Grow Lab Privacy Policy
Effective July 24, 2026
Grow Lab is made by Kinetic Flux, LLC ("we," "us"). Grow Lab is an online game with a shared economy, so unlike some of our offline games it does need a server and an account. This policy explains what that involves, in plain language.
Your account
When you first launch Grow Lab, we silently create an anonymous account identified by a random ID stored on your device. No email, no signup, no personal information. You can play the whole game this way.
Optionally, you can secure your account so it survives a lost phone, by linking one of:
- Email and password. We store your email address and a salted, hashed form of your password (we never store the password itself). We send verification and password-reset emails to that address.
- Sign in with Apple or Google. We verify the sign-in token with Apple or Google and store the account identifier they give us. If you use Apple's Hide My Email, we only ever see the relay address.
Data we collect
- Gameplay data: your facility, crops, in-game currency, market orders, and transactions live on our servers, because the market is shared between all players. The market's price history is kept indefinitely; it powers the in-game charts and keeps the economy fair.
- Purchase records: if you buy something, payment is handled entirely by Apple or Google. We never see your card details. We receive and keep a record of the transaction from Apple or Google so we can grant and restore what you bought.
- Push tokens: if you enable notifications, we store the device token Apple or Google issues so we can send them.
- Technical logs: our servers log requests, including IP addresses, to operate the service, rate-limit sign-in attempts, and investigate abuse and market manipulation. Logs are kept for a limited period and then deleted automatically.
We collect no contacts, no location, no photos, and nothing from your device beyond what is listed here.
Advertising
On the free tier, Grow Lab offers optional rewarded videos through Google AdMob: you choose to watch an ad, you get an in-game reward. There are no banner or interstitial ads anywhere in the game, and paid tiers show no ads at all. The AdMob SDK is the only third-party component in the app, and it may collect device identifiers and ad-performance data under Google's privacy policy and AdMob's data practices.
If you link an email address, we use it for account emails only: verification, password resets, and security notices. Marketing email is strictly opt-in via an unchecked box, records when and where you consented, and every message carries a one-click unsubscribe. We never buy, sell, or share mailing lists.
Who we share data with
We share data only with the providers needed to run the game: Amazon Web Services (hosting and email delivery), Apple and Google (sign-in, purchases, and notification delivery, for the accounts you choose to link), and Google AdMob (rewarded ads on the free tier, as described above). We do not sell your personal information, and we disclose it beyond this list only if required by law or to protect our players and service.
Data retention and deletion
We keep your account and gameplay data while your account is active. You can request deletion of your account and its personal data through the Kinetic Flux contact form; we may need to verify you control the account first. Purchase records are retained as required for accounting and tax purposes, and aggregate market history is not personal data and survives account deletion.
Your rights
You can ask us to access, correct, or delete your personal data through the contact form above. If you are in the EEA or UK (GDPR), you additionally have the rights to restrict or object to processing, to data portability, and to complain to your supervisory authority; we process your data to provide the game you asked for, to meet legal obligations, and for our legitimate interest in keeping the game secure and its market fair. If you are a California resident (CCPA/CPRA), you have the right to know, access, correct, and delete your personal information and to opt out of its sale or sharing; we do not sell or share personal information, and we will never discriminate against you for exercising your rights.
Children
Grow Lab is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us information, reach us through the contact form and we will delete it.
Where data is processed
Grow Lab runs on infrastructure in the United States (AWS, us-east-1). If you play from elsewhere, your data is processed in the United States.
Security
Purchases and rewards are verified server-side, passwords are hashed with a modern algorithm, and access to production systems is restricted. No system is perfectly secure, but we build as if the market's integrity depends on it, because it does.
Changes to this policy
If Grow Lab's data practices change, this policy will be updated first, the effective date above will change, and the change will be described here in plain language.
Contact
Questions? Reach us through the Kinetic Flux contact form.