Privacy Policy

Who we are

Grsshppr is operated by Natan Santolo, an individual based in Singapore, who is responsible for your personal data (the data controller) and acts as the contact for data protection matters. Contact: natan.grsshppr@gmail.com.

What we collect

• Account details from the sign-in provider you choose (Google or GitHub): your name, email address and profile picture. If you add a passkey, we store only its public key and technical details about it — never your biometrics or device secrets.
• Sign-in records: the session that keeps you signed in, with the IP address and browser user agent it was created from, and the tokens your sign-in provider issues to us.
• Your profile: role (mentor or mentee), headline, bio, areas of expertise, years of experience, links you add and, for mentors, weekly availability and time zone.
• Mentoring activity: session requests and bookings (times, status, cancellation reasons), shared session notes, goals and their progress, feedback ratings and comments, and in-app notifications.
• Emails we send you about your sessions, such as requests, confirmations and cancellations.

We do not use analytics, advertising or tracking cookies, and we do not sell or rent personal data.

Why we use it

• To create and secure your account and keep you signed in.
• To show profiles, match mentors and mentees, and book and manage sessions.
• To send you emails and notifications about your sessions.
• To keep the service safe, prevent abuse and fix problems.

We use your data only for these purposes. If you are in the EU or UK, our legal bases are performing our agreement with you (providing the service), our legitimate interest in keeping it secure, and your consent where we ask for it (for example, connecting a calendar).

What other people can see

• Mentor profiles are public. A mentor's name, picture, headline, bio, expertise, links and whether they are taking new mentees can be seen by anyone, including search engines.
• Mentee goals stay private. A mentor's public profile shows only how many mentee goals they have helped achieve — never a goal's title or who it belongs to. Mentee profiles are not public.
• The people you have sessions with can see your name and picture, the session details, shared notes, and goals linked to your sessions.

Who processes your data

We use a small number of service providers to run Grsshppr:

• Vercel — hosting the website and keeping short-lived operational logs.
• Neon — hosting the database.
• Resend — sending emails.
• Google and GitHub — signing you in, if you choose them. Their own privacy policies apply to your accounts with them.

These providers may process data outside Singapore, including in the United States. Where they do, we rely on their contractual commitments to protect it to a standard comparable to Singapore's Personal Data Protection Act.

Google user data

If you sign in with Google, we receive your name, email address and profile picture, and use them only to create and identify your account.

When Google Calendar integration becomes available and you choose to connect your calendar, Grsshppr will only create, update and delete the events for your Grsshppr sessions on your own calendar. Those events carry no other participant's contact details. We do not read your other events, and you can disconnect at any time, which revokes our access.

Grsshppr's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, do not sell it, and do not use it to train AI models.

Cookies and local storage

We use one strictly necessary cookie to keep you signed in. Your browser's local storage remembers small preferences, such as light or dark mode and dismissed prompts. None of these track you across other sites.

How long we keep it

We keep your data while your account exists. When you delete your account, we delete your name, email, picture, profile, availability, goals, the feedback you gave, notifications, sign-in records and passkeys. Upcoming sessions are cancelled and the other participant is told. Past sessions stay in the other participant's history, with you shown only as “Deleted user”: the session times, the shared notes you wrote together and any feedback they gave are kept for them. Copies may persist in encrypted backups and provider logs for a short period before they are overwritten.

How we protect it

Data is encrypted in transit, access is limited to what is needed to run the service, and the code is public for anyone to review. No system is perfectly secure; if a breach affects your data, we will notify you and the relevant authorities where the law requires it. Please report security issues as described in our security policy.

Your rights

Under Singapore's Personal Data Protection Act, you can ask to access your personal data, ask us to correct it, and withdraw your consent (which may mean we can no longer provide the service to you). If you are in the EU or UK, you also have the right to erasure, to restrict or object to processing, to data portability, and to complain to your local data protection authority.

You can edit your profile and delete your account yourself in Settings. For anything else, email natan.grsshppr@gmail.com. We will respond within 30 days.

Age

Grsshppr is for people aged 18 and over. We do not knowingly collect data from anyone younger; if you believe we have, contact us and we will delete it.

Changes to this policy

We will post any changes on this page and update the date above. For significant changes, we will also let you know by email or in the app. Earlier versions are in the public history of this page.

Contact

Questions or requests about your data: natan.grsshppr@gmail.com.