Legal

Privacy Policy

Last updated: 18 October 2026

JoshMTech, the UK sole trader behind Gloss, is the data controller for your personal data. The app runs on your Mac: what you type, your glossaries and your usage statistics stay on your device. We only collect what we need to sell and support licences — mainly your email, purchase records and an activation fingerprint — and we use no analytics, advertising or tracking.

Who we are

This policy explains how JoshMTech (“we”, “us”, “our”), a sole trader based in the United Kingdom and the maker of Gloss, handles your personal data. JoshMTech is the “data controller” under the UK GDPR and the Data Protection Act 2018.

For any privacy question, or to exercise your rights, email privacy@trygloss.tech.

The app runs on your Mac

Gloss works locally. We do not run analytics, telemetry or crash reporting, and the app does not send us what you type.

Keystrokes are examined only in memory on your Mac to detect your triggers. They are never stored or sent.
Your glosses, glossaries and settings live on your Mac. Usage statistics are simple counts kept only on your Mac, never synced; you can reset them or turn them off.
Accessibility permission. Gloss needs the macOS Accessibility permission to read the text field you are typing in and to insert expansions. When macOS Secure Input is on (for example in password fields, password managers, or Terminal with Secure Keyboard Entry) Gloss pauses and tells you which app switched it on.
iCloud sync (optional). If you turn it on, your glossaries and settings sync through your own iCloud account via Apple. We cannot access that data.
On-device AI (optional, Pro).AI features run on your Mac using Apple's Foundation Models. A request contains only the gloss's own instruction plus the context that gloss chooses to include (for example clipboard contents, selected text, the app name, or form answers). Text around your cursor is never sent, clipboard items a password manager marks as concealed are never read, and Apple's Private Cloud Compute is not used.

What the app sends us

To check your licence, Gloss contacts our licence server at api.hoverstash.tech— a self-hosted copy of Keygen Community Edition that we run on our own server in Germany. After activation it checks about every 6 hours. Each check sends:

your licence key;
a SHA-256 hash of your Mac's hardware identifier (the raw IOPlatformUUID never leaves your Mac);
the platform (“macOS”);
a device label such as “Mac (Mac15,6)” built from the model identifier (never your computer's name);
a request header containing the app version, build and macOS version.

If Gloss cannot reach the server it keeps Pro working offline for 7 days, then pauses Pro features (the free tier keeps working) until the next successful check.

Updates. Gloss checks for updates through the open-source Sparkle framework at trygloss.tech/api/appcast (a standard request that includes the app and macOS version) and downloads updates from updates.trygloss.tech. You can turn automatic checks off in the app.

Information we hold

Account and licence. Your email address (and your name if you give it at Stripe checkout), your Stripe customer ID, your licences, and your activated devices (the device label and fingerprint hash described above).
Purchases.Invoice records (amount, currency, country and Stripe IDs). Payments run on Stripe's hosted checkout — we never see your card details. Stripe sends us webhook events (which include your email, country and amounts); we keep copies for up to 90 days.
Sign-in.When you sign in we email a single-use link valid for 15 minutes. We store only a SHA-256 hash of the link's token, together with your email, IP address and browser user agent, for security and rate limiting.
Sessions. While you are signed in we store a session record with your IP address and user agent (truncated to 400 characters).
Email. We send transactional email (sign-in links, licence keys, payment problems) through Resend. If you email our support addresses, those messages are received through Resend and stored so we can reply.
Community glossaries. If you upload one, we process its name, description, the author name you enter and its glosses. Uploads are scanned for secrets and risky scripts, personal details are removed from the name, description and author fields, and staff review them before anything is published. Approved glossaries are public for anyone to browse and download, and we record download counts. We remove yours on request; rejected submissions are deleted after 30 days.
Staff actions in our admin tools are recorded in an audit log that can include IP address and user agent.
Server logs. Our web server keeps access logs (IP address, user agent, the page requested and the time).

Cookies

We use a few first-party cookies and no advertising or analytics cookies. We do not use third-party scripts, tracking pixels or externally hosted fonts.

Cookie	Where	What it is for
`__Host-gl_customer`	`app.trygloss.tech`	Your signed-in customer session. HttpOnly, Secure, SameSite=Lax, sliding 30-day session.
`__Host-gl_admin`	`admin.trygloss.tech`	Staff-only operator session. HttpOnly, Secure, SameSite=Strict, sliding 8-hour session up to a 24-hour maximum.
`gloss_account`	`.trygloss.tech`	Set to “1” while you are signed in so the site can show your account link. Secure, SameSite=Lax, readable by page scripts, and holds no personal data.
`gloss_theme`	`.trygloss.tech`	Only set if you choose Light or Dark with the appearance switch, so the site keeps your choice; without it the site follows your Mac. Lasts a year, SameSite=Lax, and holds no personal data.

Why we use your data

Under the UK GDPR our lawful bases are:

Contract— to deliver Gloss, issue and check licences, run your account and dashboard, provide updates and reply to support.
Legitimate interests— to keep our services secure and to prevent abuse, fraud and licence-sharing, and to review community glossaries before publishing.
Legal obligation— to keep invoices and tax records.

We do not use your data for advertising, and we do not sell it.

We use a small number of processors under written data-processing terms:

Stripe — payments (United States / Ireland). stripe.com/privacy
Resend — email delivery (United States). resend.com/legal/privacy-policy
Hetzner Online GmbH — hosting (Germany). hetzner.com/legal/privacy-policy

Our licence server (Keygen Community Edition) is self-hosted on our own Hetzner infrastructure, not a third-party Keygen service. We may also disclose data where the law requires it.

International transfers

Our hosting is in the EEA (Germany), which the UK recognises as providing adequate protection, so that transfer needs no additional safeguards. Some processors (Stripe, Resend) are in the United States. Where data goes there, transfers rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses and/or the UK Extension to the EU–US Data Privacy Framework, as applicable.

How long we keep data

Unused sign-in links: expire after 15 minutes; sign-in link records are deleted after 30 days.
Customer sessions: deleted 90 days after the session ends.
Staff sessions: deleted 30 days after they end.
Stripe webhook event copies: deleted after 90 days.
Support emails and audit-log entries: deleted after 2 years.
Web server access logs: deleted after 30 days.
Rejected glossary submissions: deleted after 30 days.
Account, licence and device records: kept while you hold a licence (licences are for the life of the product) so we can restore your licence, and deleted on request.
Invoices: kept for 6 years for tax purposes.

Your rights

Under the UK GDPR you can ask us to:

give you access to the personal data we hold about you;
correct data that is inaccurate;
erase your data (except records we must keep, such as invoices);
restrict or object to certain processing;
provide your data in a portable form.

Email privacy@trygloss.techand we will respond within one month. If you are unhappy, you can complain to the Information Commissioner's Office at ico.org.uk, though we would welcome the chance to help first.

Security

All traffic uses HTTPS with TLS 1.2 or newer, and we send HSTS.
Sign-in tokens are stored only as SHA-256 hashes. Session cookies are HttpOnly, Secure and use the __Host- prefix, which ties them to a single host; the admin cookie uses SameSite=Strict and the customer cookie SameSite=Lax.
The raw hardware identifier used for activation never leaves your Mac — we only ever receive a one-way hash.

Changes to this policy

If we materially change this policy we will update this page and, where appropriate, tell active licence holders by email. The date at the top shows the latest revision.

Contact

Privacy questions and requests: privacy@trygloss.tech. General support: support@trygloss.tech. You also have the right to complain to the ICO (ico.org.uk).