Version 2026-10-01 · Effective 1 October 2026

Privacy policy

This policy explains what personal data Glassy collects, why, who receives it, how long it is kept and what rights you have. Glassy is operated by Manuel Ortuno, Playa Grande, Cabo Velas, Santa Cruz, Guanacaste, Costa Rica ("Glassy", "we"). Contact for anything privacy-related: privacy@glassyhq.com.

The short version

• We store what is needed to plan, publish and measure your posts and to answer your comments and messages. Nothing else.
• We do not sell personal data, share it for advertising, or use it to build profiles for anyone else.
• We use one essential cookie (to keep you signed in) and no analytics, advertising or third-party tracking.
• You can export everything or delete your account yourself from Settings at any time.

What we collect

Your account. Email address, name, time zone, a salted hash of your password (never the password itself), the version and date of the terms you accepted, whether you want product news, notification preferences, and, if you turn on two-factor sign-in, an encrypted authenticator secret and hashed recovery codes.

Your workspace and content. Workspace name and settings, posts you write or schedule (captions, media and links, notes, content pillars, times, publishing history), files you upload, snippets, saved replies, inbox rules, posting schedule, brand voice notes for the writing assistant, your link page, and team members and invitations (name, email, role).

Connected social accounts. When you connect an account (for example Instagram), we receive and store: the account ID, username and profile picture link; an access token (encrypted at rest); your own posts on that account and their metrics (such as reach, views, likes, comments, saves, shares, watch time); account-level insights (such as reach and profile visits); and aggregated follower demographics (countries, cities, age ranges, gender) that the platform provides. We never receive or store your social media password.

People who interact with you. To show your inbox, we store comments on your posts and direct messages sent to your account: the person's platform ID and username, the text, attachments links, and time. This data belongs to the conversations you have on your account; we process it on your behalf.

Usage. The dates on which you used Glassy (not what you clicked), your weekly focus check-ins and work sessions, writing-assistant request counts, and on your link page, daily counts of views and link taps (no IP addresses or visitor identifiers are stored for those counts).

Devices. If you turn on push notifications, the push address your browser gives us, its encryption keys and the browser's user agent.

Payments. If you subscribe, Stripe processes your card and billing details. We receive and store your Stripe customer and subscription IDs, plan, status and paid-through date. We never see or store full card numbers.

Waitlist. If you join from our website: your email, the answers you give (role, platforms, what bothers you about posting), where you came from (the page that linked you), and whether you want product news.

Technical logs. Our hosting provider records standard server logs (IP address, time, requested page, browser) for security and troubleshooting. Our server briefly keeps IP addresses in memory to limit repeated sign-in attempts.

How we use it, and our legal bases

• To provide Glassy (publishing, inbox, analytics, notifications, team features, support): necessary to perform our contract with you.
• To keep Glassy secure (sign-in protection, rate limits, fraud prevention, backups) and to improve it (aggregated usage such as active days during the pilot): our legitimate interests, balanced against yours.
• Product news emails and push notifications: your consent, which you can withdraw at any time in Settings or with the link in each email.
• Billing records and tax: legal obligation.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

The writing assistant (AI)

If, and only when, you use the writing assistant, the text needed for the request (for example your caption, notes, a comment thread or DM conversation you ask about, an image you ask to describe, your brand voice notes) is sent to Anthropic, PBC, which runs the Claude model that writes the draft. Anthropic processes it as our service provider and, under its commercial terms, does not use it to train its models. Drafts are suggestions; nothing is posted or sent without you. Do not paste sensitive personal data into the assistant.

Data from Instagram and other platforms

We use data received through Meta's and other platforms' APIs only to provide the features you see in Glassy, in line with each platform's developer terms. We do not sell it, use it for advertising, or transfer it to anyone except the service providers listed below. When you disconnect an account, its access token and the data received from the platform (comments, messages, platform media, insights, metrics) are deleted; your own drafts and post history in Glassy stay until you delete them. If you remove Glassy from your Instagram settings, Meta notifies us and we do the same automatically. See also data deletion. Glassy is not affiliated with, endorsed by or sponsored by Meta Platforms, Inc.

Who receives data (service providers)

Members of a workspace see that workspace's content, accounts and inbox according to their role. We may disclose data if required by law, or to protect the rights and safety of users or the public, and to a buyer if Glassy is sold or merged, under this policy.

International transfers

Some providers above process data outside your country, including in the United States. Where the law requires it, we rely on adequacy decisions or standard contractual clauses (and their equivalents) with those providers.

How long we keep data

• Account, workspace and content: until you delete them or your account. Deletion is immediate in the app; copies in our encrypted backups are overwritten within [7] days.
• Comments and direct messages: deleted after 12 months, or earlier when you disconnect the account.
• Usage days, follower history: 24 months. Writing-assistant usage counts: 13 months. Automation logs: 90 days. Read notifications: 90 days.
• Sign-in sessions: 30 days. Password-reset links: 1 hour. Two-factor sign-in attempts: 5 minutes.
• Billing records: as long as tax law requires ([X] years), held by us and Stripe.
• Waitlist: until the pilot invitation process ends, at most 24 months, or until you ask us to delete it.

Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to the processing of your personal data, to receive it in a portable format, and to withdraw consent. Most of this you can do yourself: Settings, Your data, Export data (a complete JSON copy), Settings to correct details, and Settings, Delete account. For anything else, write to privacy@glassyhq.com; we answer within 30 days. You can also complain to your data protection authority, for example in Costa Rica the Agencia de Protección de Datos de los Habitantes (PRODHAB), or in the EU/UK your local supervisory authority.

California residents: you have the right to know, delete and correct personal information and to opt out of its sale or sharing. We do not sell or share personal information as those terms are defined, and we will not discriminate against you for using your rights.

If you are someone who commented on or messaged an Glassy user's account and want your data removed, ask that account owner or write to us; we will help.

Cookies and similar technologies

We use a single essential cookie, sid, to keep you signed in (HttpOnly, 30 days). The installable app stores its own files on your device so it works offline. We load no fonts, scripts, images or trackers from other companies on our website or app pages, so no cookie banner is needed. Media you add to posts may be loaded from wherever you host it.

Security

Connections use HTTPS. Passwords are hashed with scrypt. Platform access tokens and two-factor secrets are encrypted with AES-256-GCM. Optional two-factor sign-in, sign-in rate limits, strict content security policy, and daily backups. Access to production data is limited to the people operating Glassy. If a breach affects your data, we will notify you and the authorities as the law requires.

Children

Glassy is for people 18 and older. We do not knowingly collect data from anyone younger. If you believe a minor has an account, write to us and we will delete it.

Changes

When this policy changes in a way that matters, we update the version above and ask you to review it the next time you open Glassy, before the change applies to you.