Glowva
← Back to Glowva

Privacy Policy

Last updated: 14 June 2026

Glowva Ltd ("we", "us", "our") values your privacy and is committed to protecting your personal information. This policy explains what data we collect, why we collect it, and how we keep it safe.

For the purposes of UK GDPR and the EU GDPR, the data controller is Glowva Ltd, a company registered in England and Wales (company number 17114339), with its registered office at 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. You can reach our privacy team at [email protected].

1. Information We Collect

We collect only what's necessary to provide and improve our service:

  • Account information (username, email address, and a securely hashed password — we never store your password in plain text)
  • Phone number (only if you choose to verify your phone for added account security or access; stored encrypted and never used for advertising)
  • Profile information (display name, bio, profile picture)
  • Content you create (drops, letters, messages, campfire contributions, and any media you upload)
  • Usage and device information (to keep the app working, secure, and improving, and to deliver push notifications)
  • Location data (only if you choose to share it — used for location-based discovery features)

Your messages and posts belong to you and are never shared or sold.

2. How We Use Your Information

We use your data to help you connect with others, improve the app experience, and keep our community safe from misuse or spam.

3. Legal Basis for Processing (Where UK/EU GDPR Applies)

Where data protection law requires a lawful basis to process your personal data, we rely on the following:

  • Performance of a contract — to create your account and provide the features you ask for.
  • Legitimate interests — to keep Glowva safe, secure, and working well (including moderation, abuse prevention, and aggregate analytics), balanced against your rights and freedoms.
  • Consent — for optional features you choose to switch on, such as sharing your location or verifying your phone number. You can withdraw consent at any time.
  • Legal obligation — where we must process or retain data to comply with the law, including child-safety reporting obligations.

4. Data Security

We encrypt sensitive data at rest using AES-256-GCM — including particularly sensitive fields such as phone numbers — and protect data in transit with TLS. Glowva is not end-to-end encrypted — our automated moderation systems (see Section 5) need to read message content to keep the community safe. You can delete your account anytime, and your personal data will be permanently removed.

5. Content Moderation

To keep Glowva safe, content you post (including drops, letters, messages, and uploaded media) is reviewed by automated systems before or shortly after it appears:

  • Anthropic (text and prompt analysis)
  • Sightengine (image and video moderation)

These providers process your content under strict data-handling agreements and do not use it to train their general-purpose models. A small amount of content may also be reviewed by our human moderation team if it is reported, escalated, or flagged for appeal.

6. Data Sharing

We do not and will not sell your personal information. We only share data with:

  • Service providers who help us operate Glowva: Railway (database hosting), Cloudflare (file storage and content delivery), Anthropic and Sightengine (automated moderation), SendGrid (transactional email), Twilio (phone verification, only if you use it), Expo, Apple and Google (push notifications), and Vercel (privacy-friendly, cookieless website analytics)
  • When required by law or legal process
  • With your explicit consent

7. International Data Transfers

Some of our service providers are based outside the UK and the European Economic Area (for example, in the United States). Where we transfer your personal data internationally, we rely on appropriate safeguards — such as the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or an adequacy decision — so that your data remains protected to an equivalent standard.

8. Wellbeing Notice

Glowva is a space for connection and self-expression. It is not a mental health service and is not a substitute for professional support. If you are in crisis or struggling, please reach out to a qualified service in your area (for example, Samaritans in the UK on 116 123, or the 988 Suicide & Crisis Lifeline in the US).

9. Data Retention

We retain your data as follows:

  • Active accounts: data retained while your account is active
  • Deleted accounts: personal data permanently removed within 30 days
  • Campfire Rooms: dissolve automatically 24–48 hours after they open, and are not archived
  • Verification tokens (email and phone): expire automatically shortly after they are issued
  • Letters and messages: retained until you delete them or close your account

10. Your Rights

You can access, update, or delete your data whenever you wish. You also have the right to:

  • Access your personal data
  • Request data portability
  • Request data deletion
  • Restrict data processing
  • Object to processing based on legitimate interests
  • Withdraw consent for optional features at any time

Contact us if you need help exercising these rights. You also have the right to lodge a complaint with your local data protection authority (in the UK, the Information Commissioner's Office).

11. Children's Privacy

Glowva is intended for people aged 16 and over. We do not knowingly collect personal information from anyone under 16. If we learn that we have collected data from someone under 16, we will delete it promptly. If you believe a child under 16 has provided us with personal data, please contact [email protected].

12. Cookies & Analytics

We use essential cookies for:

  • Authentication (session cookies)
  • Security (CSRF protection)

We do not use advertising or cross-site tracking cookies. We use a privacy-friendly, cookieless analytics service (Vercel Analytics) that measures aggregate page traffic without setting cookies or identifying you individually. The essential cookies above are required for the app to function and do not require consent.

13. Exercising Your Privacy Rights

To exercise your privacy rights:

  • Access your data: Go to Settings → Profile
  • Export your data: Go to Settings → Account Profile → Download My Data
  • Delete your account: Go to Settings → Account → Delete Account
  • Update your data: Go to Settings → Profile

All privacy rights can be exercised directly through the app, or by contacting us.

14. California Privacy Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

  • Right to know what personal information we collect, use, and share
  • Right to delete your personal information
  • Right to opt-out of sale (we do not sell your data)
  • Right to non-discrimination for exercising your privacy rights

You can exercise these rights using the methods described in Section 13 above.

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you in the app or by email. Continued use of Glowva after an update means you accept the revised policy.

16. Contact Us

For privacy questions or data requests, contact us: