Privacy Policy

1. Introduction

Glake ("we," "us," or "our") is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your data when you use glake.io.

2. Information We Collect

Information you provide:

• Name and email address; passwords are handled by Supabase Authentication. If you sign in with Google, we receive account information such as your email, name, and profile photo
• Profile information (username, bio, profile photo)
• Recipient name, shipping address, order items, payment status, transaction identifiers, and subscription records when you make a purchase
• Content you provide, including posts, shorts, comments, channel messages, direct messages, uploaded media, and questions to the AI assistant
• Preferences you choose to provide, including gender, age group, style preferences, favorite artists, language, and onboarding answers
• With your browser location permission, latitude and longitude for weather-based fashion recommendations

Information collected automatically:

• Device type, browser, and operating system
• IP address and general location
• With analytics permission, pages visited, time spent, login events, and features used within the app
• Interaction data needed for community features, such as likes, follows, restricts, messages, rewards, referrals, and which shorts you have viewed
• With advertising permission, online identifiers and browsing events collected by Google Ads and Meta Pixel for campaign measurement and advertising

3. How We Use Your Information

• To provide, operate, and improve the Service
• To process transactions and fulfill orders
• To detect the language of content and provide translations of posts, comments, or other submitted text
• To personalize your experience, including generating AI answers, outfit recommendations, and images when you use those features
• To understand service usage with analytics permission and measure advertising, including limited cookieless measurement through Google Consent Mode
• To monitor community activity and operate support and internal notifications
• To communicate with you about updates and support
• To enforce our Terms of Service
• To comply with legal obligations

4. Sharing of Information

We share data with providers as needed for the features described below. We do not sell personal information for money. Advertising disclosures may be considered a sale or sharing under some privacy laws; you can refuse advertising through Privacy choices.

• Supabase — authentication, database records, and uploaded files.
• Stripe — store payments, Premium subscriptions, and advertising purchases. If a store checkout uses Paddle, Paddle handles that transaction as Merchant of Record. The checkout identifies the provider.
• Vercel — website hosting and infrastructure; Vercel Analytics is enabled with analytics permission.
• PostHog — with analytics permission, page events and your account ID when signed in. We do not send your email in new PostHog identification events, and our integration disables session recording and automatic interaction capture.
• Google Ads and Meta — with advertising permission, campaign measurement and advertising-related browsing data. Google also receives limited cookieless measurement and consent signals when advertising permission is absent. Their processing may involve activity across services.
• Google Cloud Translation — submitted text for language detection and translation. Translations of posts and comments may be cached in our database for other readers.
• Anthropic — AI conversation history and concert context; for outfit recommendations, the preferences you submit, favorite group, and weather or city context.
• xAI — an outfit illustration prompt generated from your recommendation, which may reflect your submitted preferences.
• wttr.in — coordinates, when you permit location access, to retrieve weather for outfit recommendations.
• Slack — internal operational notifications when configured. These can include signup/login emails, purchase details, channel-message excerpts, and the latest AI question (up to 280 characters) with your email or account ID. Direct-message notifications include participant names or handles, group details, and message length or media status; that notification path does not include the DM text.
• Embedded content and discovery providers — YouTube video players, externally hosted images, and OpenStreetMap tiles receive connection data such as your IP address when loaded. These providers may use their own cookies or similar technologies. Artist lookups may send artist names or handles to X to retrieve public posts.
• Other users can see the profile and community content you make available to them. Uploaded media is served through hosted URLs; anyone who receives a public media URL may be able to access that file.
• When you view someone else's short while signed in, its author can see that you viewed it, along with your name, username, profile photo, and when you viewed it.
• Authorities or other recipients when disclosure is required by applicable law or necessary to address fraud, abuse, or legal claims.

5. Payment Data

Card details are collected by the payment provider through its checkout; Glake does not store full card numbers or card security codes in its application database. We store order and subscription records, such as provider customer/transaction IDs, amounts, and payment status. See the Stripe Privacy Policy or, for a Paddle checkout, the Paddle Privacy Policy.

6. Data Retention

We retain account and service records while they are needed to operate your account and the features you use. Retention also depends on the type of record, security and dispute-resolution needs, and applicable accounting or legal requirements. There is no single retention period for all categories.

Shorts stop being shown to other users 24 hours after they are posted. We keep the short, its file, and the record of who viewed it after that, under the retention approach above; you can delete your own short while it is still shown, or contact us to have expired shorts deleted.

You can delete your account in Settings or request deletion at support@glake.io. The in-app process deletes your application account and authentication account and attempts to cancel an active Stripe subscription. It does not automatically erase every uploaded file, backup, payment-provider record, or historical analytics and Slack record. Contact us to request review and deletion of remaining personal data, subject to applicable retention requirements. Deletion does not itself issue a refund. For billing help, contact support before deleting your account.

7. Cookies and Privacy Choices

Essential cookies and local storage support sign-in, security, your saved preferences, and your privacy choice. Optional analytics (PostHog, Vercel Analytics, and our login/page-time statistics), Meta Pixel, and Google advertising cookies and personalization are off until you choose to enable the relevant category. The Google tag loads with consent denied by default and can send limited cookieless measurement and consent signals before you choose or after you reject advertising. Use the Privacy choices control on this website to accept, reject, or change either category. Rejecting optional tracking does not prevent use of the Service. We remember your choice in this browser for up to 180 days; clearing browser storage or using a different browser may require a new choice. Global Privacy Control denies Google advertising storage, advertising user data, and personalization and disables Meta Pixel even if you previously accepted advertising. Google may still send limited cookieless signals. Withdrawing permission stops consent-dependent tracking and may reload the page; it does not delete data already received by providers. You can also manage cookies in your browser, including third-party cookies we cannot remove. Hosting security logs and records required to operate features are separate from optional analytics.

8. Your Rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your data (right to erasure)
• Object to or restrict certain processing
• Data portability
• Withdraw consent and opt out of sale or sharing for advertising through Privacy choices; we honor Global Privacy Control for advertising
• Complain to the privacy regulator responsible for your location

To exercise these rights, contact us with enough information to locate your account. We may need to verify your identity before acting, and some rights are subject to legal exceptions. Contact us at support@glake.io.

9. Children's Privacy

Glake is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected such data, we will delete it promptly.

10. Security and International Processing

We implement industry-standard security measures including encryption in transit (HTTPS), secure authentication, and access controls. However, no system is completely secure and we cannot guarantee absolute security. Our providers may process information outside your country, including in the United States. The locations and safeguards depend on the provider and service configuration. Contact us for information about the transfers relevant to your account.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will provide notice of material changes, and seek fresh consent where required by applicable law. The "Last updated" date at the top reflects the most recent revision.

12. Contact

For privacy-related questions or requests, please contact us at support@glake.io.