Privacy Policy
Last updated: August 26, 2026
This policy explains what personal data Glypher collects when you use the app or the glypher.app website, why, who it's shared with, how long it's kept, and what rights you have. It applies under the General Data Protection Regulation (GDPR).
Important, please read first: Glypher works by showing a floating bubble on top of your screen and analyzing the text visible on screen (Android screen-capture technology) to offer translation and explanations. In practice, this means the text you select — including, potentially, text from another app or a conversation with another person, if it happens to be on screen at the moment you make a selection — is sent to our translation/AI providers (DeepL, Anthropic) for processing. Glypher only captures and transmits the text you explicitly select, never the whole screen and never continuously.
1. Who is responsible for your data
Glypher is published by Guillaume Bruley, a French sole trader (micro-entrepreneur) (SIRET: 109 234 849 00015). For the publisher's full identity, see the legal notice. The terms governing use of the Service are set out in the terms of use. For any question about your data, contact: contact@glypher.app.
2. Data we collect
- Account data: email address and password (your password is never stored in plain text; it's managed securely by our authentication provider).
- Content processed on request: the text you select on screen and its immediate context, sent to DeepL (translation) and/or Anthropic (grammar explanations) when you trigger the action.
- Content you save: translations/explanations you choose to save under "Saved", and any folders you create to organize them.
- Credit and usage data: credit balance, transaction history (welcome gift, ads watched, spending), quota counters.
- Anti-abuse technical data: request-rate counters, and, if an account is deleted and recreated, a non-reversible fingerprint (hash) of the email address — never the plain address — used only to prevent bypassing usage limits.
- Advertising data: if you choose to watch a rewarded ad, Google AdMob may process an advertising identifier provided by your device.
- Anti-bot verification: at signup, sign-in, or account deletion via the website, an hCaptcha challenge is used to verify you're not a bot; hCaptcha may process technical signals from your device/browser for this purpose.
3. Why we process this data
- Performance of the contract between us (the service's terms of use): creating your account, translating, explaining, saving, and managing your credits.
- Legitimate interest: service security, fraud and abuse prevention (rate limiting, anti-quota-bypass), service improvement.
- Consent: showing rewarded ads (you voluntarily choose to watch one).
4. Who your data is shared with
We do not sell any data. It is shared only with the providers necessary to run the service, each authorized to use it solely for the purpose stated:
| Provider | Role | Data involved |
|---|
| Supabase | Authentication, database, server function hosting (hosted in the EU, Paris region) | All account data |
| Anthropic | Grammar explanation generation (Claude) | Selected text + context |
| DeepL | Translation | Selected text |
| Google (AdMob) | Rewarded ads | Device advertising identifier |
| Cloudflare | Hosting glypher.app, routing the contact email | Site browsing data, emails sent to contact@glypher.app |
| Resend | Sending transactional emails (confirmation, password reset) | Email address |
| hCaptcha | Anti-bot verification | Technical device/browser signals |
5. International transfers
Anthropic, Google, Cloudflare, Resend, and hCaptcha are based in the United States; DeepL is based in Germany (European Union); Supabase hosts your data in the EU (Paris). Where a transfer outside the EU occurs, it is governed by appropriate safeguards (European Commission Standard Contractual Clauses and/or, where applicable, the EU-US Data Privacy Framework).
6. Retention periods
- Account data, credits, saved content: kept for as long as your account exists, permanently deleted (cascading) as soon as the account is deleted.
- Cached responses used to prevent double-charging credits after a network drop: 5 minutes maximum.
- Request-rate anti-abuse counters: 7 days maximum.
- Anti-fraud fingerprint tied to an account deletion (hashed email): 30 days maximum after deletion, even for an already-deleted account — needed to prevent immediately bypassing usage limits by deleting and recreating the account.
7. How we protect your data
Each user can only access their own data (database row-level security, enforced by Postgres). Passwords are never stored in plain text. Sensitive operations (credits, account deletion) go exclusively through dedicated server functions, never through direct database access from the app.
8. Your rights
Under GDPR, you have the right to access, rectify, erase, restrict, object to, and port your data. You can delete your account and all associated data directly from the app (Settings → Delete account) or, if you no longer have the app, via glypher.app/delete-account. For any other request, contact contact@glypher.app. You can also lodge a complaint with France's CNIL (cnil.fr) or the data protection authority in your country of residence.
9. Cookies and trackers
The glypher.app website does not use tracking cookies. Within the app, a device advertising identifier may be processed by Google AdMob only when you choose to watch a rewarded ad.
10. Minimum age
Glypher is not intended for children under 16 without the consent of a parent or legal guardian.
11. Changes to this policy
This policy may be updated; the date at the top of the page shows the last change. We will notify you in the app of any significant change.
12. Contact
contact@glypher.app