Is Grass Safe? What the App Accesses and What It Never Touches

Reassurance is cheap, and a skeptical reader is right to discount it. I've spent years writing about everyday consumer tech, and the claims that hold up are the ones you can check against something concrete: a permission prompt, a publisher name, a named entity with a registered address. This guide tests Grass against exactly those things.

Start with a naming problem most safety guides skip. According to WRDW, "touch grass" is internet slang for someone who needs to get back to reality, and the phrase now names more than one app. A search for a Grass safety answer can surface unrelated screen-time tools with their own permissions and their own privacy labels. One such App Store listing declares that no data is collected, while the store itself notes it has not verified that claim. What this means is simple. A label is a claim, not a check.

Grass is a different kind of product entirely. A node is the device running the app. It shares only the unused bandwidth on your connection so verified institutions can gather public web data, and you can pause it whenever you like.

Below, I walk through four things in order: what the app touches, every permission it requests, how to confirm your download is genuine, and who stands behind it. Each claim comes with its source and its date. That way you can weigh the evidence yourself.

What does Grass access on your device, and what does it never touch?

The app uses one thing: the unused portion of your internet connection. It never accesses your personal files, browsing history, passwords or accounts, and personal activity stays separate from network traffic.

A practical way to judge any app like this is the two-column test: write down what the app is built to use, write down what it has no route to, then check whether the evidence fills both columns. An analysis of 3 sources shows the same boundary. Grass's own privacy scope, a 2024 interview with a Wynd Labs co-founder and a 2026 analyst write-up all describe one job: carrying requests for public web data over spare connection capacity.

Two terms matter here. A node is the device running the app - your laptop or phone. Unused bandwidth is the capacity you're not using right now. And you almost never use all of it at once: even while streaming, downloading, or on a call, there's usually spare capacity left over, and that's the part Grass uses. If you ever do need the full connection, Grass steps aside so your activity comes first.

Think of it like a friend using your Wi-Fi. They share the connection, but they cannot open your laptop, read your messages or see which sites you visit. That is the relationship the app is designed around.

According to Andrej, CEO and co-founder of Wynd Labs, speaking to WuBlockchain in 2024, a device running the app "acts as a node, simply routing the web request." He said the only data being accessed comes from the internet, not from the device itself. He was also candid that the node uses "a little bit of CPU and bandwidth," which is true of any program left running.

What the app uses	What it never touches
The unused portion of your internet connection	Personal files and photos
A small amount of processing power to route requests	Browsing history
Public web requests from verified buyers	Passwords
Connection status, used to record uptime	Your online accounts

A common misconception is that sharing a connection means sharing what happens on it. The reality is narrower. Your personal activity is structurally separate from the network's public web traffic.

The reward system reflects the same boundary. Contribution is measured in Grass Points: Network Points when a node's bandwidth is actually used, and Uptime Points for staying reliably connected. Neither kind records what you browse, type or store. Points are an in-app measure of contribution, not a currency.

The other side of the connection is vetted too. According to Chris Kim's 2026 analysis on Substack, every buyer must pass Know Your Business (KYB) or Know Your Customer (KYC) verification, meaning an identity check on the organization or person, and contributions are accessible only to verified clients. What this means is simple. The requests passing through a node come from checked organizations seeking public pages.

In practice, the app's reach ends at spare capacity. The takeaway is to hold every later claim against those two columns. The next test is whether the permissions it requests match that narrow job.

What permissions does Grass ask for, and why does it need each one?

The browser extension asks to read and change data on all websites. That broad permission lets it route public web requests; it does not open stored browsing data.

This is the permission that stops most people, and it deserves a straight answer rather than a skip. The stated scope is narrow, yet the install prompt reads broad. That gap is exactly where skepticism belongs, so I'd rather walk through it line by line.

According to a January 2024 thread on the r/Grass_io subreddit, one user put the worry plainly, asking why a bandwidth tool needs "read and write access to all of my websites." The same user reported that the extension "doesn't work if I disable this." A 2024 independent review confirmed the first point: the extension requested the right to modify data on all visited websites, and the store listing offered no detailed explanation.

The most plausible explanation is operational. An extension that routes web requests in the background has to be allowed to send and handle requests to whatever public site a verified buyer asks for, and those sites change constantly. The same review judged the permission likely necessary for background operation. The developers also stated that the extension has no access to stored browser information, history or other browser data, and that request processing runs in the background, isolated from your own session.

In my view, the honest summary is this: the permission is broad because the job is open-ended, not because the extension reads your pages. If it still bothers you, the desktop app runs outside the browser, so browser site permissions do not apply to it.

Permission or data type	Where it appears	What it allows	Most likely reason
Read and change data on all websites	Browser extension install prompt	Sending and handling web requests to any site	Routing public web requests in the background
Location	Google Play declaration; 2024 Chrome listing	Knowing roughly where a node connects from	Matching public web requests to a region
Personal info	Google Play declaration	Details linked to your account	Creating and managing your account
Device or other IDs	Google Play declaration	Telling one device from another	Recording which node is connected

According to the Google Play listing, the developer declares that the app "may collect these data types: Location, Personal info, and Device or other IDs." The same listing states: "Grass cannot see your private data or online activity, only the unused part of your connection is shared." Google Play also notes that this Data safety information is provided by the developer. What this means is plain. A store label tells you what a developer says, not what anyone verified. On Android, you can review the app's permissions in your phone's app settings before and after installing.

So who has checked the claims? The answer depends on the date. The 2024 review described the extension as closed source and not yet security audited, so confidence rested on developer assurances. Later in 2024, the co-founder said the app had completed audits with three different groups, with one published on its website. The app now also holds AppEsteem certification. AppEsteem is an independent program that certifies consumer apps against standards for deceptive or unwanted behavior. The evidence reviewed here does not list its full checklist, so I'd recommend looking up the certification on AppEsteem's own site rather than taking any summary on faith, including this one.

In practice, the permission prompt is the one fact you can check before installing. The takeaway is simple: compare each permission against the app's stated job.

How can you tell you're installing the real Grass, and who is behind it?

Download only from grass.io. The app is published by the Grass Foundation, the legal entity is Grass OpCo Ltd., and Wynd Labs provides services to the network without owning it.

Even a well-scoped app is only as safe as the copy you install. The honest weak point here is not the app itself but impersonation of its name. The product was previously called GetGrass, and that older name is what lookalike sites tend to borrow.

According to a December 2024 thread on r/CryptoIndia, one user clicked a promoted "get grass" ad, was asked to select a wallet, and approved a prompt they recalled as "get grass is requesting permission to get ur wallet details." The user said they never typed a wallet address, email or password. The approval alone was enough to drain the wallet. A commenter who appeared to moderate the subreddit wrote: "Banned at least 20 accounts promoting that scam." Other commenters described the real project as legitimate and the site as a fake clone.

What this means is specific. The risk sat entirely outside the official app, in a single approval on a lookalike page.

A five-step check before you install

1. Start at grass.io. Type the address yourself and use the download links there. Skip ads, sponsored posts and direct messages that offer a download or a reward claim.
2. Check the publisher name. According to the Google Play listing, the app appears under the developer "Grass Foundation," with the legal developer entity listed as Grass OpCo Ltd in Road Town, British Virgin Islands. A listing under any other name is a red flag.
3. Know what setup requires. The same listing describes a three-step setup: download, create an account, then let the app contribute in the background. Nothing in that flow calls for a seed phrase or private key.
4. Read every wallet prompt. If a site asks to connect or approve access to a wallet, stop and confirm you reached it from grass.io. Never share a seed phrase or private key with anyone.
5. Report lookalikes. Users in the 2024 thread reported the fake ad to the project team. Reporting helps, although the thread noted the ad kept appearing.

I'd recommend treating the download link as the most important safety decision you make. Every protection described earlier assumes you are running the genuine app.

Who is behind Grass?

Name	Role
Grass	The network and the app
Grass OpCo Ltd.	The legal entity behind the app listing
Grass Foundation	Holds the network assets; handles reward distribution and governance
Wynd Labs	Provides services to the network under an agreement with the Foundation; not its owner

Accountability also shows up in the listing's written commitments. According to the Google Play Data safety section, the developer declares "No data shared with third parties," states that data is "encrypted in transit," and says users "can request that data be deleted." Support is listed at [email protected]. These are developer declarations, but they are specific, public and on record.

In practice, the download link matters more than any label. The takeaway: start at grass.io every time.

What is the bottom line on Grass safety?

Grass holds up when tested against specifics: it touches only unused bandwidth, its broad extension permission has an operational reason, and the clearest documented risk is a fake download.

That matters more each year. According to WRDW, citing Pew, nearly half of people in the U.S. say they are constantly on their phones. Devices that are always on are always connected, so what an app does in the background deserves real scrutiny.

In my view, the safety question is moving. Fewer people will ask whether an app reads their files. More will ask who uses the connection, and whether each claim can be checked. Grass already answers the first part with an identity check on every buyer. The second part is where every app will be judged.

Permission design points the same way. Even a solo developer's screen-time app now lets users grant location as a one-time permission. Store privacy labels, meanwhile, remain self-declared.

So my recommendation is concrete. Open grass.io, compare the install prompt against the permission table above, and note where the pause control sits before your first session. The questions readers ask most come next, starting with files.