The short version
- We cannot read your messages. They are encrypted on your device and decrypted on your friend's. The server only ever stores ciphertext.
- Your private key never leaves your device in a form we can use — the copy we hold is encrypted with your password, which we never see.
- No ads, no analytics, no tracking SDKs, and nothing sold or shared with third parties.
- Invite-only. No phone number, no email address, no address-book upload.
1. What we actually store
Glow needs a server to pass messages between people who are not online at the same time. Here is everything that server holds, and what it can make of it.
| Data | Why | Can we read it? |
|---|---|---|
| Username | So people can find and message you | Yes — you choose it, and it is visible to people you chat with |
| Password | To sign you in | No — stored only as a salted hash |
| Public key | So others can encrypt messages to you | Yes — it is public by design |
| Private key | Held encrypted so you can sign in on another device | No — encrypted with a key derived from your password |
| Messages | To deliver them | No — stored as ciphertext only |
| Photos and files you send | To deliver them | No — encrypted before upload, including the filename and file type |
| Reactions | To show them | No — the emoji itself is encrypted |
| Display name, bio, avatar | Optional profile, if you set one | Yes — you choose what to put there |
| Timestamps, who messaged whom, read state | To order conversations and show delivery | Yes — this is metadata we cannot avoid holding |
We want to be straight about that last row. End-to-end encryption protects the content of your messages. It does not hide the fact that two accounts exchanged a message at a particular time — the server has to know where to route it. Glow does not attempt to conceal that metadata, and you should not assume otherwise.
2. How the encryption works
Each account has a keypair. Your device combines your private key with your friend's public key to derive a shared secret (X25519), and encrypts each message with it (XSalsa20-Poly1305). Only the two of you can derive that secret, so only the two of you can read the message.
Your private key is generated on your device. The copy stored on the server is encrypted with a key derived from your password, so it is useless to anyone — including us — without that password.
This has a consequence worth understanding: if you forget your password, your message history cannot be recovered. Not by you, and not by us. That is the cost of us genuinely not holding the key.
3. Notifications
To notify you when the app is closed, we send a push notification through Apple (APNs) or Google (FCM). We do not put your message text in it. Instead we forward the same ciphertext your device would have received, and your device decrypts it locally to show the preview.
This means Apple and Google can see that a notification was sent to your device, but not what it says. If your device cannot decrypt it, the notification falls back to "New message".
4. What Glow never does
- No advertising, and no advertising identifiers.
- No analytics or crash-reporting SDKs.
- No selling or sharing of your data with third parties.
- No access to your contacts or address book.
- No phone number or email address required.
- No location collection.
5. Who else is involved
Glow relies on a small number of providers, none of which receive your message content:
- Apple Push Notification service and Firebase Cloud Messaging — to wake your device. They receive ciphertext, never plaintext.
- Our own server, which stores the encrypted data described above.
6. Your choices
- Delete messages — for yourself, or for everyone if you sent them.
- Turn off notifications — in Glow's settings or your system settings.
- Biometric lock — require Face ID, Touch ID or a fingerprint before your messages can be decrypted on your device.
- Delete your account — email us and we will remove your account and its data. We are a small team, so this is handled by a person rather than a button today.
7. Children
Glow is not directed at children under 13, and we do not knowingly collect data from them.
8. Changes to this policy
If this policy changes in a way that affects what we collect or how we handle it, we will update the date at the top of this page and note the change in the app's release notes.
9. Contact
Questions, or a request to delete your account: [email protected].