Privacy Policy

1. What data we collect

We only collect what we actually need to run Ecogru and keep it safe. If you have an account, we collect:

• Your name, email address and country. A phone number, location or company name only if you add them.
• Your skills, a one-line headline and the hours a week you can give, if you add them.
• A profile photo, if you choose to add one.
• Your profiles: links you add (LinkedIn, Instagram, GitHub, a portfolio or any other site). At least one is required. We don't fetch or import anything from them.
• The ideas you post, and messages, files and activity inside the workspaces you're part of. That includes what a team writes on its journey: the customer talks it logs (a date, who they spoke to and what was said; log only what you need, and not someone's contact details), the company's name, country and registration number, the pitch outline, and documents in the data room.
• Skill confirmations left by owners of ideas you've worked on.
• When you sign an NDA or accept a planned ownership agreement: the legal name you sign with, the time, and the IP address you signed from (for an NDA, also your browser details).
• Basic payment information if you subscribe to a paid plan (see section 5).

For everyone, we also automatically collect some basic technical information — like device type, browser, and general usage patterns (for example, which pages get used most) — so we can keep Ecogru working well and fix problems.

2. How we use your data

We use your information for one simple purpose: to make Ecogru work well for you. Specifically, that means:

• Showing your profile to other signed-in people, like the owners of ideas you ask to join and your teammates. Until 23 October 2026 we also counted who viewed each profile; we no longer do, and the views we recorded are deleted 90 days after they happened.
• Letting you communicate, share files, and collaborate inside workspaces.
• Showing trust signals on your profile (whether your email is confirmed, the links you added, skill confirmations from teammates and teams completed) so people can decide who to work with (see section 4).
• Processing subscription payments, where applicable.
• Sending you important notifications — like invites, messages, and account activity.
• If you connect an AI app (such as Claude, ChatGPT, Gemini or Cursor), answering its requests as you. See AI apps you connect.
• Improving Ecogru over time, based on how the platform is actually used.
• Keeping the platform safe — detecting fraud, abuse, and violations of our Terms of Service.

We do not use your personal data to sell you unrelated advertising, and we do not sell your data to advertisers or data brokers.

3. How it's stored and protected

Your data is stored on secure servers, protected with industry-standard measures to keep it safe from unauthorised access.

• Passwords are never stored in plain text — they're encrypted so that even we can't read them.
• Access to sensitive data (like evidence attached to a dispute) is limited to the small number of people who need it to do their job, for example reviewing a reported problem.
• We use secure, encrypted connections (HTTPS) for all traffic between your device and Ecogru.
• Traffic to Ecogru passes through Cloudflare, which protects the site from attacks. When you sign up, sign in, ask for a sign-in link or contact us, Cloudflare Turnstile checks in the background that you're a person, using your internet address and basic browser details. You don't have to solve a puzzle, and Ecogru gets only a pass or fail.
• We keep your data only for as long as your account is active, plus a reasonable period afterward in case it's needed for legal, security, or dispute-resolution reasons — after that, it's deleted.

No system is 100% risk-free, and we can't promise perfect security — but we take real, practical steps to protect your information, and we'll tell you promptly if something ever goes wrong that affects your data.

4. The Trusted badge (no ID or biometric data)

Ecogru doesn't collect government ID documents, selfies or any biometric data. We used to offer optional ID verification; we ended it in October 2026 and permanently deleted every ID document and selfie we held.

Instead, profiles show facts you can check yourself, and a Trusted badge for people who have the basics:

• Trusted means your email address is confirmed and at least one of your profiles is linked (LinkedIn, GitHub, Behance, Dribbble, a portfolio or any other site). We only check the link's format.
• Every profile shows whether the email is confirmed, the profiles linked, skill confirmations and reviews from teammates, teams joined, ideas finished, and when the person joined.
• Your profiles are links you type in. We check that each one has the right shape for its site (a LinkedIn link must be a linkedin.com/in/ profile, for example), but we don't sign in to those sites, fetch them or import anything. Anyone can report a link as "This person is using my profile".
• Until 23 October 2026, to check skill confirmations, we kept a scrambled (keyed hash) version of the internet address and of a random browser cookie each time you signed in, never the raw values. We no longer collect it. What we kept is deleted 180 days after it was recorded, or when you delete your account.
• Team calls run on Jitsi Meet (meet.jit.si) inside the idea's workspace; Ecogru doesn't record them.
• Being Trusted never depends on a paid plan.

5. Payment data

Ecogru's plan, Pro, is sold by our payment provider, which acts as the merchant of record (see the Terms). When you pay, you give your card or other payment details to the payment provider, not to Ecogru, and its own privacy notice covers them.

• Ecogru never sees or stores your card number.
• From the payment provider we keep only what we need to run your plan: which plan you have, its status (active, payment failed, cancelled), when it renews or ends, and its reference numbers for your subscription and customer record.
• When you check out, we tell the payment provider your email address and which Ecogru account the plan is for.
• Ecogru doesn't take or pass on payments between members.
• If you delete your account, we cancel your plan at once and delete our plan records. The payment provider keeps its own transaction records as tax law requires.

6. Who we share data with

We share your data only when it's genuinely necessary — never to make money from selling your information.

• Other Ecogru users, appropriately. Your profile (name, photo, skills, headline, your profiles and the trust facts in section 4) is visible to other signed-in users as part of how Ecogru works; profiles aren't shown to people who aren't signed in. An idea's title, short pitch, skills needed and stage are public, so anyone can find it; the owner's name needs sign-in, and the private details need the NDA. Your email address and phone number are never shown to other users.
• People an idea's owner shares the data room with. An owner can make a read-only link to the idea's data room. Anyone holding the link can see the documents' names and download them, without an account, until the link expires after 30 days or the owner turns it off. They see nothing else from the workspace.
• Service providers we trust. We work with a small number of carefully chosen providers who help us run Ecogru — for example, secure cloud hosting and payment processing. They only get the specific data they need to do their job, and they're not allowed to use it for anything else.
• Legal requirements. If we're required to by law — for example, a valid court order — we may need to share specific data with the relevant authority.
• Safety situations. If we believe someone is at risk of harm, or serious fraud or abuse is happening on the platform, we may share relevant information as needed to protect people.

We do not share your data with advertisers, marketers, or data brokers.

7. AI apps you connect

You can connect an AI app that supports MCP (for example Claude, ChatGPT, Gemini CLI, Cursor or VS Code) to your Ecogru account. Nothing is connected unless you do it: you sign in from the AI app and press Allow on Ecogru, or you make a personal key yourself. We use your data this way because you asked us to.

• What it can read. Only what you can see in Ecogru: your own ideas and the ideas you joined, and for those, the tasks, project updates, the names of shared files (not the files), the Ready to start checklist and the planned ownership, where you have access to them in the app. Private idea details only where you own the idea or are on its team and signed its NDA. It can also search the public list of ideas.
• What it can add. Idea drafts (only you can see them, and you post them yourself), tasks, a task's status and project updates, in your name. The AI app should ask you before each of these.
• What it never gets. Anyone's email address, phone number or other contact details, and the links to shared files. It can't sign an NDA, accept or change planned ownership, invite or remove people, make payments or delete anything.
• Where the data goes. What the AI app reads is sent to the company that runs it (for example Anthropic, OpenAI, Google or Cursor) and is handled under your own account and agreement with them, not by Ecogru. Connect only apps you trust with your ideas.
• What we keep. The app's name and the address it sends you back to; a scrambled (hashed) copy of each sign-in token and personal key, never the token itself; and a log of each request (which connection, which tool, a short copy of what it asked, and whether it worked), kept for 90 days. Sign-in tokens expire after an hour and are renewed while you stay connected. Drafts you haven't posted are kept for 30 days.
• You're in control. Settings, Connect your AI lists every connected app and key. Disconnect or revoke any of them in one click and it stops working at once. Deleting your account removes your connections, keys, their log and your drafts.

8. Your rights over your data

It's your data, and you're in control of it. At any time, you have the right to:

• See what we have. You can request a copy of the personal data we hold about you.
• Correct it. If something in your profile or account is wrong, you can update it yourself, or ask us to fix it.
• Delete it. You can delete your account and request that we permanently remove your personal data, subject only to what we're legally required to keep for a limited time (for example, financial records for tax purposes).
• Download it. You can request an export of your profile and workspace data in a readable format.
• Object or restrict. You can ask us to stop a specific use of your data that you're not comfortable with, and we'll do our best to accommodate that request.

To use any of these rights, just contact us — see below. We aim to respond to every privacy request within 30 days.

9. Contact us about privacy

If you have any questions, concerns, or requests about your privacy or personal data on Ecogru, reach out any time:

• Email: BY@ecogru.com
• We aim to respond to every message within a few working days, and to fully resolve data requests within 30 days.

Related reading: our Terms of Service covers the broader rules for using Ecogru.