Privacy Policy

17244720 Canada Inc (“we,” “our,” or “us”) operates Glowcast and is committed to protecting your privacy. This Privacy Policy describes how we collect, use, store, and disclose information in connection with the Glowcast application and related software (the “App”) on macOS, our website at https://www.glowcastapp.com (the “Site”), and any future versions or platforms (including without limitation iOS, iPadOS, or companion applications). By downloading, installing, or using the App or Site, you agree to the practices described in this policy. Our Terms of Service and Refund Policy apply to your use of the Services and purchases.

If you do not agree with this Privacy Policy, please do not use the App or Site.

1. Scope and applicability

This Privacy Policy applies to:

• The Glowcast macOS application (including all features such as annotation, cursor highlight, spotlight, zoom, magnifying glass, full-screen zoom, dim inactive windows, hide region, keystroke display, Ghost Notepad, Desktop Mat, Stage Lights timers, and related settings).
• Any future platforms on which we offer Glowcast (e.g., iOS, iPadOS, or a companion app), unless we publish a platform-specific or supplemental policy.
• Our website (e.g., https://www.glowcastapp.com or related domains), including any usage data or cookies we use to operate and improve the site (such as analytics or essential site functionality).
• Analytics and product usage data we collect to improve the App.
• Subscriptions to Glowcast Pro are purchased through our Site via checkout operated by Lemon Squeezy (or another payment partner we designate). Payment and subscription customer data for those purchases are processed by Lemon Squeezy and its processors as described in their policies; we receive limited metadata to provide your license, as described below.
• Website accounts and licensing: To subscribe on the Site, you create an account using our authentication provider Supabase. We store your user identifier, email, and subscription status synced from Lemon Squeezy so the App (or Site) can verify access.

The macOS App may be distributed as a direct download (for example, a notarized build from our Site). That does not use Apple's in-app purchase system for Glowcast Pro; subscription billing runs through the Site and Lemon Squeezy as described above.

2. Information we collect

2.1 Information you provide directly

• Preferences and settings: When you change settings in the App (e.g., cursor highlight color, spotlight size, annotation tools, shortcuts, timer position), we store these preferences locally on your device using the operating system's standard storage (e.g., UserDefaults on macOS). We do not upload your preference values to our servers.
• Ghost Notepad content: If you use the Ghost Notepad feature (presenter-only notepad), the text and formatting you enter are saved only on your device and are not transmitted to our servers or any third party.
• Desktop Mat custom image: If you choose a custom image for the Desktop Mat overlay, we store a reference to the file path locally; we do not upload the image itself.
• Onboarding status: We store a local flag indicating whether you have completed onboarding (e.g., permission prompts); this is used only to show or skip the onboarding flow and is not sent to us.
• Website account (Supabase): When you sign up or sign in on the Site, we collect and store your email address. If you complete our registration form, you may also provide first and last name, which we store in your user profile metadata. If you use Google or another social login we enable, we may receive your name, email, and profile identifier as that provider shares with Supabase. Supabase handles authentication credentials (such as passwords or OAuth tokens) according to its security practices. We use this account to tie your subscription to you and to communicate about your purchase or support requests.
• Subscription and billing metadata (Site purchases): When you subscribe via Lemon Squeezy, we receive and store subscription records (for example, status, trial and billing period end dates, and Lemon Squeezy subscription identifiers) through secure webhooks and associate them with your user ID. We do not store full payment card numbers on our servers; card data is processed by Lemon Squeezy and its payment partners.
• Optional Site tools (AI text generator): If you use the text generator experience on the Site (for example, pages under /text-generator), your prompts and conversation messages are sent to our servers and forwarded to OpenAI (or another model provider we configure) to generate a response. We do not use that content for advertising. Our API handling does not persist full chat transcripts in our application database for that feature; messages exist transiently during the request and in your browser session as you use the tool. OpenAI's API terms and privacy practices apply to their processing.
• Sign-in handoff to the macOS App: When you authenticate on the Site to return to the App, we may use a short-lived secure cookie and/or a custom URL scheme (for example, glowcast://) to pass a session token so the App can sign you in. That token is not used for advertising.

2.2 Information collected automatically (analytics)

We use PostHog (a third-party analytics service) to understand how the App is used so we can improve it. When the App is configured with a valid PostHog API key (e.g., in production builds), we may send the following to PostHog's servers (hosted at https://us.i.posthog.com or such other host as we configure):

• Event names and screen views: For example: app_opened, onboarding_started, onboarding_completed, onboarding_skipped, screen_view (e.g., Settings, Onboarding, Paywall), and feature usage events. We do not include your name, email, or other personally identifiable information (PII) in these event payloads.
• Anonymous identifier: PostHog may assign or we may use an anonymous device or session identifier to correlate events for analytics. This identifier is not intentionally linked to your website account email or other PII we add to these payloads.
• Technical context: Standard analytics context may include device type, operating system version, app version, and similar technical metadata. We do not intentionally add PII to this context.

We have configured PostHog to not capture automatic screen views or application lifecycle events beyond the events we explicitly send. Analytics are used only for product improvement and aggregate usage statistics.

For the Site (our website), when you opt in to analytics cookies via our cookie banner, we use Google Analytics 4 (Google LLC) to understand traffic, navigation, and how visitors use pages such as download and subscribe. Google may process data (including a client identifier, approximate location derived from IP, device/browser information, and events such as page views and button clicks) on Google's infrastructure. We use Google's Consent Mode so that non-essential measurement respects your choice until you accept analytics. We do not use Google Analytics on the Site for cross-site advertising or to sell your data.

2.3 Information we do not collect

• We do not collect the content of your keystrokes for transmission. The keystroke display feature shows key presses on screen for presentation purposes only.
• We do not collect the content of your screen (pixels, windows, or applications) for transmission to our servers. Screen capture is used only locally and is not sent to us or to PostHog.
• We do not collect voice or audio for transmission unless you explicitly opt in to a future cloud-based feature.
• We do not collect camera data unless you enable a future feature that requires camera access.
• We do not store full payment card numbers on our own servers; Lemon Squeezy and its processors handle payment card data for subscriptions purchased on the Site.

2.4 Cookies and website usage

When you visit our website, we may use cookies and similar technologies (e.g., local storage) for essential operation, analytics, and to improve the site. Non-essential analytics cookies (including Google Analytics) are set only if you allow them through our cookie banner; you can change your choice anytime via Cookie settings in the site footer. We do not use cookies for advertising or to track you across third-party sites for ads. You can also control cookies through your browser settings.

3. How we use your information

• To provide and improve the App: We use analytics (PostHog) to understand feature usage, onboarding completion, permission flows, and paywall interactions.
• To operate the App locally: Your preferences, Ghost Notepad content, and other local data are used solely to provide the features you enable.
• To operate the Site and subscriptions: We use account and subscription data to authenticate you, process checkouts (via Lemon Squeezy), validate licenses, send service-related communications, and maintain subscription status. Where you consent, we use Google Analytics on the Site to measure usage and improve the website experience.
• To comply with law: We may use or disclose information where required by applicable law, court order, or government request.

We do not sell your personal information. We do not use your data for advertising or cross-app tracking for advertising purposes.

4. Legal basis for processing (EEA/UK)

If you are in the European Economic Area or the United Kingdom:

• Analytics: We rely on our legitimate interests (improving the App and Site and understanding usage). You may opt out of App analytics (PostHog) and reject non-essential cookies for the Site (including Google Analytics) as described in Section 9.
• Local data: Processing is necessary for the performance of our contract with you and for our legitimate interests.
• Site accounts and subscriptions: Processing is necessary for the performance of our contract with you (providing the subscription and license you purchase) and for our legitimate interests (fraud prevention, support, and service integrity).
• Legal obligation: Where we must process data to comply with law, we do so on the basis of legal obligation.

5. Third-party services and data sharing

5.1 PostHog

We use PostHog (PostHog, Inc.) for product analytics. Events are sent to PostHog's infrastructure (e.g., us.i.posthog.com). PostHog's own privacy policy and data processing terms apply. PostHog may process data in the United States or other jurisdictions.

5.2 Google Analytics

We use Google Analytics 4 (Google LLC) on the Site when you consent to analytics cookies. Data is sent to Google's servers (for example google-analytics.com / googletagmanager.com regions as Google operates them). Google's privacy policy and terms apply to their processing. We configure tags with Consent Mode and do not use the Site tag for advertising personalization.

5.3 Apple and macOS

We do not sell Glowcast Pro subscriptions through the Mac App Store. The App may be distributed as a direct download; Apple provides macOS platform services (such as notarization and Gatekeeper) that process technical metadata about the app as part of normal system security. That processing is governed by Apple's documentation and your device settings. It is separate from subscription checkout on our Site, which is handled by Lemon Squeezy.

5.4 Supabase

We use Supabase (Supabase, Inc.) for website authentication and to host application data (including your account identifier, email, and subscription records linked to your account). Supabase processes data on our instructions and under its own privacy policy and terms. Data may be stored in regions Supabase configures for our project (for example, United States or EU).

5.5 Lemon Squeezy

We use Lemon Squeezy (or its affiliates) to process payments and subscriptions when you subscribe on the Site. Lemon Squeezy collects payment information and billing details needed to complete the transaction. Its privacy policy and terms describe how it handles payment and customer data. We receive limited subscription metadata (not full card numbers) via webhooks and dashboards to fulfill your license.

5.6 OpenAI and other AI providers

The Site's AI text features use model APIs such as OpenAI (OpenAI, LLC or its affiliates). Your prompts and message context are transmitted to OpenAI for inference as part of generating a response. OpenAI's terms of use and privacy policy apply to their processing. We configure requests to provide the feature; we do not use prompts from this tool for third-party advertising. If we add or substitute other model providers, we will update this policy or a supplemental notice.

5.7 Hosting and infrastructure

We use cloud hosting and infrastructure providers (for example, to serve the Site, run API routes, and store operational logs) that process data on our behalf under contractual safeguards. Those subprocessors may handle limited technical data (such as IP addresses and request metadata) as part of normal service operation.

5.8 No other sharing

We do not share your personal data with other third parties except: (a) as described in this policy (PostHog, Google Analytics on the Site when you consent, Apple platform services as described in Section 5.3, Supabase, Lemon Squeezy, OpenAI or other AI providers, and hosting or infrastructure subprocessors); (b) with your consent; (c) to service providers who process data on our behalf under strict confidentiality; or (d) as required by law.

6. System permissions and how we use them

The App may request macOS (or, in the future, iOS) permissions. We use them only for the stated purposes:

• Accessibility: To detect global keyboard shortcuts and for the keystroke display overlay. We do not log or transmit the content of your keystrokes.
• Screen Recording: Required for Magnifying Glass, full-screen zoom, Desktop Mat's blur option, and Hide Region. Capture is performed on-device only; we do not stream, store, or transmit screen content.
• Future permissions (e.g., Microphone, Camera): If we add voice-triggered or gesture-based features, we will request access only for those features and process data on-device where possible.

You may revoke any of these permissions at any time in System Settings → Privacy & Security (orSettings → Privacy on iOS).

7. Data storage and retention

• On your device: Preferences, Ghost Notepad content, and similar data are stored locally until you delete the App or clear its data.
• Analytics (PostHog): Event data is retained according to PostHog's configuration and our agreement. You may request deletion as described in Section 9.
• Analytics (Google Analytics, Site): Retained according to Google's settings for our property and our configuration. You can limit future collection by rejecting analytics cookies or using Google's browser add-ons and controls as described in their documentation.
• Site account and subscriptions (Supabase): We retain account and subscription records for as long as your account is active and as needed to meet legal, tax, and accounting obligations. You may request deletion of your account or data as described in Section 9, subject to legal retention requirements.
• Lemon Squeezy: Retains transaction and customer records according to its policies and legal requirements.

8. Data security

We take reasonable technical and organizational measures:

• Local data: Stored using the operating system's standard mechanisms (e.g., UserDefaults, app sandbox).
• Network: Communication with PostHog, Google (when you use the Site with analytics enabled), Supabase, Lemon Squeezy webhooks, and other APIs is over HTTPS (TLS). We do not transmit your screen content, keystroke content, or Ghost Notepad text from the App to our servers.
• Hosted services: Website authentication and subscription data are stored with Supabase under industry-standard access controls. We configure services to limit access to operational needs.

No method of transmission or storage is 100% secure. In the event of a data breach that affects your personal data and where required by law, we will notify you and the relevant supervisory authorities.

9. Your rights and choices

9.1 Analytics opt-out

If you do not want usage events sent to PostHog in the App, you may contact us (Section 13) to request that we disable analytics for your use, subject to technical feasibility. We may add an in-App opt-out toggle in a future version.

For the Site, use Cookie settings in the footer to reject non-essential cookies or withdraw consent for Google Analytics. You can also clear site data or use browser controls.

9.2 Access, correction, deletion, and portability

You can delete local App data by uninstalling the App. For your website account and subscription records held in Supabase, contact us (Section 13) to request access, correction, export, or deletion; we will respond in accordance with applicable law (e.g., within 30 days for GDPR requests where applicable). Deletion may be limited where we must retain certain records for tax, fraud prevention, or legal compliance. For analytics data (PostHog or Google Analytics), contact us to request deletion or use provider-specific tools where available. For payment and invoice history processed by Lemon Squeezy, you may also exercise rights through their customer tools or by contacting us for coordination.

9.3 Restriction, objection, and withdrawal of consent

If you are in the EEA/UK, you may have the right to restrict processing, object to processing based on legitimate interests, or withdraw consent. Contact us (Section 13) to exercise these rights.

9.4 Complaints

You may lodge a complaint with a supervisory authority in your country of residence (e.g., in the EEA, your local data protection authority).

9.5 California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights:

• Right to know: Request information about the personal information we have collected about you.
• Right to delete: Request that we delete personal information we have collected from you, subject to certain exceptions.
• Right to opt-out of sale or sharing: We do not sell your personal information. We do not share it for cross-context behavioral advertising in a way that qualifies as a “sale” or “sharing” under the CCPA.
• Right to non-discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise these rights, contact us using the details in Section 13.

9.6 Canada (PIPEDA and Quebec)

If you are in Canada, our collection, use, and disclosure of personal information is subject to applicable federal and provincial privacy laws, including the Personal Information Protection and Electronic Documents Act (PIPEDA), where it applies. You may request access to your personal information and challenge its accuracy and completeness; we will respond in accordance with applicable law. You may file a complaint with the Office of the Privacy Commissioner of Canada or your provincial privacy commissioner, as applicable. If you are in Quebec, the Act respecting the protection of personal information in the private sector (Law 25) may grant you additional rights (for example, transparency and certain transfer rules); we will honor those requirements where they apply to our processing.

9.7 Automated decision-making

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

10. Children

The App is not directed at children under 13 (or higher age where required by local law). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us (Section 13) and we will delete it in accordance with applicable law.

11. International transfers

We and our service providers (including PostHog, Google, Supabase, OpenAI, and Lemon Squeezy) may process data in the United States and other countries. If you are in the EEA, UK, or another region with transfer restrictions, we rely on appropriate safeguards (e.g., Standard Contractual Clauses, adequacy decisions) where required.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated policy on the Site (and, where practical, in the App) and update the “Last updated” date. For material changes, we may notify you via email (if you have an account), the App, or other reasonable means. Your continued use of the App or Site after the effective date of the updated policy constitutes acceptance of the changes where permitted by law.

13. Contact us

If you have questions about this Privacy Policy, or want to exercise your rights (access, deletion, opt-out, complaints), please contact us:

• Email: valyriaapps@gmail.com
• Address: Contact us via email above for postal address if required for formal requests.

We will respond to legitimate requests in accordance with applicable law.

This Privacy Policy is provided for the Glowcast application and is intended to be comprehensive for the current feature set. Future features (e.g., voice commands, gesture drawing) will be handled in accordance with this policy and any supplementary disclosures we provide at the time of release.