Privacy

Who we are

glith is made by an independent developer based in Romania. Contact: support@glith.app.

What glith collects

Sign-in with Google is required to use glith. Your account holds:

• Your Google account id and email address
• The YouTube channel you chose to track — its public channel id and name
• The latest published subscriber count for that channel
• Your goal
• Your widget settings: colors, shape, label, fill direction, background and opacity
• Your device's time-zone offset, so the widget can be refreshed at sensible hours for you. This is a device setting, not your location.
• A push-notification token, used to refresh the widget on your home screen
• Your Studio purchase state
• Two optional answers you can give while setting up: how long you have been creating, and what reaching your goal would unlock. Both can be skipped, and skipping stores nothing.
• Your progress through setup: which step you are on, which steps you finished or skipped, and counts of a few actions such as opening the plans sheet or adding the widget. Times and counts only, never anything you typed.
• If you start the free Studio trial: when it started and when it ends.

glith does not collect your location, your contacts, your browsing, or anything you watch on YouTube.

Why

glith uses this data to:

• Sign you in
• Show your growth as a count
• Refresh the widget
• Keep your settings
• Handle Studio purchases
• Bring you back to the step you left off on, and show us where setting up loses people
• Word what glith tells you, using the two answers above
• Run the free trial and remind you before it ends

YouTube and Google data

glith uses YouTube API Services. Using glith means accepting the YouTube Terms of Service and the Google Privacy Policy.

The YouTube data glith stores — a channel's id, name and latest published subscriber count — is refreshed periodically and is removed when you delete your account. Subscriber counts published by YouTube are rounded by YouTube itself for channels above 1,000 subscribers; glith stores what YouTube publishes and nothing more.

Connecting your own channel

glith offers an optional Connect your YouTube channel step that finds your channel for you instead of asking you to type its handle. It is optional: you can always enter a channel by hand, and if you never use Connect, glith never asks for YouTube access at all.

When you do use it, glith requests the read-only scope youtube.readonly, and uses it for exactly one thing: a single call asking YouTube which channel belongs to your account, so it can fill in the channel id and name. No narrower YouTube scope permits that call.

The Google access token is never stored. It is used once, inside that single request, and discarded. glith holds no refresh token and cannot access your YouTube account at any other time, including while you are not using the app.

You can revoke glith's access to your Google account at any time at myaccount.google.com/permissions.

glith's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How your data is protected

glith treats everything it holds about you, and in particular anything received from Google or YouTube, as sensitive. The measures below apply to all of it.

• Encrypted in transit. Every connection glith makes — between the app and glith's servers, between glith's servers and YouTube, and between the app and Google sign-in — uses HTTPS (TLS). The app never talks to YouTube directly; every YouTube request is made by glith's servers.
• Encrypted at rest. All stored data lives in Google Cloud Firestore, which encrypts data at rest by default.
• Your record is readable only by you. Firestore security rules let a signed-in user read only their own account record, and let no app or client write to it at all. Every write is performed by glith's server functions, which validate each request first. Push-notification tokens live in a collection that no client can read or write.
• The Google access token is never persisted or logged. When you use Connect, the token travels over HTTPS to glith's server, is used for one YouTube request, and is discarded when that request completes. It is not written to any database, cache or log, and any error returned to the app is a fixed message that cannot contain it. glith never receives a refresh token.
• Least privilege. glith asks for youtube.readonly only, only when you choose Connect, and uses it for a single call. The server-side YouTube API key is restricted to the YouTube Data API and is never shipped inside the app.
• Rate limits. The server limits how often any one account can trigger YouTube requests, which protects the service and your data from abuse.
• Restricted administrative access. Production data can be reached only by the developer, through Google Cloud's own console and access controls behind two-step verification, and only when needed to run the service or answer a support request. No third party has access; the processors listed below each receive only what their task needs.
• Deletion. Deleting your account removes everything listed above immediately (see “How long” below). Signing out or deleting your account also clears the widget's cached image and settings from your device.
• If something goes wrong. If glith ever discovers a breach affecting your data, you will be told by email at your Google account address without undue delay, and where the law requires it the relevant authority will be informed within 72 hours.

Where data is kept and who processes it

glith's data is stored on Google Cloud infrastructure in the United States (Firestore multi-region nam5), and its server functions run in Google's us-central1 region. If you are in the European Economic Area or the United Kingdom, this means your data is transferred outside it, under the safeguards Google applies to its cloud services.

The following providers process data on glith's behalf:

• Google Firebase — Authentication, Cloud Firestore, Cloud Functions and Cloud Messaging, for accounts, storage and push notifications
• Google Play — billing
• RevenueCat — purchase entitlement

glith shows no ads, uses no advertising or analytics SDKs, and does not sell or share your data with anyone else.

How long

glith keeps your data until you delete your account. Deleting it in the account menu removes, immediately: your account record and everything in it, your registered devices and their push tokens, your Google sign-in record with glith, and the tracked channel's cached data if nobody else is tracking that channel. On your device, signing out or deleting the account clears the widget's cached image and settings as well.

One record is kept after deletion. When you start a free Studio trial, glith notes that the tracked channel has used its one trial, so the same channel cannot take the trial again and again. That note holds the channel's public id and the dates only. It does not hold your account id, your email, or anything else about you.

Step-by-step instructions, including how to ask for deletion by email if you no longer have the app, are on the delete your account page. Deleting your account does not cancel a Google Play subscription, so if yours is still set to renew, cancel it in Google Play first.

Your rights

You can, at any time and without asking anyone:

• Change your goal or tracked channel in the account menu
• Revoke glith's access to your Google account at myaccount.google.com/permissions
• Delete your account, and all of the above data with it, in the account menu

If you are in the European Economic Area or the United Kingdom, data protection law also gives you the right to access, correct, export or restrict the processing of your personal data, and to object to it. The account menu covers deletion directly; for anything else, write to support@glith.app and it will be handled. You also have the right to complain to your national data protection authority — in Romania, the ANSPDCP.

Children

glith is not directed at children. Signing in requires a Google account, so glith's minimum age is Google's own minimum age for a Google account in your country.

This website

The glith.app website sets no cookies and runs no analytics. It is hosted on Cloudflare.

Changes

This policy may change as glith gains features. Updates are posted on this page, and the date at the top changes with them.

Contact

Questions about this policy: support@glith.app.