Glow ("we", "our", "us") operates the Glow mobile application and backend API. This document describes data collection, use, retention, and your rights. Use of the app and API constitutes acceptance. Contact: support@glowapp.org.
Data controller: The entity operating Glow. Contact for data protection and privacy requests: support@glowapp.org. Legal basis (GDPR): We process data to perform our contract with you (account, service delivery), on the basis of consent where we ask for it (e.g. optional profile or contact features), and for legitimate interests (security, abuse prevention, analytics). You may withdraw consent or object where applicable; contact us to exercise.
1. Data collected
1.1 Account and profile
- Email, username, password; or OAuth identifiers (Google ID, Apple ID)
- Name, profile picture (optional)
- Bio, skin type, ingredient sensitivities, interests, favorite brands (optional)
- Phone number (optional)
1.2 Usage and product data
- Scans, barcode lookups, search queries, product views
- Reviews, ratings, wishlists, tried-product lists
- Affiliate link clicks
1.3 Device and technical
- Device type, OS, app version
- Crash and performance data (e.g. Firebase Crashlytics)
- Authentication tokens (JWT) stored on device; we do not use third-party advertising cookies or cross-app identifiers for ads.
1.4 Contacts
If the app uses device contacts (e.g. find friends):
- Full contact lists are not uploaded or stored on our servers.
- Only data needed for the requested feature (e.g. matching) is processed; we do not retain your address book.
- Contact access is revocable in device settings.
1.5 Location
We do not collect precise location. No location-based advertising or profiling. Location can be disabled in device settings.
2. Purposes
- Account: Registration, authentication, profile, reviews, wishlists.
- Product: Product info, search, recommendations, trending/similar products.
- Trust: Email verification for reviews; abuse prevention.
- Operations: Crash diagnosis, performance, support.
- Analytics: Aggregate usage (e.g. Firebase Analytics); not used for third-party ad targeting.
3. Retention
- Account and profile: until account deletion (Section 7).
- Reviews, wishlists, scans, search history: deleted with account.
- Verification and password-reset tokens: short-lived; expired/used tokens removed.
- Aggregated/anonymized analytics: may be retained; not personally identifiable.
4. Firebase and third parties
We use Google Firebase for:
- Authentication (e.g. Google/Apple sign-in)
- Crashlytics (crash reports)
- Analytics (aggregate usage)
Firebase data is processed per Google's privacy policy and our configuration. We do not use Firebase for third-party advertising. Any future services (e.g. Google Analytics) will be listed here; consent obtained where legally required.
5. Contact importing
- Full contact lists are not uploaded or stored.
- Matching uses only what is needed (on-device or limited server-side); we do not keep a copy of your address book.
- Contact permission is revocable in device settings.
6. Sharing and security
We do not sell personal data. We do not share personal information for cross-context behavioral advertising. Data may be shared: (a) with processors (hosting, analytics) under contract; (b) when required by law or to protect rights/safety; (c) in a merger or sale of assets, with notice where required. We use encryption and access controls; data is stored on our infrastructure and, where used, AWS (S3, hosting).
7. Account deletion
You can delete your account and associated data at any time from the app: open the Profile section and use the Delete my account button. After you confirm, your account and linked data are permanently removed.
What is removed: User record; email verification and password-reset tokens; password history; reviews and review images; review likes, dislikes, comments; search history; wishlist categories and items. Scans, product views, product image uploads, affiliate clicks and conversions are anonymized (user reference set to null). User history records are removed. Deletion is permanent and irreversible.
Your rights: Depending on your jurisdiction (e.g. EU/EEA, UK, California), you may have the right to access, correct, port, object to, or restrict processing of your data, and to withdraw consent. Contact the email below to exercise these rights. You also have the right to lodge a complaint with a supervisory authority (e.g. your local data protection authority in the EU/EEA).
8. Children
Services are not directed at under-13s (or higher age if required locally). We do not knowingly collect data from children. To report such data: support@glowapp.org; we will delete it.
9. International transfer
Data may be processed in jurisdictions where we or our processors operate. We use contracts and, where required, standard contractual clauses or other lawful transfer mechanisms.
10. Changes
We may update this policy. The "Last updated" date will change; the current version is published at the same URL. Continued use after changes means acceptance. Material changes may be notified in-app or by email where the law requires.