Glow — Privacy Policy

The short version

• We cannot read your messages. They are encrypted on your device and decrypted on your friend's. The server only ever stores ciphertext.
• Your private key never leaves your device in a form we can use — the copy we hold is encrypted with your password, which we never see.
• No ads, no analytics, no tracking SDKs, and nothing sold or shared with third parties.
• Invite-only. No phone number, no email address, no address-book upload.

1. What we actually store

Glow needs a server to pass messages between people who are not online at the same time. Here is everything that server holds, and what it can make of it.

Data	Why	Can we read it?
Username	So people can find and message you	Yes — you choose it, and it is visible to people you chat with
Password	To sign you in	No — stored only as a salted hash
Public key	So others can encrypt messages to you	Yes — it is public by design
Private key	Held encrypted so you can sign in on another device	No — encrypted with a key derived from your password
Messages	To deliver them	No — stored as ciphertext only
Photos and files you send	To deliver them	No — encrypted before upload, including the filename and file type
Reactions	To show them	No — the emoji itself is encrypted
Display name, bio, avatar	Optional profile, if you set one	Yes — you choose what to put there
Timestamps, who messaged whom, read state	To order conversations and show delivery	Yes — this is metadata we cannot avoid holding

We want to be straight about that last row. End-to-end encryption protects the content of your messages. It does not hide the fact that two accounts exchanged a message at a particular time — the server has to know where to route it. Glow does not attempt to conceal that metadata, and you should not assume otherwise.

2. How the encryption works

Each account has a keypair. Your device combines your private key with your friend's public key to derive a shared secret (X25519), and encrypts each message with it (XSalsa20-Poly1305). Only the two of you can derive that secret, so only the two of you can read the message.

Your private key is generated on your device. The copy stored on the server is encrypted with a key derived from your password, so it is useless to anyone — including us — without that password.

This has a consequence worth understanding: if you forget your password, your message history cannot be recovered. Not by you, and not by us. That is the cost of us genuinely not holding the key.

3. Notifications

To notify you when the app is closed, we send a push notification through Apple (APNs) or Google (FCM). We do not put your message text in it. Instead we forward the same ciphertext your device would have received, and your device decrypts it locally to show the preview.

This means Apple and Google can see that a notification was sent to your device, but not what it says. If your device cannot decrypt it, the notification falls back to "New message".

4. What Glow never does

• No advertising, and no advertising identifiers.
• No analytics or crash-reporting SDKs.
• No selling or sharing of your data with third parties.
• No access to your contacts or address book.
• No phone number or email address required.
• No location collection.

5. Who else is involved

Glow relies on a small number of providers, none of which receive your message content:

• Apple Push Notification service and Firebase Cloud Messaging — to wake your device. They receive ciphertext, never plaintext.
• Our own server, which stores the encrypted data described above.

6. Your choices

• Delete messages — for yourself, or for everyone if you sent them.
• Turn off notifications — in Glow's settings or your system settings.
• Biometric lock — require Face ID, Touch ID or a fingerprint before your messages can be decrypted on your device.
• Delete your account — email us and we will remove your account and its data. We are a small team, so this is handled by a person rather than a button today.

7. Children

Glow is not directed at children under 13, and we do not knowingly collect data from them.

8. Changes to this policy

If this policy changes in a way that affects what we collect or how we handle it, we will update the date at the top of this page and note the change in the app's release notes.

9. Contact

Questions, or a request to delete your account: [email protected].