optional)

If you connect Google Search Console, Growcake requests read-only access (webmasters.readonly) and reads, for the property you select: search performance data (queries, pages, clicks, impressions, click-through rate, position) and URL inspection results (index status) for pages you ask about. We store the OAuth tokens encrypted and the performance data needed for your reports and measurements.

Publishing destinations (optional)

If you connect WordPress, Payload CMS or a custom webhook, we store the site address, the credentials you provide (for example an Application Password, an API key or a webhook secret) and settings needed to publish. Credentials are encrypted with AES-256-GCM, kept on our servers only, and never sent to your browser. To update an existing page, Growcake reads that page's current content from your CMS.

Cookies

We use only cookies needed for the service: a sign-in session cookie (up to 30 days), a cookie remembering which of your websites is selected, and short-lived cookies that protect the Google and integration sign-in flows. We do not use advertising or third-party analytics cookies.

Technical logs

Our servers log errors and requests (for example time, route and error messages) to keep the service running and secure. Logs are written to avoid secrets such as passwords and tokens.

How we use data

To provide Growcake: analysing your websites, generating recommendations and content, publishing where you ask, and measuring results.
To keep accounts separate and secure, enforce plan limits, and prevent abuse.
To fix problems and improve the service.

We do not sell personal data, and we do not use your data for advertising.

Google user data

Growcake's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

We use Google Search Console data only to provide and improve the user-facing features you use in Growcake (reports, opportunities, measurements and index status).
We do not transfer it to others except as needed to provide those features (for example, sending query and page data to our AI provider to generate your analysis), to comply with law, or as part of a merger or acquisition with notice to you.
We do not use it for advertising, and we do not sell it.
No person reads it unless you ask us to (for example for support), it is needed for security or abuse investigation, or the law requires it.

You can revoke Growcake's access at any time in your Google Account permissions or by disconnecting Search Console in Growcake.

Who we share data with

We use these service providers (processors) to run Growcake. They receive only the data needed for their task:

OpenAI: text for analysis and writing (website pages, business details, search data, briefs, drafts). Used through their API.
DataForSEO: website domains, keywords and search queries, to retrieve search volumes, search results and competitor data.
fal.ai: image descriptions, to generate cover images when you use that feature.
Google: sign-in and, if connected, Search Console.
Our cloud hosting and database providers: they run the application and store its data on our behalf, under data processing terms.
Your own destinations: content and images you choose to publish are sent to the CMS or webhook you connected.

We may disclose data if the law requires it, or to protect the rights and safety of users and the service.

Retention and deletion

Website data is kept until you delete the website in Settings; deleting it removes its analysis, plans, content records and connections.
Disconnecting an integration deletes its stored credentials.
To delete your account and all its data, email [email protected] from the address you sign in with. We delete it within 30 days, except where the law requires us to keep something.
Content already published to your website stays there; remove it in your CMS.

Security

We encrypt stored credentials and tokens, keep each account's data separate, use secure session cookies, and limit outgoing requests from our crawler to public addresses. No system is perfectly secure; if a breach affects your data, we will notify you as the law requires.

Your rights

Depending on where you live (for example under the GDPR or Turkey's KVKK), you may have the right to access, correct, delete or export your personal data, to object to or restrict processing, and to complain to a data protection authority. Email [email protected] to use these rights.

International transfers

Our providers may process data outside your country. Where required, we rely on appropriate safeguards such as standard contractual clauses.

Children

Growcake is not intended for anyone under 16, and we do not knowingly collect their data.

Changes

We will post changes here and update the effective date. For material changes, we will notify you in the app or by email.