glowbug Privacy Policy

Draft for legal review. Effective 2026-10-17.

Nimonic (니모닉), [주소], is the controller of your personal data. Contact: [email protected]. EU representative (GDPR Art. 27): [EU 대리인].

UK representative (UK GDPR Art. 27): [UK representative]. Nimonic (니모닉) is a sole proprietorship registered in the Republic of Korea. This policy covers the glowbug apps, the phone web version and our website, wherever you live. The sections near the end add what particular countries and US states require.

What we process, why, and for how long

• We don't record, store, or send your keystrokes. The app only checks whether your chosen shortcut is held.
• We don't sell personal data, don't use it for advertising, and don't train AI models with it. Our AI providers' API terms don't allow them to use it for training.
• We don't look for sensitive information (such as health, religion or finances). If a screenshot or photo happens to show some, it is used only to answer your question, is not stored by us, and is never used to infer anything about you.

How long we keep data

Who processes data for us (and international transfers)

For data from the EU, transfers to Korea rely on the EU adequacy decision for the Republic of Korea. Onward transfers to the USA rely on the providers' data processing agreements with Standard Contractual Clauses or the EU-US Data Privacy Framework, where certified.

Our data is stored on servers in Japan (Tokyo), which also has an EU adequacy decision. From the UK, transfers to Korea and Japan rely on UK adequacy regulations, and onward transfers to the USA on the UK Extension to the EU-US Data Privacy Framework or the UK Addendum to the Standard Contractual Clauses. You can ask us for a copy of these safeguards at [email protected].

Legal bases (GDPR and UK GDPR)

We rely on these legal bases under Article 6 of the GDPR and UK GDPR:

• Contract (Art. 6(1)(b)): to provide what you ask for: answers, your account and plan, gifts, saved guides and payments.
• Legitimate interests (Art. 6(1)(f)): to keep the service secure and prevent fraud and abuse (hashed device identifier, rate limits, bot check), to fix errors, and to establish or defend legal claims. We use as little data as possible for this, and you can object.
• Consent (Art. 6(1)(a)): only where we ask for it: "answer when I say glowbug" and, if you sign in with another account, receiving its email and display name. You can withdraw consent at any time; this doesn't affect processing before you withdrew it.
• Legal obligation (Art. 6(1)(c)): keeping payment and tax records, and the age check.

Your rights

Under the GDPR and UK GDPR you have the right to:

• access your data and get a copy of it;
• have inaccurate data corrected;
• have your data erased;
• restrict processing;
• data portability (receive your data in a machine-readable format);
• object to processing based on legitimate interests;
• withdraw your consent at any time;
• not be subject to decisions based solely on automated processing that have legal or similarly significant effects (we make none).

How to exercise them:

• Account → download my data: an instant export of everything we hold, in a machine-readable format.
• Account → delete my account: immediate deletion.
• Anything else: email [email protected], ideally from the address on your account. We may ask you to confirm your identity. It's free.

We reply within one month. If a request is complex or there are many, we may extend this by up to two more months; we'll tell you why within the first month.

You also have the right to complain to a data protection supervisory authority, in particular in the EU country where you live, work or where the issue happened, or to the Information Commissioner's Office (ICO) in the UK. EU representative: [EU 대리인]. UK representative: [UK representative].

United States

This section applies to residents of California (CCPA as amended by the CPRA) and of other US states with comprehensive privacy laws, such as Virginia, Colorado, Connecticut, Texas and Oregon.

What we collect, by category (now and in the last 12 months):

• Identifiers: email address, account and sign-in identifiers, hashed device identifier, IP address.
• Commercial information: your plan, purchases and gifts.
• Internet or other electronic network activity: usage counts, timestamps, error reports.
• Approximate location: the country derived from your connection. No precise location.
• Audio and visual information: screenshots, photos and voice you send with a question (not stored by us).
• Sensitive personal information: we don't seek it. A screenshot or photo may happen to show some; we use it only to answer you and don't use it to infer characteristics about you.
• We don't create inferences or profiles about you.

Sources: you, your device, the sign-in provider you choose, and payment providers. We use this information for the purposes in the table above, disclose it only to the service providers and contractors listed above for those purposes, and keep it for the periods above.

We do not sell or share personal information, including for cross-context behavioural or targeted advertising, and have not done so in the last 12 months. We show no ads. We use sensitive personal information only to provide the service you ask for. We treat a Global Privacy Control signal as a valid opt-out request.

Your rights: to know and access what we collect, use and disclose; to delete it; to correct it; to opt out of sale, sharing, targeted advertising and profiling (we do none of these); and to limit the use of sensitive personal information. We won't discriminate against you for using these rights: no different prices, quality or denial of service.

How to make a request: use Account → download my data or delete my account, or email [email protected] with the subject "US privacy request". We verify a request by confirming control of the email address on your account. An authorized agent may make a request for you with your signed permission; we may ask you to confirm your identity with us directly. We respond within 45 days (extendable once by 45 days, with notice). If we refuse, you can appeal by replying to our answer; we decide within the time your state's law sets, and if you disagree you can contact your state attorney general.

Republic of Korea

If you live in the Republic of Korea, the Korean version of this policy (개인정보 처리방침) applies. It covers the Personal Information Protection Act in detail: the overseas transfer table, processors, destruction, safety measures, our privacy officer ([개인정보 보호책임자]) and where to seek remedies. We act on requests from Korea within 10 days.

If you live in Brazil, Japan, India, Canada or Australia

• Brazil (LGPD): we process your data on the bases of contract performance, legitimate interest and consent (Art. 7). You have the rights in Art. 18, including confirmation of processing, access, correction, anonymisation or deletion, portability, information about sharing, and withdrawal of consent. Our data protection contact (encarregado): [개인정보 보호책임자], [email protected]. You can also complain to the ANPD.
• Japan (APPI): our data is stored in Japan (Tokyo). It is also transferred to the Republic of Korea, where we are based, to the USA and to the other countries in the recipients table. Korea has a comprehensive data protection law (the Personal Information Protection Act) with an independent supervisory authority. The USA has no comprehensive federal privacy law; protection there depends on sector and state laws. Each recipient is bound by contract or its own policy to protect your data. You can ask us at [email protected] for disclosure, correction, suspension of use or deletion of your data, and for details of our security measures.
• India (DPDP Act 2023): you have the rights to information about your data, correction and erasure, grievance redressal, and to nominate someone to exercise your rights if you die or become unable to. Grievance Officer: [Grievance Officer], [email protected]. We respond within 90 days at most. If you're not satisfied, you can complain to the Data Protection Board of India.
• Canada (PIPEDA): you can access and correct your data and withdraw consent, subject to legal or contractual limits. Your data is processed outside Canada (in Japan, Korea, the USA and the other countries above) and may be accessible to authorities there under local law. You can complain to the Office of the Privacy Commissioner of Canada.
• Australia (Privacy Act 1988): we handle your data in line with the Australian Privacy Principles. Your data is disclosed to the overseas recipients and countries listed above. You can access and correct your data; we respond within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC).

Children

glowbug is for people aged 18 and over (19 in the Republic of Korea), and the AI features unlock only after you confirm your age. glowbug is not directed to children under 13, and we don't knowingly collect personal information from them (US COPPA) or from anyone under our minimum age. If we find that we have, we delete it. If you think a child has given us data, email [email protected].

Security

• Encryption in transit: all traffic uses TLS.
• Data minimisation: we collect only what we need. Screenshots, photos and audio are never stored by us, and error reports contain no screen, audio or text.
• Access controls: least-privilege access; sign-in tokens and device identifiers are stored only as hashes.
• Edge protection: our website and servers sit behind Cloudflare (DDoS protection, bot check), and we apply rate limits.
• Providers: our AI providers process data under API terms that don't allow training on it.

If a breach happens: where the GDPR or UK GDPR requires, we report it to the supervisory authority within 72 hours of becoming aware of it, and tell you without undue delay if it is likely to put your rights at high risk. For users in Korea, we notify you and report to the authorities within 72 hours, as the Personal Information Protection Act requires. In the US and elsewhere, we notify you and the authorities as local law requires.

Cookies and similar technologies

We use no tracking or advertising cookies, no analytics and no ad pixels. We only use:

• localStorage in your browser: your language choice and, in the phone web version, a random device identifier. Both are needed for features you ask for.
• Cloudflare Turnstile: a bot check when you create a trial account from a web page. It is a strictly necessary security measure; Cloudflare processes your IP address and browser signals for it and may use strictly necessary security cookies.

Because these are all strictly necessary, they don't need your consent and we show no cookie banner. You can clear them at any time in your browser settings.

AI transparency

• When you use glowbug, you are interacting with an AI, not a person, and the app tells you so.
• Answers are generated by AI and are labelled as AI-generated in the app; the voice you hear is a synthetic AI voice (EU AI Act Art. 50; Korean AI Basic Act).
• AI answers can be wrong. Check important steps yourself, especially payments, security settings or anything you can't undo.
• We make no decisions about you based solely on automated processing that have legal or similarly significant effects.

Changes

We'll announce changes in the app and on our website in advance. Material changes require your renewed consent.