Privacy Policy

Last updated: October 31, 2026

This policy explains what information GrowTallest ("we", "us") collects when you use growtallest.com, our Discord server or our Telegram groups, why we collect it, and who we share it with. GrowTallest is run by GROW TALLEST, a sole proprietorship registered in Singapore under UEN 53516970A, at 70 Bayshore Road, #22-12 Costa del Sol, Singapore 469987. It is the data controller for the purposes of the GDPR and the UK GDPR, and the organisation responsible for your data under Singapore's Personal Data Protection Act.

Information we collect

• Account information. When you sign up, our sign-in provider, Clerk, collects your email address and, if you use Google sign-in, basic profile information from Google. We don't collect a password ourselves: Clerk handles that. Clerk also records, for each device you sign in on, its IP address, approximate location, browser and type of device. You can see and sign out your devices in Sign-in settings on your account page, and the device limit under Account protection uses these sessions.
• Card payments. Card purchases are sold and charged by Link (Sold through Link, LLC), Stripe's merchant-of-record service, which handles your card under its own privacy policy. We never see your card number. Our Stripe account shows us the order: your name, email and billing address, the plan, the amounts and tax, your subscription status, a customer reference, and a fingerprint of the card used (a code that identifies a card without revealing its number). If an affiliate's link or code brought you, we record that affiliate against your account and your Stripe customer record, so the discount stays on your renewals and the affiliate is paid commission on your payments. When you buy or change plan by card, we also keep a record of what you agreed to: the plan, what you were charged, the renewal terms you were shown, the terms it was sold under and when, linked only to your account number.
• Self-referral check. When a purchase uses an affiliate's code, we compare the buyer's email (ignoring +tags, and dots in Gmail addresses) and, for a card purchase, the card's fingerprint with the affiliate's own account emails and the cards the affiliate has paid us with, to stop affiliates earning commission on their own purchases. A match automatically withholds the commission on that purchase and on its renewals; the purchase stands. If you think a commission was withheld wrongly, email us and a person will review it.
• Bitcoin payments. If you pay in Bitcoin, we store the payment address we gave you, the plan and amount, the IDs of the transactions sent to that address, and the request you ticked for access to start straight away, with when you ticked it, all linked to your account. If you withdraw from a Bitcoin purchase on the site, we note which order and when; the name you give goes only into the acknowledgement we email you. Bitcoin transactions are public by design, so anyone can see payments to an address, though not who made them.
• Emails about your account. We email you what your membership needs: a confirmation after each purchase or plan change, of a cancellation wherever you make it, and of a withdrawal you make on the site; Bitcoin receipts; the tracker reminders you ask for; and replies when you write to us. They go to the address on your account or, for a card purchase, the one given at checkout. If you email us, we keep your message and our reply.
• Email updates. If you ask to be emailed when a new article is published, on the email form or by ticking the box when you create an account, we keep your email address, the wording you agreed to and when. If you ticked the box when creating an account, that wording includes occasional offers and we may also email you offers; the email form is for new articles and nothing else. The box on the account form starts unticked. An address that isn't confirmed within 30 days is deleted. You can unsubscribe at any time at growtallest.com/email or from the link at the foot of each of these emails. When you unsubscribe or ask us to, we delete your address and keep only a coded form of it, so it isn't emailed again. Deleting your account takes the address you signed up with off the list; one you added on the email form stays until you unsubscribe.
• Affiliate applications. If you apply to the affiliate program, we collect the link to your profile, your main platform, an approximate follower range, and what you write about how you'd promote the site. If we approve you, we also collect the name and email on your PayPal or Wise account, and your Bitcoin address if you give one, so we can pay you. This is stored against your account and used to review your application, pay your commission, and run the self-referral check above, which compares buyers who use your code with your account emails and the cards you have paid us with. Commission paid in bitcoin is a public transaction to the address you give us.
• Growth tracker. If you use the growth tracker, we store what you enter there against your account: your date of birth, whether to read you against the male or female growth chart, your parents' heights if you choose to give them, each height and weight you log with its date and any note you add, and any supplements you list with their amounts. This is health information, so the tracker saves it only with your explicit consent: you give it by ticking the box before the tracker first saves anything, and we keep a record of when you did and the words you agreed to. What was saved before October 25, 2026, when the tracker began asking, is kept as it is until you agree or erase it; nothing more is saved, and no reminder is sent, until you agree. We use it only to draw your own chart, work out your own figures and, if you turn them on, send your reminders. It is never shown to anyone else, never used to advertise to you, and never sold. The tracker won't save a date of birth under 13. You can export your log as a file, or erase all of it at once from the tracker, which withdraws your consent; deleting your account removes it too. More in our consumer health data policy.
• Tracker reminders. If you turn on reminders, we keep that choice and the date of the last reminder. Once 90 days have passed since your last logged height, we email your account address with the date of that measurement, at most once every 90 days. Turn them off on the tracker page; they also stop if your membership ends.
• Account protection. When a member opens a locked page, we note which device (sign-in session) opened it, which page, and when. We use this only to keep an account to 3 devices at once, signing out the ones used longest ago, and to pause locked pages for an hour if an account opens more than 40 of them within 10 minutes or more than 150 in a day. When either happens, we're told the account number. These records are deleted 14 days after the account last opens a locked page. The text of a locked page you read also carries a code linked to your account, in characters that take no space, and a printed or saved copy shows your email at the top of every page, so a copy shared outside the site can be traced to the account it came from. The code stays linked to your account until you delete the account, which removes all of it.
• Reading progress. When you reach the end of an article, we note which article it was against your account, to show how much of the library you have read and mark what you have finished. This record holds no dates or times. Deleting your account removes it.
• Discord. If you join our Discord server through the site, we store your Discord user ID against your account, so we can give you the roles your membership or affiliate account includes and remove them when it ends. We also store your Discord display name, username and profile picture, so your account page can show you which Discord account is linked, and we refresh them daily while the link lasts. We see what you post in the server. We only ask Discord for your basic profile and permission to add you to the server, and we don't keep the access Discord gives us. Unlinking or deleting your account removes all of it. Every lifetime member can read what's posted in #coaching, so don't post anything private there, about your health or anything else.
• Telegram. If you link Telegram from your account page, we store your Telegram user ID, name and username against your account, so we can let you into the groups your membership or affiliate account includes and show your role (Member, Lifetime or Affiliate) beside your name there. Everyone in a group can see that role, including, in our public group, people who aren't members. When your access ends, we remove your role and may take you out of the group. Linking works through our Telegram bot: you open it from your account page and press Start, and we don't ask Telegram for anything else. If you ask to join one of our groups, the bot checks your Telegram user ID against linked accounts to decide, and keeps nothing about you unless you have linked one. We see what you post in the groups. Like every Telegram bot that helps run a group, ours is sent the messages posted there; it ignores them and keeps none. Disconnecting Telegram on your account page, or deleting your account, removes the link and the stored name.
• Usage data. We use Vercel Web Analytics to count visits. For each page view it records the page address, the site you came from, your approximate location, and your browser, operating system and type of device. Page addresses are sent without anything personal in them, such as the email address in an unsubscribe link. It sets no cookies and doesn't follow you to other sites: it tells visits apart with a code made from your connection, which Vercel discards after 24 hours. We also keep daily totals of a few steps, such as how many checkouts were started and paid; these are plain counts with nothing about who took them.
• Technical data. Like any website, ours receives your IP address and details of your browser with each request. Some forms count requests per IP address, for up to 10 minutes, so they can't be sent too often. Our error log keeps its last 200 entries, which can include an account number but no email or card details.

How we use it, and our legal basis

We use each kind of data only for the purposes given above. Under the GDPR and the UK GDPR, our legal basis for each is:

• Running your account and membership: access, renewals, cancellations and withdrawals, purchase confirmations and receipts, Discord and Telegram roles, article requests, reading progress, affiliate payouts and support. Contract: we need it to give you what you signed up for.
• The growth tracker. Your explicit consent.
• Tracker reminders, article emails, offers, and the referral cookie where we ask before saving it. Your consent. Elsewhere, the referral cookie rests on legitimate interests: applying your discount and crediting the affiliate who sent you.
• Account protection: the device limit, the reading pause, the code in locked pages and the email on printed copies. Legitimate interests: stopping shared logins and copying of paid content.
• The self-referral check. Legitimate interests: preventing commission fraud.
• Running our Discord server and Telegram groups for everyone in them, members or not: deciding requests to join, showing members' roles, and acting on reports and on posts that break the community rules. Legitimate interests: running the community and keeping it safe.
• Reporting a crime, or giving data to the police, a regulator or a court where the law requires it. Legitimate interests: keeping people safe, children above all, and meeting our legal duties.
• Visit statistics, daily counts, the human check, rate limits, the error log and backups. Legitimate interests: understanding and protecting the site, and not losing your data.
• Payment, tax and commission records, and the record of what you agreed to when you bought. Legitimate interests: keeping the records Singapore tax law and California's renewal law require, and being able to show what was agreed.

Your right to object. You can object at any time to anything we do on the basis of legitimate interests, and to direct marketing, which then stops. Email growtallest.com@gmail.com with "Data protection" in the subject.

Under Singapore's PDPA, we rely on your consent, and on the legitimate interests exception for account protection, the self-referral check, the human check and rate limits. Our Data Protection Officer answers questions about it.

Cookies and browser storage

Clerk, which runs sign-in, sets its own cookies (such as __session and __client_uat) so you stay signed in; one of our scripts reads __client_uat only to show the right header before Clerk loads. They're needed for the site to work and aren't used for tracking or advertising. We don't use advertising or cross-site tracking cookies.

If you arrive through an affiliate link, we store that affiliate's code in a first-party cookie (gt_ref) for 30 days, so that your discount is applied at checkout and the affiliate who sent you is credited. If you're in the EU, the EEA, the UK, Switzerland, Gibraltar, the Channel Islands or the Isle of Man, or we can't tell where you are, we ask you first and only save it if you agree. It holds the code and nothing else, it isn't shared with anyone, and it can't be read by other sites. Clearing your cookies removes it.

When you're signed in and have a membership, we set a cookie (gt_member) that holds only your plan (monthly or lifetime) or the value 1, so the site can hide its "Join" button from you and mark your plan on the pricing cards. It grants nothing. It lasts 30 days, and is removed the next time the site finds you are no longer a member.

When you pass the "Verify you are human" check on the affiliate application, we set a cookie (gt_human) that proves it for two hours, so the application can still be sent after you create an account. It holds the time and a signature, nothing about you, and is removed once the application is sent.

When you join our Discord from your account page, we set a cookie (gt_discord_state) holding a random value for up to 10 minutes, to check that the answer coming back from Discord is for the request you started.

Your browser's own storage also keeps, on your device only: an affiliate application you start without being signed in (gt_affiliate_draft), until it is sent or 7 days pass, so that creating an account doesn't lose it; a referral code you type on the pricing card, with its discount, for that tab only (gt_typed_ref); which locked page you were reading when you went to join (gt_resume), so your account page can offer it back after you pay, which, where we ask before saving the affiliate cookie, is kept only once you press a link on that page, and only for that tab; which activity level you last picked for the tracker's calorie figure (gt_activity); and that you've been shown the height questions on the homepage (gt_intro_seen). Your answers to those questions stay in your browser: they aren't saved, and aren't sent to us.

Who we share data with

We share data with the companies below, each for the purpose given. Most store or process it for us. Link, Discord, Telegram, PayPal and Wise also use it for their own purposes, under their own privacy policies.

• Clerk: sign-in and accounts, including the device records above.
• Link (Sold through Link, LLC) and Stripe: Link sells and charges card purchases as merchant of record, covering payment, tax, receipts, refunds and billing support; Stripe runs checkout and holds our billing records.
• Vercel: hosting and visit statistics.
• Upstash: our database. It stores Bitcoin payment records, the email update list, the record of what card buyers agreed to, what you enter in the growth tracker and your reminder choice, which articles you have read, the account-protection records, which Discord or Telegram account belongs to which member, with its name (and, for Discord, its picture), our error log, and the per-IP request counts.
• Cloudflare: runs the "Verify you are human" check on the affiliate application, and on sign-up as part of Clerk's bot check. It sees your IP address and details of your browser.
• Resend: sends our emails, such as sign-up confirmations, purchase confirmations and receipts, tracker reminders, article emails, affiliate emails, our own alerts and our weekly backup. It receives your email address and each message.
• Google: hosts our Gmail mailbox, where your emails to us arrive, along with our own alerts and the weekly backup.
• Discord: hosts the members' server, if you join it.
• Telegram: hosts our public group and any members' groups you join. Our own alerts also reach us there, and can include an account number.
• PayPal and Wise: pay affiliates' commission on card sales. If you're paid this way, they receive the name and email on your payout account and the amount.
• mempool.space and Blockstream: we ask them whether payments have reached your payment address. They receive the address, not your account details.

We don't sell your data, and we don't share it with anyone for their own marketing. We give it to the police, a regulator or a court only where the law requires it, or to report a crime such as the sexual abuse of a child.

Where your data goes

We're in Singapore. The companies above store and process data outside Singapore, mainly in the United States, and Resend sends our email from Japan. Where EU or UK law protects your data, transfers to the companies that process it for us (Clerk, Vercel, Upstash, Resend, Cloudflare and Stripe) rely on an adequacy decision (as for Japan), on the EU-US Data Privacy Framework and its UK Extension for companies certified under it, or on the European Commission's standard contractual clauses, with the UK Addendum, in that company's data processing terms. Google, which hosts our mailbox, is certified under that Framework. Link, Discord, Telegram, PayPal and Wise receive data under their own policies when you use them through us: to pay, to join our community, or to be paid. Email us for a copy of these safeguards.

Data retention

We keep your account, and what is linked to it, until you delete the account. Deleting it cancels any card subscription so you aren't billed again, turns off your referral codes if you're an affiliate, and removes the growth tracker, your reading progress, the account-protection records, your Discord and Telegram links, and your Bitcoin order, paid or not, with the request you ticked on it. Link and Stripe keep card payment records as the law requires them to.

The record of what you agreed to when you bought by card is kept for three years, or until a year after the subscription ends if that is later, as California law requires; deleting your account doesn't remove it before then.

We keep records of Bitcoin payments already received (the account number, plan, amount, date, any affiliate code, the payment address and the transaction IDs), and of any withdrawal from them, for as long as Singapore tax law requires us to keep business records, currently 5 years. The payment address stays linked to the account number so that a payment reaching it later can still be traced and refunded. These records hold no name or email.

An affiliate application, with your payout details and the payouts we've sent you, stays on your account until you delete the account. Our error log keeps only its last 200 entries, and our own alerts are kept only as long as we need them to deal with what they report. Emails you send us are kept for as long as we need them to help you.

Once a week we email ourselves a backup of what is held only in our own database, except the growth tracker: the email update list with its consent records and coded unsubscribes, card buyers' consent records, which Discord or Telegram account is linked to which account, Bitcoin payment records and our error log. It goes through Resend to our private mailbox, and we delete each one within 60 days. We can also download a full copy, growth tracker included, and we delete any copy we download within 60 days. When you erase your growth tracker, unsubscribe, unlink an account or delete your account, that data is removed from the site at once, and from our backups within 60 days.

Your rights

You can see and update your account details on your account page, cancel your membership there, and delete your account in Sign-in settings. The growth tracker has its own Export and Erase. You can also ask us for a copy of your data, to correct it, to delete it, to restrict what we do with it, or to send it to you in a machine-readable file. You can withdraw any consent at any time: unsubscribe, erase the tracker, turn off reminders or clear the referral cookie. Email growtallest.com@gmail.com with "Data protection" in the subject. We reply within 28 days.

You can also object, as set out above, and complain to a data protection authority: in the EU, the one where you live (listed by the European Data Protection Board); in the UK, the ICO; in Singapore, the PDPC.

Consumer health data

Our consumer health data policy, for Washington's My Health My Data Act and similar US state laws, is at growtallest.com/consumer-health-data.

Data Protection Officer

GROW TALLEST has appointed a Data Protection Officer, as Singapore's Personal Data Protection Act requires. Reach them at growtallest.com@gmail.com with "Data protection" in the subject line.

Children and teenagers

Teenagers use GrowTallest, including the library and the growth tracker. You must be 13 or older to create an account or use the tracker, and the tracker won't save a date of birth under 13. If we learn that a child under 13 has given us personal data, we delete it. If you think one has, email growtallest.com@gmail.com.

Changes to this policy

If this policy changes materially, we'll update the date at the top of this page.

Contact

Questions about this policy: growtallest.com@gmail.com, or by post to GROW TALLEST, 70 Bayshore Road, #22-12 Costa del Sol, Singapore 469987.