Gromi Privacy Policy

Last updated: 8 October 2026

The short version

• Your conversations live on your iPhone. Everything Gromi knows about you is stored in the app on your phone, not on our servers: your chats, photos, voice transcripts, tasks, reminders and what Gromi remembers.
• To answer you, the parts an answer needs go to AI providers at that moment. Text chat goes through OpenRouter under zero data retention: the content isn't stored or used for training. Live voice, dictation and photos shown during a voice conversation go to OpenAI, which may keep them for up to 30 days to check for abuse and then deletes them.
• Nothing goes to the AI until you agree. Gromi is an AI companion, so using it needs your agreement to AI processing. You can turn Gromi's AI off at any time in Settings; Gromi then waits at the consent screen until you agree again, sends nothing more, and keeps your data on your iPhone.
• Our servers keep almost nothing about you. We keep an account made of scrambled (hashed) identifiers, and technical counts that contain none of your content and aren't linked to your account.
• No ads, no analytics, no tracking, and we never sell your data, in the app or on this website.
• You can delete everything from Settings → Delete account, or from the consent screen if you haven't agreed to AI processing.

1. Who we are

Gromi is provided by BYGEN AI Kft. (VAT 32746763-2-04, seat 5600 Békéscsaba, Lázár utca 3, Hungary), the controller of the personal data described here. Contact: privacy@bygen-ai.com.

This policy covers the Gromi iOS app and the services behind it. We're based in the EU, so the GDPR applies to our processing wherever you are. The app is currently offered in the United States. Section 13 covers California.

2. What stays on your iPhone

The app keeps its data in a database on your iPhone:

• your conversations with Gromi, including reactions and cards;
• photos you attach;
• transcripts of voice conversations;
• your tasks and reminders;
• what Gromi noticed or remembers about you, and what you confirmed or turned down;
• your focus-timer history;
• your settings, such as your name, time zone, Gromi's personality, dictation language and voice;
• which calendar you connected, including the Google account email if you connected Google.

Your sign-in and any Google Calendar access are kept in your iPhone's Keychain, marked for this device only.

• Backed up with your iPhone. The database is included in your iCloud and computer backups, like other apps' data, so a new iPhone set up from a backup keeps your Gromi. Those backups are yours, under your Apple account and settings: Apple encrypts iCloud backups (end to end if you turn on Advanced Data Protection), and a computer backup is encrypted only if you choose to encrypt it. Your sign-in isn't backed up, so you sign in again on the new phone.
• Uninstalling deletes it. Deleting the app deletes everything Gromi stored on your phone. Copies in your own backups follow your backup settings.
• We can't see it. We have no copy and no way to read it.

3. What leaves your iPhone, when, and where it goes

3.1 Chatting with Gromi (text and photos)

When you send a message, your iPhone sends a request to our server. Our server passes it to OpenRouter, which routes it to an AI model; the chat model is currently GLM, made by Z.ai. The request carries what Gromi needs to answer:

• your message and any photo you attached. A photo is sent as a fresh copy without the location, camera and time details stored in the original file, and at most 1600 pixels wide;
• recent conversation, as text;
• your first name and time zone, and the personality settings you chose;
• facts you've pinned;
• your list of tasks, up to 80;
• a short summary of earlier conversations today;
• what's on screen when you ask, such as the calendar page;
• which calendar backend you connected.

When Gromi looks something up on your phone (your schedule, or a search of your messages and tasks), the result travels the same way. For your schedule that's the title, time and calendar name of the events it needs.

Every request to OpenRouter asks for zero data retention, and to be routed only to model hosts that don't collect data. The content isn't stored or used to train models by OpenRouter or the host that runs the model. Our server holds the request only while answering it.

3.2 Live voice conversations

When you talk with Gromi:

• Your microphone audio goes directly from your iPhone to OpenAI (its realtime voice model).
• Our server sets up the conversation. It sends OpenAI Gromi's instructions and the text of your recent voice conversations (up to about 60 turns), so Gromi can pick up where you left off.
• A photo you show during a voice conversation goes to OpenAI through our server, to be described in words for the conversation. It's sent as a copy without its location, camera and time details.

We ask OpenAI not to store these requests. OpenAI may still keep them for up to 30 days to detect abuse, and then deletes them. The transcript of your conversation is saved on your iPhone.

3.3 Dictation

When you speak a message instead of typing it, the recording goes through our server to OpenAI to be turned into text. OpenAI may keep it for up to 30 days, as in 3.2. The recording is deleted from your iPhone once it's transcribed, or after 24 hours if it can't be.

3.4 Gromi's overnight memory

When your iPhone lets apps run in the background, usually overnight, Gromi does two things.

Recap. It sends a finished stretch of conversation, as plain lines of what you and Gromi said, to write a short summary.

Noticing. It sends up to 300 of your own messages from the last 7 days and up to 300 tasks from the last 4 weeks, to notice things worth remembering. It gets back at most three suggestions, and nothing becomes a fact until you confirm it.

Both go through our server to OpenRouter under zero data retention, as in 3.1. The results are stored on your iPhone.

3.5 Calendars

Google Calendar. If you connect it, your iPhone talks to Google directly, and our server never does.

• Gromi asks for three permissions:
  • see the list of your calendars, so you can choose which ones Gromi may read;
  • view the events on your calendars, so it knows what's on your week;
  • create its own "Gromi" calendar and manage the events in it, to mirror your tasks.
• It reads only the calendars you allow: event titles, start and end times, and calendar names and colours.
• It writes only to the Gromi calendar.
• Google's access token stays in your iPhone's Keychain.
• Disconnecting revokes Gromi's access at Google. You can also remove it at myaccount.google.com/permissions.

iPhone Calendar. If you choose it instead, Gromi reads the same kinds of details through iOS and writes only to a calendar named Gromi.

What reaches the AI. Event details reach the AI model only as described in 3.1: when Gromi checks your schedule to answer you, when a search matches an event, or when you're on the calendar page while you chat.

When you disconnect or delete your account, events Gromi added stay in your calendar. Delete them there if you don't want them.

3.6 Signing in with Apple

Apple gives us an identifier for your Apple ID. We don't ask for your name or email, and we never see your Apple ID password. We store the identifier only as a keyed hash that can't be reversed.

When you delete your account, we revoke Gromi's access to your Apple ID with Apple.

3.7 Technical records on our server

For every chat turn and voice session, our server records a technical entry:

• which provider and model answered, and whether it succeeded or which kind of error occurred;
• how many tokens and seconds it used, and how long it took;
• how many tool calls it made;
• the hour it happened (not the minute);
• version identifiers for the software and prompt.

It contains none of your content, no account identifier and no identifier from your phone. We use it to run the service, find faults and understand cost, and delete it after 90 days.

3.8 App updates

Gromi receives small updates through Expo (EAS Update). When the app starts, it asks Expo's servers whether an update exists. That request carries a random installation identifier, the app's platform and version, and your IP address. Expo's privacy policy applies.

3.9 Purchases

Gromi doesn't sell anything in the app today. When it offers subscriptions, they will be bought through Apple, we won't receive your payment details, and this policy will say which provider manages subscription status before that happens.

3.10 Links

Links in Gromi's replies, and our privacy, terms and support pages, open only when you tap them. The site you open has its own privacy practices.

3.11 This website

gromi.me doesn't use analytics, advertising or tracking. It sets no cookies of its own. Loading a page sends your IP address to our host, Railway, to serve it, and the pages load their fonts from Google Fonts, which receives your IP address and browser details under Google's privacy policy.

4. Your agreement to AI processing

Before anything you send reaches an AI model, the app shows you what goes where and asks for your agreement. Gromi is an AI companion, so you need to agree to use it. If you decline:

• nothing is sent to the AI;
• Gromi stays on the consent screen until you agree;
• everything already on your iPhone stays there;
• you can still sign out or delete your account from that screen.

You can turn Gromi's AI off at any time in Settings → Gromi's AI. Gromi then returns to the consent screen, and you can agree again whenever you like.

If what you share includes sensitive information, such as your health or beliefs, it's processed as described above, only to answer you, and only because you chose to share it and agreed to AI processing.

5. Google user data

Gromi's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google Calendar data only to provide features you can see in the app: answers that know your schedule, and your tasks mirrored to the Gromi calendar.
• We transfer it only to provide those features, and only after your agreement to AI processing: the event details an answer needs go to the AI model as described in 3.1, under zero data retention.
• We don't use it to develop, improve or train any AI or machine-learning model, and our AI providers don't either.
• We don't use it for advertising, don't sell it, and don't transfer it to data brokers.
• Nobody at Gromi reads it. It's never stored on our servers. It stays on your iPhone, apart from the moment an answer needs it.

6. What we don't do

• We don't sell or share your personal information for cross-context behavioural advertising.
• We don't use analytics, advertising, attribution or crash-reporting services, in the app or on this website.
• We don't track you across apps or websites.
• We don't use your content to train AI models, and nobody at Gromi reads it.

7. Why we process your data (GDPR legal bases)

You can object to processing based on legitimate interests (section 12).

8. Who receives data

These companies act as our processors, or, for Apple and Google, under their own terms for their own services. We may also disclose data where the law requires it.

9. International transfers

Our server runs in the EU, and several providers are in the US. Where personal data moves between the EU and other countries, we rely on the EU–US Data Privacy Framework where the recipient is certified, or on the European Commission's Standard Contractual Clauses. Ask us for details at privacy@bygen-ai.com.

10. How long data is kept

11. Deleting your data

Settings → Delete account (also on the consent screen, if you haven't agreed to AI processing) deletes:

• your account and sign-in sessions on our server;
• Gromi's access to your Apple ID, revoked with Apple;
• your Google Calendar access, revoked;
• everything Gromi stored on your iPhone.

It can't be undone.

It also cancels any reminders Gromi scheduled on your phone.

It doesn't delete:

• technical records, which aren't linked to you and expire after 90 days;
• events Gromi added to your calendar;
• a subscription, which you cancel with Apple.

Signing out keeps your data on the iPhone, so you can sign back in.

12. Your rights

Under the GDPR you can:

• ask for access to, correction of, or deletion of your personal data;
• ask to restrict or object to its processing, or ask for a portable copy;
• withdraw consent at any time, without affecting what was done before.

Because your content is on your iPhone, you can see and delete it there directly. Our server holds only the hashed account data and technical records described above.

Write to privacy@bygen-ai.com. We answer within one month and may need to confirm your identity. You can also complain to a data protection authority, such as Hungary's NAIH or the authority where you live.

13. California

California residents have the right to:

• know what personal information we collect, use and disclose;
• have it deleted or corrected;
• not be discriminated against for using these rights.

We collect the categories described above: identifiers (hashed), content you choose to send for AI processing, and audio. We don't sell or share personal information, and we don't use sensitive personal information to infer characteristics about you. To make a request, write to privacy@bygen-ai.com.

Crisis protocol (SB 243). Gromi is an AI companion, not a person. If someone expresses thoughts of suicide or self-harm, Gromi refers them to 988 and other crisis resources. Our crisis protocol is published at gromi.me/safety. Companion chatbots may not be suitable for some minors.

14. Children

Gromi is for people aged 16 and over. It isn't directed at children under 13, and we don't knowingly collect their personal information. If you believe a child has used Gromi, contact us and we'll help delete the account.

15. Security

• Connections to our server and providers are encrypted (TLS).
• Sign-in and calendar credentials are stored in the iPhone Keychain for this device only.
• Our server stores only hashed identifiers, and logs never contain your content.
• The database on your iPhone is protected by iOS Data Protection and your passcode. In your iCloud or computer backups, those backups' own encryption applies.
• No system is perfectly secure. Tell us at privacy@bygen-ai.com if you suspect a problem.

16. Changes

We'll post changes here and update the date above. For material changes we'll also tell you in the app. If a change affects what reaches the AI, we'll ask for your agreement again.

17. Contact

BYGEN AI Kft., 5600 Békéscsaba, Lázár utca 3, Hungary. privacy@bygen-ai.com (privacy) · info@bygen-ai.com (everything else)