1. Overview
2. Information We Collect
2.1 Information you provide
- Email address — collected when you create a paid account or request a magic link to sign in.
- Logo image — collected if you are a Plus subscriber and upload a logo. Stored securely via Vercel Blob Storage.
- Payment information — processed directly by Lemon Squeezy. We do not store your credit card number or billing details on our servers.
2.2 Information we do NOT collect
- The content of your secrets. It is encrypted client-side and we have no access to the plaintext.
- The decryption key. It lives in the URL fragment (#) and is never transmitted to our servers.
- IP addresses associated with secret creation or viewing.
2.3 Automatically collected information
Vercel, our hosting provider, may collect standard server logs including IP addresses and request metadata as part of normal infrastructure operation. We do not collect or log IP addresses at the application level, and we do not use infrastructure log data for profiling or analytics.
2.4 Website analytics
We use two analytics tools, and only on our guides, pricing, how-it-works, security, contact, and payment-confirmation (/welcome) pages.
Plausible Analytics is cookieless and collects aggregate page views, referrers, and coarse device and country information.
The Google Ads tag measures whether our ads lead to sign-ups. It records when someone clicks Try Gliiph, Create a link, or Get Gliiph Plus, and when a Plus purchase completes. It sets Google advertising cookies. Google receives the page address without its fragment, the standard request data your browser sends (such as IP address and browser type), and for a purchase the plan price and the order number. Ad personalization is turned off, so these visits are not used to target ads. It is not loaded for visitors in the European Economic Area, the United Kingdom, or Switzerland.
Neither tool receives note contents, passwords, decryption keys, email addresses, account identifiers, or the fragment part of any URL. Neither is loaded on the homepage composer, the recipient page, the sign-in page, or the account page.
We also keep an aggregate count of notes created. It stores nothing but the number.
3. How We Use Your Information
- Send you a magic link to sign in to your account.
- Manage your subscription and communicate billing-related updates.
- Respond to support requests you initiate.
4. Data Storage and Security
- Secrets are stored in Upstash Redis with a Time-To-Live (TTL). They are automatically and permanently deleted when they expire or are viewed, whichever comes first.
- All secrets are encrypted using AES-256-GCM before being stored. We store only ciphertext.
- Account data (email, plan, subscription status) is stored in Upstash Redis.
- Logo files are stored in Vercel Blob Storage. Filenames are hashed and do not contain identifying information.
- Session tokens are stored in secure, httpOnly cookies.
5. Third-Party Services
- Vercel — hosting and infrastructure.
- Upstash — Redis database for temporary secret and session storage.
- Resend — transactional email delivery for magic links.
- Lemon Squeezy — payment processing and subscription management.
- Plausible — cookieless website analytics on the pages listed in section 2.4.
- Google Ads — ad conversion measurement on the pages listed in section 2.4.
6. Data Retention
- Secrets — deleted automatically upon viewing or expiration. No copies are retained.
- Account data — retained for the duration of your account. You may request deletion at any time by contacting us.
- Session tokens — expire after 30 days.
7. Abuse Reporting
8. Your Rights
- Access the personal information we hold about you.
- Request correction of inaccurate information.
- Request deletion of your account and associated data.
9. Children
10. Changes to This Policy
11. Contact
Gliiph LLC
Missouri, USA
privacy@gliiph.com