Legal
Privacy Policy
Short — one place your data lives, one place it goes, one log we describe in full before you sign in.
1. Operator
Glovrex is operated by mahirhir, a pseudonymous developer in Tokyo. Service name: Glovrex. Contact: via the public repository at github.com/mahirhir or X (@greymoth__). The service is in a pre-launch phase; this policy describes what the software does today and will be updated before any of it changes.
2. What Glovrex stores
The live demo runs on seeded data and needs no account — nothing you do there is saved. Once you sign in, your captures, extracted ideas, graph, and outputs are stored as plain files in a private folder on the machine Glovrex runs on: one folder per account, isolated from every other account and tested to stay that way, not just promised. It is not a shared database, and nothing in it gets synced out to a separate cloud silo on top of that. Your browser additionally keeps a few local preferences (theme choice, whether you have seen the onboarding tour, dashboard widget layout) in localStorage. These never leave your device.
3. What leaves your account
One thing, either way: when you run extraction or generation, the text you explicitly submit is sent to whichever AI provider your build has configured, tried in this order until one answers: DeepSeek, then Cloudflare Workers AI, then Google Gemini. When configured, this means the text may be processed by DeepSeek (a service operated under Chinese jurisdiction) or Cloudflare Workers AI, not only Gemini — each under that provider's own API terms, not ours. If none of the three are configured, or all of them fail to answer, the extraction falls back to a deterministic, non-AI offline algorithm, and no text leaves your account at all. We send the minimum context the feature needs, and we do not send anything you have not asked the AI to read. If you sign in with Google, Discord, or GitHub instead of email, that provider shares the basic account details needed to create your account, under its own terms — pick email and password if you would rather skip that. Everything else, including the usage log described next, stays inside your account's folder and does not reach another account or another service. We make no training-use promises on any provider's behalf; their API terms govern that. If this matters to you, read the terms of whichever provider your build actually reaches first before pasting sensitive material — DeepSeek and Cloudflare Workers AI included, not just Gemini.
4. Usage logging, analytics, and cookies
No third-party analytics scripts, tracking pixels, or ad cookies, on the marketing site or in the product. Signing in sets one functional session cookie so you stay signed in; it is not used to track you elsewhere. Signed-in accounts do get a first-party usage log, engine-trace: which of the AI's suggestions you accept, edit, or skip, rough token counts, and any outcome score you record against a decision. It lives inside your own account folder, never leaves it, and the sign-in page states exactly what it covers. The demo logs none of this, because it has no account to attach it to.
5. Your rights (APPI / GDPR)
No self-serve export or delete tool for your graph exists yet — the account Reset pane only clears local display preferences (name, portrait, theme), not your captures or outputs. Until that ships, email us or open an issue on the public repository and we will export or delete your account folder by hand, promptly. This section gets rewritten the day a self-serve tool replaces that manual process, not after.
6. Security
See the Security page for the current posture. Short version: signed-in data sits in an isolated per-account folder on the machine Glovrex runs on, the demo has nothing to attack because it saves nothing, and the one network path leaving either of those (AI provider calls) uses TLS.
7. Changes to this policy
If the data reality changes (accounts, sync, anything server-side), this policy changes first, with at least 7 days notice on the changelog.