GDPR Last updated: 15 September 2026

Privacy notice

This notice covers the website gruvon.app and the app lets.gruvon.app. We collect as little as we can and use your data only to run gruvon. The German version (Datenschutzerklärung) is the binding one.

1. Who is responsible

Forest River UG (haftungsbeschränkt)
Hofkoppel 17
23715 Bosau
Germany
Email: info@foriver.de

We have not appointed a data protection officer because we are not required to.

2. Hosting of the website and the app

The website and the app’s interface are served by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. On every request Vercel processes what is technically needed: your IP address, date and time, the address requested, the referrer and your browser’s details (user agent). This serves delivering and securing the pages (Art. 6(1)(f) GDPR). Vercel is certified under the EU-U.S. Data Privacy Framework and keeps these logs only as long as it needs them for those purposes.

3. Audience measurement on gruvon.app (PostHog)

To understand how many people visit the website and whether they find their way to the app, we use PostHog (PostHog Inc., USA) with data stored in its EU cloud in Frankfurt.

• No cookies are set and nothing is stored in your browser.
• We record the page view (address, referrer, browser, operating system, device type, how far you scrolled), which chapters of the page came into view, a click on a colour swatch, and a click on a button that leads to the app (which button, which language). The link to the app then carries a note of which button it was, so the app can count sign-ups per button; it identifies no one.
• Each page load gets a random ID that exists only while the page is open. Nothing links it to an earlier visit, so every visit counts as a new one.
• When a page view arrives, PostHog derives your approximate location (country, region, city, postcode) from your IP address and then discards the IP address; it is not stored.
• There are no session recordings, no heatmaps and no user profiles.

The legal basis is our legitimate interest in privacy-friendly audience measurement (Art. 6(1)(f) GDPR). PostHog is certified under the EU-U.S. Data Privacy Framework. You can object by using a content or script blocker that blocks PostHog — then nothing is sent. How the app measures its use is described in section 5.

4. Fonts

The website loads its fonts (Space Grotesk, Space Mono) from gruvon.app itself; no data goes to third parties.

The app currently still loads the same fonts from Google Fonts (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), which receives your IP address and browser details. The legal basis is our legitimate interest in a consistent appearance (Art. 6(1)(f) GDPR). We are moving the app to self-hosted fonts.

5. The app at lets.gruvon.app

Account. For an account we store your email address, your password (only as a secure hash), your display name and, if you set them, profile photo, language and theme. Your profile is visible to you, to the members of your bands (also after they leave a band, so history keeps their names) and to people you invited to a band while the invitation is open.

Your band’s content. Songs, setlists, uploaded files and recordings, runs with ratings and notes, gigs (including venue contact details you enter), availability and RSVPs, the band ledger, gear and to-dos. The members of that band see this content, depending on their role. Practice sessions are private and visible only to you. Profile photos and band logos are kept in public storage: anyone with the link can fetch the image.

Invitations. When an admin invites someone, we store the email address they enter with the role and expiry date, and send that address an invitation with the band’s name, the inviter’s name and a link.

Calendar subscription. A band’s calendar feed is a secret link. Anyone who has it sees the band’s events (gigs, rehearsals, proposals), but no names, RSVPs or finances. Admins can replace the link at any time.

Storage in your browser. The app keeps what it needs to work in your browser: your sign-in session, the band you selected, theme and language, and hints you dismissed. This is strictly necessary for the service you asked for (§ 25(2) no. 2 TDDDG); the app sets no cookies.

Purpose and legal basis. We process these data to provide the app to you (Art. 6(1)(b) GDPR). An invitation to someone who has not signed up yet rests on the band’s legitimate interest in inviting its members (Art. 6(1)(f) GDPR).

Usage analytics in the app (PostHog). To see which parts of the app bands actually use and where they get stuck, the app reports usage events to PostHog (see section 3; EU cloud, Frankfurt). An event says what was done — for example “a rehearsal session was ended”, “a setlist was exported”, “an invitation was accepted” — together with the screen path, the time, your browser and device type, your language and theme, the band it concerned and that band’s name and size. You appear under your account’s technical ID, not your name or email address. The content stays out: no song titles, no names of members, no venues, no amounts, no notes, no file names. On arrival PostHog derives your approximate location (country, region, city, postcode) from your IP address and then discards the IP address. The app stores nothing for this in your browser; there are no session recordings. Practice sessions report only that a practice run was logged, never which song. The legal basis is our legitimate interest in running and improving the app (Art. 6(1)(f) GDPR); you can object at any time by writing to the address in section 1.

Feedback you send from the app. The app has a feedback form (Feedback in the sidebar, or Send Feedback in the account menu on a phone). You pick a kind — bug, idea or something else — and write a message. This is the one place the app sends text you wrote yourself, and only when you press Send: nothing is sent while you type, and nothing if you close the form. The message goes to PostHog (as above) together with your account’s technical ID, the band you have open and your role in it, the screen path, and your browser and device type — never your name or email address. We use it to fix what is broken and to decide what to build next; the legal basis is our legitimate interest in improving the app (Art. 6(1)(f) GDPR). A content blocker that blocks PostHog blocks feedback too; you can always write to the address in section 1 instead. Ask us to delete a message you sent at any time.

Database and files: Supabase. The app’s data and files are stored with Supabase in Frankfurt (AWS region eu-central-1). Where Supabase or its subprocessors access the data from outside the EU, this is based on the EU Standard Contractual Clauses.

Email: Resend. Confirmation, password and invitation emails are sent through Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA) from its Ireland region (eu-west-1). Resend is certified under the EU-U.S. Data Privacy Framework.

How long. We keep account data as long as your account exists. A band’s content stays until the band deletes it or the band is deleted. Email us if you want your account deleted — the app has no delete function yet.

6. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Write to the email address above. You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

7. Changes

When gruvon changes, we update this notice. The version published here applies.