Privacy Policy

Last updated: 25 October 2026

यह दस्तावेज़ अंग्रेज़ी और स्पेनिश में उपलब्ध है।

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation, “GDPR”), and Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (“LOPDGDD”), Mr Marc Morales Linares informs users of the GLOSSY application, the glossy.day website and the GLOSSY browser extension (together, the “Application”) about the processing of the personal data they voluntarily provide when registering for, accessing and using the service.

1. Data controller

Mr Marc Morales Linares, self-employed professional (autónomo), Spanish tax ID (NIF) 49819232J, with address for notices at Carrer de Floridablanca, 68, 08015 Barcelona, Spain (the “Controller”), is the controller of the data provided by users of GLOSSY (each a “User”). GLOSSY is a product run by a single person with no employees, available on iOS, Android and desktop, through the glossy.day website and as an extension for the Google Chrome browser.

Contact email: support@glossy.day.

2. The service

GLOSSY is a language-learning application built on the “comprehensible input” method. It helps Users improve their language skills by reading books, articles and other content suited to their level, doing writing exercises, practising conversation and practising pronunciation. The Application currently offers twelve (12) languages, as well as certain features based on artificial intelligence, including conversations with an AI conversational assistant to practise the chosen language.

The browser extension lets the User look up the meaning of words on any web page or in a video’s subtitles, in the language they are learning, without leaving the page, and save them to their GLOSSY vocabulary. Its data processing is described in section 6.

3. Categories of data processed

The Controller processes the following categories of the User’s personal data:

• Account and identity data: email address (provided by the User or taken from the Apple or Google identity token when signing in with those accounts), an irreversibly hashed password (only for email sign-up), the sign-in provider used and session metadata (sign-up date, last sign-in and confirmation), display name and (unique) username, native language, and the date a deletion was requested, which starts the purge period. Sign-up asks only for what is essential (email and languages); it does not ask for a real name, exact age, phone number or interests, and content recommendations are built from what the User reads inside the Application.
• Content written or imported by the User: journal entries (original text, translation, corrected version and the automatic corrector’s comment, with date and language), translation practice (suggested sentence, the User’s translation, reference translation and score), custom word senses and vocabulary groups, book library (title, author, genre, format, source and reading progress; the book file itself is never uploaded), imported articles, subscribed news sources and categories, YouTube channel identifiers imported with express and revocable authorisation, content reports (reported text, reason and details) and app preferences.
• Learning profiles and progress: learning profile (language studied, translation language, level and resets), review state of vocabulary and alphabet characters (level, stability, difficulty, repetitions, lapses and next review date), encounters with each word (sentence, position, source type and date), word lookups, reading, video, conversation and translation-practice sessions, level-ups, and articles or videos already seen.
• Subscription, usage and operational data: subscription status (access level, trial period, purchase source, expiry date, product, and customer and subscription identifiers at the payment provider), commercial conversion events, per-user daily usage of AI features for quotas and cost control, and audio transcription quota.
• Browser extension usage data: as described in section 6.

4. Purposes of processing

The User’s data are processed in order to:

• Manage sign-up, authentication and administration of the User account.
• Provide the language-learning service, including tracking the User’s progress, personalising the content and exercises offered, and running the artificial intelligence features (conversation, correction, translation, transcription and pronunciation).
• Manage the purchase, activation and renewal of the Premium plan and the related billing.
• Diagnose technical errors and keep the Application working properly.
• Answer the User’s questions and requests.
• Send the emails the service needs (account confirmation and password recovery).
• Send the newsletter, only to people who have voluntarily joined the waiting list or newsletter and confirmed it through double opt-in.

5. Use of artificial intelligence

5.1. Features that use language models (OpenRouter)

GLOSSY uses the provider OpenRouter to route each artificial intelligence request to the appropriate language model for the task. It is by far the provider that receives the most User-generated content, so the following explains, feature by feature, what is sent and whether it includes text written by the User:

• Meaning in context: to explain the exact sense a word has in the sentence the User is reading (from the catalogue, an article, a book, an imported video or a web page read with the extension), that sentence is sent together with the language pair.
• Vocabulary card definition: generated from the word and an example sentence written by Glossy itself, with no User text involved.
• Translation of sentences or passages the User asks for: the text to translate, both languages and, where relevant, translations of words the User already knows are sent, to keep the terminology consistent.
• Practice sentence generation: when no reusable sentence exists, one is generated from the target words, the User’s level and language, without sending any text written by the User.
• Correction of translation exercises: the original sentence, the User’s translation and the reference translation are sent, to score and comment on it.
• Practice conversation: to generate each reply of the fictional partner, the history of the current conversation is sent, including the User’s messages, together with the scenario, level and language; at the end, the User’s turns are also used to comment on the session and identify strengths and recurring mistakes.
• Journal correction: the full entry as written by the User is sent, with the language, to correct its grammar and explain the proposed changes.
• Generation of a first personalised reading text: when the catalogue has nothing suitable for a new User, a text is generated from their language and level, without sending any of their text and without keeping the result on the server.
• Transcription of imported audio or video: the file is split into chunks of about two minutes and sent, with the language if known, to generate the subtitles.
• Reading recommendations: excerpts of articles, videos or books the User has already read are sent to turn them into numerical representations that rank recommendations, without any User identifier.
• Maintenance of the catalogue: only Glossy’s own content is used, with no data from any User.

None of these requests includes the User’s email address or account or profile identifier; the only identification sent is that of the GLOSSY application as a client of the service, not of the person. All of them are made under declared zero data retention and with data collection for training expressly prohibited, a condition that extends to the fallback model providers in OpenRouter’s network, so none of them keeps or trains on the content sent.

The Controller does not keep a copy of the requests either; only the number of tokens used and their cost are recorded, for quota control.

5.2. Word translation and voice (Google Cloud Translation and Microsoft Azure Speech)

When the User taps a word, Google Cloud Translation translates it out of context; it receives only that word and the language pair, without the sentence it appears in or any account identifier, and the translation obtained is stored in Supabase without any link to who requested it and reused for all users. Microsoft Azure Speech, in its speech synthesis role, turns into audio the pronunciation of the vocabulary and the writing-system characters taught by Glossy’s catalogue, never text written by the User, producing files that are reused for all users and served from the Cloudflare storage described in section 9.2.

5.3. Pronunciation practice (Microsoft Azure Speech)

Besides the use above, Azure Speech also powers the Application’s pronunciation practice: it records the User’s own voice during the exercise and sends it to Azure for analysis, which returns a score or correction. Unlike the speech synthesis described in section 5.2, this feature does involve sending a recording of the User’s voice, but the recording is used only to assess it at the time of the exercise: the Controller does not keep it and it is not stored on any server once the analysis is complete. The request sent to Azure contains no User account or profile identifier.

5.4. Transparency about artificial intelligence systems

In accordance with Article 50 of Regulation (EU) 2024/1689 (Artificial Intelligence Act), the Controller informs the User that, when using the features described in this section, they are interacting with an artificial intelligence system and not with a natural person.

6. Browser extension

The GLOSSY extension for Google Chrome requires a GLOSSY account and only acts when the User uses it. Its data processing is as follows:

• Nothing is sent before the User taps a word. The extension waits for the gesture chosen by the User (for example, a double click) without reading the page’s text or sending anything. Only when the User taps a word are the word, the sentence or subtitle line it appears in and, for an expression, the selected text sent to GLOSSY, to translate and explain them as described in section 5. The word is saved to the User’s vocabulary with that sentence as its example.
• Page address: together with the lookup, the address of the page where the User tapped the word is stored, reduced to its domain and path, without query parameters or fragment; on YouTube, the video’s identifier. Nothing is recorded about pages the User only visits without tapping a word.
• Study activity: reading or watching time after the first tap on a page or video, and the taps themselves (which word and whether the User knew it), for the User’s statistics and spaced repetition.
• Page colouring: the optional feature that colours the words on the page by level reads the page’s text locally, in the browser, and sends none of it anywhere.
• Data stored in the browser: the account’s session token and a copy of the User’s vocabulary, in the browser’s local storage; and the extension’s settings (gesture, colouring, video options and the language chosen per site), in the browser’s synced storage, which the browser itself may sync with the User’s Google account.
• Error reports: off by default. If the User turns them on, technical information about failures of the extension’s own code (the error’s name and message, the version and the browser) is sent to Sentry; never the page’s address or text, nor the User’s words or translations.

The extension shows no advertising, sells no data and loads no remote code. The User can switch it off for any site from the toolbar button.

7. Legal basis

The User’s data are processed on the following legal bases:

• Performance of the service contract arising from registration and, where applicable, from the purchase of the Premium plan, whose terms and conditions are made available to the User in advance for express acceptance.
• The User’s free, specific, informed and unambiguous consent, given by a statement or a clear affirmative action, for optional features such as importing YouTube subscriptions or joining the newsletter.

If the User does not provide their data to the Controller, or provides it incorrectly or incompletely, registration and use of the Application will not be possible.

8. Retention and deletion

The User can request the deletion of their account from the Application or from glossy.day/delete-account, or ask the Controller to close it. In both cases the account is immediately marked as deleted and can no longer be accessed; an automated task deletes it completely, with all associated data, after thirty (30) days. Imported videos are automatically pruned after ninety (90) days. The content of conversations with the AI assistant is not kept: the turns are sent to the AI provider to generate the reply and only the session counters are stored. Voice recordings from pronunciation exercises are not stored. Book files are never uploaded and remain only on the User’s device. Retention periods specific to certain providers, where different, are set out in section 9.

9. Recipients and processors

The Controller uses the following providers to deliver the service, which act as processors or, where stated, as independent controllers for certain operations:

As a general rule, payment data (card number or other payment method) are never accessible to, transmitted to or stored by the Controller: the User enters them directly in the Stripe, Apple or Google checkout, depending on how they subscribe. Relevant details of each provider follow.

9.1. Supabase

The main processor: it hosts all of the Application’s infrastructure (authentication, database, storage and the server functions that talk to the other providers) and is the only one that keeps personal data permanently. The database applies row-level security to every User table, so each User can only read and write their own rows; only the Controller has administrative access.

9.2. Cloudflare

Performs four functions: hosting the glossy.day site, managing the domain and its certificates, serving the pronunciation and catalogue audio files, and syncing the public catalogue of public-domain books. It receives the data inherent in serving a web page: IP address, browser, operating system, page requested and date. When delivering audio it also checks the User’s session token to verify they are entitled to that file; the token is validated and discarded on the spot, never stored. Its file storage holds only content generated by Glossy itself, pronunciation audio and public-domain books; no file or text of the User is ever uploaded there. The site does not set Cloudflare cookies for tracking.

9.3. Stripe

Acts as merchant of record for subscriptions bought on the website, through its Link service, which is the name the buyer sees at checkout, on receipts and on their bank statement: it invoices the User, pays the tax due in each country and handles payment claims. When checkout opens, it receives the buyer’s email address, the internal identifier of their account (as the purchase reference), the country that sets the price, the chosen plan, the applicable trial period and, where applicable, the discount code or the identifier of the affiliate who originated the purchase. Card details never pass through the Controller, as the buyer enters them directly on the page hosted by Stripe. The Controller receives from Stripe the customer and subscription identifiers, the subscription’s status and expiry date, which are stored in Supabase to grant paid access. To change the payment method or cancel the subscription, the Application opens Stripe’s customer portal, which receives only the relevant customer identifier; the buyer can also do this from their Link account. Stripe keeps the transaction record for the periods required by its own accounting and tax obligations, regardless of whether the User deletes their Glossy account.

9.4. RevenueCat

Syncs the status of subscriptions bought inside the Application on the App Store and Google Play; payment is taken by Apple and Google, not by RevenueCat. It receives only the internal account identifier and the purchase receipt issued by the store, without the User’s email address. In return, RevenueCat sends automatic notifications of new subscriptions, renewals, cancellations, refunds and trial endings, which update paid access in Supabase. Neither the Controller nor RevenueCat ever has access to the payment method used, which is handled entirely by the relevant store.

9.5. Affonso

Attributes a purchase to the affiliate whose link originated the visit and automatically applies any discount they offer. It receives a referral identifier, which does not identify the person, and notice that a purchase has been completed; the same identifier also travels in the purchase data sent to Stripe, so the affiliate’s commission can be paid. It is the only part of the system that uses a tracking cookie, and it is only activated when the visitor arrives at the site through an affiliate’s link: only that visitor is shown the cookie notice, and nothing is attributed or recorded until they expressly accept it; if they decline, they do not see the notice again and are not tracked. Other visitors see no banner, as there is no cookie to consent to. Details are in the Cookie Policy.

9.6. Sentry

Collects errors and crashes of the Application on its three platforms and in the server functions, so they can be fixed. Each error report includes the technical trace of the failure, the Application version, the operating system and the device model, together with an opaque profile identifier that shows whether several failures affect the same person without identifying them. The automatic sending of personal data that the tool’s maker enables by default is switched off, so neither the User’s email address, IP address nor name is sent; in addition, the Controller’s own filter cleans each report before it is sent to remove any credential or personal data it might contain. The User can turn off error reports in the Application’s privacy settings; in the browser extension, reports are off unless the User turns them on. The service is provided from a European instance hosted in Germany (Frankfurt).

9.7. Plausible

Provides analytics for the glossy.day website, receiving the page visited, approximate country, device type and the visitor’s referrer, always in aggregate form. It sets no cookies, does not store the IP address and creates no persistent identifiers, so it cannot follow a person across visits or sites; for that very reason its use does not require prior consent. It covers only the website: the Application includes no behavioural analytics tool.

9.8. Apple

Involved in three ways. Sign in with Apple returns a signed identity token from which the User’s email address is taken, which may be their real address or a private relay address if they so choose, and which is registered as an account in Supabase. Purchases made on iOS are processed entirely by Apple, and the Controller receives only confirmation of the subscription status, never the payment method or billing address. Finally, Apple provides the Controller, as developer, with aggregate download statistics and the Application’s public ratings, without identifying any User.

9.9. Google

Provides six separate services. Sign in with Google returns a signed identity token from which the verified email address is taken, which is registered as an account in Supabase. Google Play distributes the Application on Android and processes its subscriptions entirely, and the Controller receives only their status plus aggregate install statistics. The Chrome Web Store distributes the browser extension, and the Chrome browser stores the extension’s settings in its synced storage, according to the sync settings of the User’s Google account. The YouTube integration is optional: only if the User expressly authorises it does the Controller access, read-only, the list of channels they subscribe to and store those channel identifiers in Supabase; the history of videos watched, by contrast, is not stored on any server and is kept for only thirty (30) days on the device itself, and the authorisation can be revoked at any time from the User’s Google account. Finally, the support address, support@glossy.day, is hosted on Google Workspace and receives whatever the User chooses to include in their message, including any screenshots they attach. In addition, Google Cloud Translation translates the single words the User taps, as described in section 5.2.

9.10. MailerLite

Manages the pre-launch waiting list and the Application’s newsletter, receiving only the email address provided and confirmation that its owner has validated the sign-up. No address is added to the list without that confirmation, sent to the address itself, which prevents anyone from signing up a third party without their knowledge. The list is independent of Application accounts: joining it does not create an account, and having an account does not mean being subscribed to the newsletter.

9.11. Microsoft Azure Communication Services

Sends the account’s transactional emails: sign-up confirmation and password recovery. It receives the recipient’s email address and the content of the message, which includes the confirmation or recovery link. The service is configured with data residency in Europe. It is not used to send marketing communications.

10. International transfers

Some of the providers listed in the previous section (OpenRouter, Stripe, RevenueCat, Affonso, Apple and Google) may process data on servers located outside the European Economic Area. These international transfers are made on the basis of the appropriate safeguards provided for in Article 46 GDPR, in particular the Standard Contractual Clauses approved by the European Commission. The User may request further information about these safeguards through the channels given in section 12 of this policy.

11. Data retention (LSSI)

The Controller informs the User that, as an information society service provider and under Spanish Law 34/2002 of 11 July on Information Society Services and Electronic Commerce (LSSI), it retains for a maximum of twelve (12) months the information strictly necessary to identify the origin of the hosted data and the moment the service began.

12. Your rights

The Controller informs the User that they have the rights of access, rectification, restriction, erasure, objection and portability, which they may exercise by writing to support@glossy.day, the same channel used for any general support question. The User also has the right to withdraw any consent given and to lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es).

13. Electronic marketing communications

The Controller runs a waiting list and newsletter, independent of Application accounts, which the User may voluntarily join from the website and which requires confirmation through double opt-in. In accordance with the LSSI, the Controller will not send advertising emails that have not been previously requested or authorised. The User can unsubscribe at any time through the link included in every email.

14. Minors

The service is intended exclusively for people aged eighteen (18) or over, because the Application gives access to internet content that the User imports or chooses (news, videos, books) and whose nature cannot be guaranteed. The Application applies an age check at sign-up. If the Controller becomes aware that an account belongs to someone under eighteen, it will delete it.

15. Additional statements about processing

The Controller expressly states the following regarding practices common in products of this kind that do not take place in GLOSSY:

• No advertising is shown: the Application contains no ads, integrates no ad networks and shares no data with advertising intermediaries.
• No data is sold: no personal data is transferred, sold or shared with third parties other than the providers listed in section 9.
• Users are not tracked across apps or sites: neither the device’s advertising identifier nor any other form of tracking is used for that purpose.
• There is no behavioural analytics inside the Application: the only thing recorded is the User’s study progress, in the database described in section 3.
• No real name is requested: the account is identified by an email address and a username the person chooses freely.
• The device’s contacts, location and camera are not accessed: the Application only accesses the files the User expressly chooses to import and, during pronunciation exercises, the microphone.
• Conversations with the AI assistant are not kept, as stated in section 8.
• The User’s payment data are not accessed: no card or bank account passes through the Controller’s infrastructure, as stated in section 9.