Privacy Policy for Glot - Contextual AI Translator

Last Updated: July 21, 2026

Overview

Glot ("the Extension") is committed to protecting your privacy. This Privacy Policy describes in detail what data we collect, how we use it, how we store it, and how we share it when you use our Chrome Extension.

User Consent and When Data Is Sent

Glot does not continuously upload browsing activity. Translation content is processed only after you intentionally request translation, such as by selecting text and using the keyboard shortcut, right-click menu, or translation UI. Account and subscription data is processed only when you sign in, start a trial, refresh entitlement status, or manage a paid plan.

You can use Bring Your Own API Key mode to send translation requests directly from your browser to the AI provider you choose. You can also clear locally stored settings and API keys at any time from the Extension options page or by uninstalling the Extension.

Information We Collect and Process

Depending on how you use the Extension, we may collect or process the following information. "Collect" includes information stored by Glot servers; "process" includes information transmitted in real time only to provide the requested translation.

1. Account Data (collected when you register or sign in)

• Email address: Used to create and verify your Glot account.
• User ID: A unique identifier automatically generated at registration, used to associate your account with your subscription status.
• Password: When you register or sign in, your password is transmitted securely via HTTPS to Supabase Authentication. Glot does not store or have access to your plaintext password.
• Authentication tokens: Session tokens are stored in chrome.storage.local to keep you signed in. When needed, they are transmitted via HTTPS to Supabase and Glot's managed services to authenticate your account and verify service entitlements.

2. Subscription & Payment Data

• Subscription status: Your plan type (free trial, premium) and expiry date, stored on our servers to verify service entitlements.
• Stripe customer ID: Generated when you process a payment through Stripe, used to manage your subscription. We do not store full payment card details.
• Trial period data: The start and end dates of the 7-day free trial automatically granted at signup.

3. Translation Content (only when using the built-in hosted translation service)

• Selected text & page context: When you intentionally request a translation using Glot's built-in hosted translation service, the selected text and the minimum necessary surrounding page context are proxied through our servers to the AI provider. Our servers do not persistently store translation content — they act solely as a real-time relay.

If you use Bring Your Own API Key mode, translation content is sent directly from your browser to your configured AI service (e.g., DeepSeek, OpenAI, Anthropic, or local Ollama) and does not pass through our servers.

4. Locally Stored Data

The Extension uses chrome.storage to save the following on your local device:

• Your API Keys and provider configurations
• Target language and translation preferences
• Prompt configurations, UI preferences, and shortcut settings
• Supabase authentication session tokens

This data is stored in chrome.storage.local on your device and is not synchronized through Chrome Sync. API keys and provider settings are not uploaded to Glot servers. In BYOK mode, the configured API key is sent only to the AI endpoint you configured so that provider can authenticate the translation request.

5. Technical & Diagnostic Data

• Operational metadata: When you use hosted translation, our infrastructure may process limited technical metadata such as request IDs, route IDs, proxy identifiers, model identifiers, request timing, response status, and error details for reliability, abuse prevention, and debugging.
• Account-linked service metadata: Our managed service may process your user ID and entitlement status to verify whether you can access hosted translation features.

Data Handling Summary

How We Use Your Information

• Account management: We use your email address and user ID to create, verify, and manage your account.
• Service authorization: We check your subscription status and trial period to determine whether you are entitled to use the built-in translation service.
• Translation proxy: In hosted mode, we relay your translation requests to an AI provider and immediately discard the content — we do not retain it.
• Payment processing: We use Stripe to process premium subscriptions and update your subscription status on our servers.
• Reliability, security, and debugging: We use limited technical and diagnostic metadata to operate the service, investigate failures, prevent abuse, and improve reliability.
• We do not sell your personal data or use it for advertising purposes.

Data Storage

• Server-side: Account information (email, user ID) and subscription status are stored in a Supabase-hosted database located in the United States.
• Local device: API keys, preferences, and authentication tokens are stored in chrome.storage.local on your device and are not synchronized through Chrome Sync.
• Translation content: Proxied in real time in hosted mode — never persistently stored on any server.
• Technical logs: Limited operational logs may be retained temporarily by our service infrastructure for reliability, security, abuse prevention, and debugging purposes.

Data Retention

• Account data (email, user ID, subscription status): Retained until you request account deletion or the data is no longer needed to provide the service, subject to applicable legal obligations.
• Payment-related data: Managed by Stripe according to its own retention policy for billing, tax, and legal compliance purposes.
• Auth session tokens: Stored in local browser storage until you sign out or uninstall the Extension.
• Translation content: In hosted mode, exists only in memory during the request and is discarded immediately after — never written to persistent storage.
• Technical & diagnostic logs: Retained only for as long as reasonably necessary for reliability, security, abuse prevention, and debugging. Aggregated or anonymized statistics may be retained longer where they can no longer identify a user.
• Locally stored data: Remains on your device until you manually clear it or uninstall the Extension.

Data Security

We take reasonable technical and organizational measures to protect your personal data against unauthorized access, use, or disclosure:

• Encryption in transit: All communication with our servers is encrypted via HTTPS/TLS.
• Infrastructure security: The service runs on professional cloud platforms such as Cloudflare and Supabase, which provide underlying security, DDoS protection, and access controls.
• Authentication protection: Passwords and session tokens are transmitted only over HTTPS. Glot does not store plaintext passwords. Session tokens are stored in chrome.storage.local and are sent only when required for authentication and entitlement verification.
• Access control: Only a limited number of maintenance personnel can access infrastructure logs when necessary, and only within log retention policy constraints.
• Translation content protection: In hosted mode, translation content is relayed only transiently in memory, never written to disk, and never used for model training.

Despite these measures, no method of internet transmission or electronic storage is 100% secure, and we cannot guarantee absolute security.

Data Sharing

We only share data with third parties as described below. We do not sell or disclose your information for any other purpose.

• Supabase (Privacy Policy): Used for user authentication and account database storage. Supabase servers are located in the United States.
• Stripe (Privacy Policy): Used to process premium subscription payments. Payment details are handled directly by Stripe; we do not store card information.
• OpenAI (Privacy Policy): Used as one hosted translation provider for processing translation requests.
• Cloudflare Workers AI (Privacy Policy): Used as one hosted translation provider and supporting network infrastructure for processing translation requests.
• User-selected AI providers: In Bring Your Own API Key mode, translation text is sent directly from your browser to the provider you configure, such as OpenAI, Anthropic, DeepSeek, or a local Ollama endpoint, without passing through our servers.
• Cloudflare (Privacy Policy): Used for request routing and network proxy infrastructure.

Children's Privacy

The Glot Extension and its services are not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we may have collected information from a child under 13, please contact us using the information below and we will promptly take steps to delete such information.

Third-Party Service Categories and Current Providers

To provide translation, account, and payment functionality, we use the following third-party services. Each service may process portions of data under its own privacy policy:

• Supabase (Privacy Policy): User authentication, account database, and subscription status storage. Data processed: email, user ID, subscription info, Stripe customer ID. Servers are located in the United States.
• Stripe (Privacy Policy): Premium subscription payment processing. Data processed: payment method info, billing address, transaction records. We do not store full payment card numbers.
• Cloudflare (Privacy Policy): Request routing, network proxy, CDN, and Workers AI inference service. Data processed: translation requests (transient relay), request metadata, IP address (for routing and security).
• OpenAI (Privacy Policy): One of the AI model providers for hosted translation. Data processed: translation text and context.
• Google Fonts (Privacy Policy): Our website uses Google Fonts for typography, which may log your IP address.
• User-selected AI providers (BYOK mode): If you use Bring Your Own API Key mode, translation data is sent directly from your browser to the provider you configure (e.g., DeepSeek, Anthropic, OpenAI, Ollama, etc.) and is not governed by this policy. Please refer to the corresponding provider's privacy policy.

Permissions Justification

• storage: Required to save your API keys, preferences, extension settings, and Supabase authentication session locally.
• alarms: Required to periodically refresh managed translation routing and availability information so hosted translation remains reliable. It is not used to collect browsing history.
• activeTab & <all_urls>: Required to read the context of the page you are translating and to render the translation UI over web pages, including PDFs and local files.
• contextMenus: Required to provide the right-click translation shortcut.
• scripting & webNavigation: Required to properly inject the translation overlay, PDF.js integration, and LaTeX rendering components.

Chrome Web Store Limited Use Disclosure

Glot's use of information received from Chrome APIs complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. We use user data only to provide and improve user-facing translation features, do not sell it, do not use it for personalized advertising, and do not allow humans to read translation content except where required for security, legal compliance, or with the user's explicit consent.

Your Rights and Controls

• Access your data: You can view your account information and subscription status in the Extension's options page.
• Choose translation routing: You can use hosted translation or Bring Your Own API Key mode. BYOK mode sends translation content directly to your configured provider instead of through Glot servers.
• Clear local data: You can remove API keys, provider settings, and other local settings from the Extension options page, by clearing extension data in Chrome settings, or by uninstalling the Extension.
• Delete your data: To delete your account and associated server-side data, please contact us using the information below. We will process your request within a reasonable timeframe.

Changes to this Policy

We may update this privacy policy from time to time. Any changes will be reflected on this page, with the date at the top updated accordingly.

Contact

If you have any questions about this privacy policy, wish to exercise your data rights, or want to delete your account, please contact the developer via GitHub or the support links provided in the Chrome Web Store.