Glifaro Privacy Policy

Effective Date: 2026-07-04
Last Updated: 2026-07-04

1. Scope of This Policy

This Privacy Policy explains how Wu Yujie, as the individual developer / operator of Glifaro, collects, uses, stores, shares, and protects information related to Glifaro. This Policy applies to:

• The Glifaro website, web login, registration, login, password recovery, account dashboard, and payment entry points.
• The Glifaro desktop application, license verification, desktop login, device binding, and update services.
• Glifaro Agent, document editing, export, local workspaces, optional GitHub version management, and optional Supabase remote sync.
• Customer support, billing, refunds, security, feedback, and other communications related to Glifaro.

This Policy does not apply to services independently controlled by third parties, such as Waffo Pancake, OpenRouter, other AI model providers, Supabase, GitHub, Cloudflare, Resend, banks, card issuers, browsers, operating systems, or websites you access on your own. Data processing by third-party services is governed by their own policies.

2. Data Controller

The data controller for this service is:

• Operator: Wu Yujie
• Business status: individual developer / sole operator
• Business address or mailing address: Hongyi Huacheng Phase 2, Huicheng District, Huizhou City, China
• Privacy contact email: [email protected]
• Customer support email: [email protected]
• Payment, billing, and refund email: [email protected]
• Security contact email: [email protected]
• Data Protection Officer: not currently appointed. Privacy requests are handled by [email protected] unless applicable law requires a separate appointment.
• Service hours: Monday to Friday, 09:00-21:00 (China Time, UTC+8), excluding statutory holidays.

3. Information We Collect

We process information only to the extent necessary to provide, protect, bill for, improve Glifaro, and comply with legal obligations. Depending on the features you use, we may process the following categories of information.

3.1 Account and Identity Information

• Email address.
• User ID, account status, creation time, update time, and last login time.
• Password hash. We do not store your password in plaintext.
• Registration, login, password reset, and verification-code status.
• Name, contact information, screenshots, logs, issue descriptions, and other content you provide in customer support, refund, security, or feedback communications.

3.2 Verification, Session, and Security Information

• Email verification-code hash, verification-code purpose, attempt count, expiration time, and consumption time.
• Web refresh token hash, desktop refresh token hash, access-token metadata, session creation time, expiration time, last-use time, and revocation time.
• IP address hash or network information necessary in security logs.
• User-Agent, browser type, operating system, request time, error information, rate-limit records, and security audit records.
• Verification results and necessary metadata returned by Cloudflare Turnstile or other security verification.

3.3 Payment, Order, and License Information

Glifaro uses Waffo Pancake to process payments. We may store or receive:

• Purchased plan code, such as free or lifetime.
• License status, such as active, expired, revoked, refunded, or chargeback.
• Trial start time, trial end time, purchase time, license start time, and license expiration time.
• Waffo product ID, checkout session ID, order ID, payment ID, external order ID, payment environment, currency, amount, payment status, checkout URL, and expiration time.
• Waffo webhook event ID, delivery ID, event type, store ID, original event payload, and processing time.
• Refund, chargeback, duplicate charge, billing error, and dispute handling records.

We do not store complete bank card numbers, card security codes, or complete payment credentials on our own servers. Such sensitive payment card data is processed by Waffo Pancake or its payment infrastructure.

3.4 Device, Machine, and Desktop License Information

To prevent trial abuse, enforce device limits, and protect Lifetime licenses, we may process:

• HMAC hash of machine fingerprint and fingerprint version. The server does not store raw hardware identifiers.
• Platform information, such as Windows, macOS, or Linux.
• Device name, application version, device public key, and device key ID.
• Machine first-seen time, last-seen time, and status.
• User-machine binding status, binding time, last-use time, revocation time, and revocation reason.
• Desktop login session status, user-code hash, expiration time, completion time, and rejection reason.
• License audit events, such as binding, unbinding, license activation, refund, chargeback, login rejection, and security events.

The desktop client generates an installation ID and device key locally and preferentially stores them in the operating system's secure credential storage. If the system secure credential storage is unavailable, the application may use local files as fallback storage.

3.5 Desktop Local Data

Glifaro is a local-first application. The following data is usually stored on your device and is not automatically uploaded to Glifaro servers:

• Local Markdown files, folders, assets, images, media, exported files, and workspace directories.
• Documents, assets, and workspace structures in in-app database workspaces.
• Theme, appearance, language, shortcut, auto-save, font, export, and workspace settings in the local SQLite settings database.
• User-configured AI base URL, AI API key, model name, and context window.
• Imported font file names, paths, and local metadata.
• Document provenance snapshots, Markdown hashes, workspace paths, and local AI provenance data.
• Agent local sessions, prompts, replies, tool-call records, and context metadata.
• Local credentials such as GitHub token, Supabase PAT, Supabase database password, Supabase secret key, desktop refresh token, and device key, usually stored in operating system secure credential storage.

Merely installing, opening, or using Glifaro locally usually does not cause the local content above to be automatically uploaded to our servers. We process related content under this Policy only when you actively log in to online features, enable platform cloud storage, enable remote sync, enable platform-provided AI services, send materials to customer support, submit error reports, or otherwise actively upload or sync content.

If you actively send logs, screenshots, documents, exported files, or error reports to customer support, we will process the relevant data according to what you send.

3.6 AI Agent-Related Information

By default, Glifaro does not provide AI generation services for which we assume responsibility for model results or model availability. By default, AI Agent is usually used after you configure an OpenAI-compatible API, OpenRouter-compatible service, API key, base URL, environment variable, or other third-party AI service. When you use Glifaro Agent, the desktop application may process and send the following information to the AI service you configure, platform-provided AI service, or relevant tool target:

• Prompts you enter, current selected text, attachment summaries, current file path, and workspace context.
• Relevant document content, file fragments, search results, tool-call input, and tool-call output.
• AI model name, base URL, request parameters, and error information.
• Search queries, URLs, page content summaries, and fetch results when you enable web search or web fetching.

If you configure a third-party AI service yourself, AI requests are usually sent directly from the desktop application to the AI service you choose. Third-party AI services may record, retain, train on, review, or process request data according to their own policies. You should avoid providing AI with personal information, trade secrets, regulated data, or sensitive information that you have no right to process.

If you actively enable platform-provided AI services, you agree that we may process, transmit, and store related AI conversation data to provide that feature, including prompts, context, document fragments, model replies, tool-call records, session metadata, error logs, and necessary security audit records. We will apply reasonable encryption, access control, and leak-prevention measures to AI conversation data stored by the platform, and process it only for providing services, troubleshooting, security, compliance, billing, abuse prevention, and purposes you expressly consent to. Unless you expressly consent or applicable law allows it, we will not use platform-stored AI conversation data to train AI models.

3.7 Optional Cloud Storage, Remote Sync, and Supabase Information

Platform-provided cloud storage, cloud backup, or remote sync features are optional by default. We store related content only when you actively enable, configure, log in to, upload, sync, import into a cloud workspace, select cloud backup, or otherwise explicitly use these features. Related data may include:

• Cloud workspaces, documents, directory structures, Markdown content, titles, summaries, and body text.
• Document assets, images, media, binary attachments, MIME types, and file sizes.
• Document versions, history, conflict records, deletion status, sync status, restore records, and last-sync time.
• Workspace members, permissions, sharing settings, index data, metadata required for search, and necessary logs.

By enabling platform-provided cloud storage, you instruct and agree that we may store, process, transmit, index, back up, restore, troubleshoot, and protect related user content and necessary metadata to provide that feature.

If you configure remote sync, the Glifaro desktop application may use the Supabase personal access token, organization slug, database password, project region, and API key you provide to interact with the Supabase Management API and your Supabase project.

Synced content may include:

• Workspaces, documents, directory structures, and Markdown content.
• Document assets, images, media, binary attachments, and MIME types.
• Document provenance, Markdown hashes, and sync status.
• Deletion status, conflict status, error status, and last-sync time.

Data generated through Supabase remote sync that you configure yourself is usually stored in the Supabase project you control or configure. You are responsible for confirming that you have the relevant Supabase project and content processing permissions. How Supabase stores, backs up, deletes, audits, or transfers the relevant data across borders is governed by Supabase's terms, privacy policy, and project configuration.

3.8 Optional GitHub Version Management Information

If you connect GitHub, we may process locally or through the GitHub API:

• GitHub user ID, login, display name, avatar URL, profile URL, authorization time, and authorization scopes.
• GitHub access token. This token is usually stored in local operating system secure credential storage.
• Version-management repository, remote URL, HTML URL, owner, repo name, and local shadow repository path.
• Workspace file changes, relative paths, hashes, commit information, and sync status.

GitHub authentication and API data processing are governed by GitHub's policies.

3.9 Website, Local Storage, Cookies, and Logs

The Glifaro website may use browser localStorage to save web login sessions, such as glifaro.web.auth. This data may include account summary, access token, refresh token, license status, and device summary. You may delete this local data by logging out, clearing browser data, or using browser privacy functions.

The website and APIs may also process:

• Request URL, timestamp, IP address or IP hash, User-Agent, error logs, response status, and security events.
• Turnstile token and verification result required for registration security verification.
• Metadata for font, script, CDN, or static resource requests required for page loading.

The current product does not clearly implement independent ad tracking or marketing cookies. If analytics, advertising, remarketing, or cross-site tracking is enabled in the future, we will update this Policy and provide consent management where required by applicable law.

4. How We Use Information

We may aggregate, anonymize, or de-identify data for product analytics, security monitoring, financial statistics, and service improvement. Such data will not reasonably identify a specific individual.

5. Payment Information and Waffo Pancake

Glifaro uses Waffo Pancake as its payment processor. When paying, you will be directed to Waffo Pancake checkout or its payment flow. Waffo Pancake may collect and process payment card information, billing information, risk information, transaction information, tax information, payment verification information, and other data required to complete the transaction.

We receive from Waffo Pancake or store data required to complete licensing, refunds, dispute handling, and audits, such as order ID, payment ID, checkout session ID, amount, currency, payment status, refund status, webhook events, and related metadata. We do not store complete card numbers or card security codes on our own servers.

6. Cookies, Local Storage, and Similar Technologies

We may use the following technologies:

You may clear cookies and localStorage through browser settings. After clearing them, you may need to log in again, and some preferences may be reset.

7. Information Sharing and Disclosure

We do not sell your personal information, and we do not sell or share personal information for cross-context behavioral advertising purposes. We share information only in the following circumstances:

• Service providers: hosting, database, email delivery, security verification, logging, monitoring, customer support, payment, tax, accounting, and infrastructure providers, processing only to the extent necessary to provide services.
• Waffo Pancake: for payment, orders, refunds, tax, risk control, chargebacks, and payment notifications.
• Third-party AI services: when you configure or use a third-party AI service yourself, related prompts, context, and request data may be sent directly to the AI service you choose. When you enable platform-provided AI services and those services depend on third-party models or infrastructure, we may transmit related request data to the relevant service provider to the extent necessary to provide the service.
• Cloud storage and infrastructure service providers: when you enable platform cloud storage, cloud backup, platform AI services, or other online content features, related user content, AI conversation data, indexes, backups, and logs may be processed by our hosting, database, object storage, search, logging, or security service providers to the extent necessary to provide the service.
• Supabase: when you enable remote sync or create a Supabase project, related credentials, project configuration, and synced content are sent to Supabase.
• GitHub: when you connect GitHub or use version management or update downloads, related OAuth, account, repository, or Release information interacts with GitHub.
• Cloudflare Turnstile: for registration and security verification.
• Resend or email services: for verification codes, password resets, billing, security, and service notices.
• Legal and regulatory: disclosure where required by law, court order, regulatory request, payment network rules, tax, accounting, sanctions, law enforcement, or rights protection.
• Business transactions: in a merger, acquisition, financing, asset sale, restructuring, or similar transaction, we may transfer relevant data, but will require the recipient to continue complying with reasonable protection obligations.
• With your consent: sharing when you expressly consent or actively instruct us to do so.

We require service providers to process data only according to our instructions or lawful authorization, and to take reasonable security measures.

8. Data Security Measures

We use reasonable technical and organizational measures to protect data, including:

• Production environments should use HTTPS/TLS encryption in transit.
• Passwords are stored using Argon2id hashing.
• Verification codes, refresh tokens, desktop refresh tokens, and machine fingerprints are stored using hashes or HMAC.
• Waffo webhooks are verified by signature before processing.
• Access tokens have expiration times, and refresh tokens can be revoked.
• Registration, login, verification-code, and payment checkout endpoints use rate limiting.
• Servers do not store raw machine hardware identifiers.
• Sensitive desktop credentials are preferentially stored in operating system secure credential storage.
• Sensitive payment card data is processed by Waffo Pancake or its payment infrastructure.
• Important license, device, and billing operations are recorded as audit events.
• Platform-stored cloud content and platform AI conversation data receive reasonable access controls, permission isolation, encryption in transit, backup protection, and appropriate encryption at rest.

No system can guarantee absolute security. Please use strong passwords and protect your email, devices, API keys, GitHub account, Supabase account, and system permissions. If you believe your account or data is at risk, contact [email protected].

If a data security incident may affect your rights, we will notify you and relevant regulators according to law after discovery. If applicable law requires a specific timeline, we will follow that timeline. In GDPR-applicable scenarios, we will generally notify the supervisory authority within 72 hours after confirming that notification is required.

9. Data Retention Periods

We retain data only for as long as necessary to achieve the purposes of this Policy, perform contracts, comply with laws, resolve disputes, enforce terms, prevent fraud, and maintain security.

Legal, tax, accounting, payment, chargeback, fraud, security, backup, and disaster-recovery requirements may cause some data to be retained beyond the periods above.

10. Your Rights

Depending on the applicable law in your location, you may have the following rights:

Please exercise your rights through [email protected]. To protect account security, we may need to verify your identity. We usually respond within 30 calendar days, and may extend where requests are complex or law allows.

Some data may not be deleted immediately, such as payment, tax, accounting, chargeback, fraud, security, and legal records that we must retain. Account deletion also does not automatically delete local files on your device, data you synced to Supabase yourself, content you pushed to GitHub, data already processed by third-party AI services according to their policies, or data already within reasonable backup, audit, dispute-handling, and security retention cycles.

11. Your Choices

You may:

• Log out of your account, or clear browser localStorage.
• Revoke device bindings in the account dashboard.
• Delete local workspaces, settings, Agent sessions, and local files in the desktop application.
• Choose not to enable platform cloud storage, platform AI services, Supabase remote sync, GitHub version management, or AI Agent.
• Delete or replace locally stored AI API keys, Supabase credentials, and GitHub authorization.
• Manage respective data through features provided by GitHub, Supabase, Waffo Pancake, AI providers, or browsers.
• Unsubscribe from marketing emails through the unsubscribe link in emails or by contacting [email protected].

Please note that service notices, billing notices, security notices, password resets, verification codes, terms-change notices, and license-status notices are necessary service communications, and you may continue to receive them even if you unsubscribe from marketing communications.

12. Children's Privacy

Glifaro is intended for users who are at least 18 years old. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, contact [email protected], and we will delete the relevant information after reasonable verification unless law requires retention.

13. Cross-Border Data Transfers

Glifaro, our service providers, Waffo Pancake, GitHub, Supabase, AI providers, email services, security services, and infrastructure providers may be located outside your country or region, including in the United States, Singapore, the European Union, or other regions. Your information may be accessed, processed, stored, or transferred in these regions.

Where applicable law requires, we will use reasonable safeguards, such as data processing agreements, standard contractual clauses, access controls, encryption, data minimization, vendor review, and other appropriate mechanisms.

Third-party services you configure yourself, such as Supabase project region, GitHub account region, and AI model provider region, may affect the actual storage and transfer location of data.

14. Third-Party Links and Third-Party Content

Glifaro may contain links to third-party websites, documentation, models, APIs, open-source projects, update resources, payment pages, GitHub, Supabase, or other services. We do not control these third parties' data practices, content, availability, or security. Please review their terms and privacy policies before use.

If you ask Glifaro Agent to fetch web pages, read URLs, call third-party APIs, or process external content, the relevant websites or services may record the request source, time, IP, User-Agent, and accessed content.

15. Supplemental Notice for California, Europe, and Other Regions

If CCPA/CPRA, GDPR, UK GDPR, PIPL, or other privacy laws apply to you, we will provide corresponding rights and protections according to applicable law.

We do not sell personal information. We currently do not clearly use personal information for cross-context behavioral advertising. If this changes in the future, we will update this Policy and provide choices required by applicable law.

Our legal bases for processing personal information may include performance of contract, compliance with legal obligations, protection of legitimate interests, consent, and protection of vital interests. You may ask about the legal basis applicable to your specific data processing activity through [email protected].

16. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified through website announcements, in-app prompts, registered email, or other reasonable methods, and the "Last Updated" date at the top will be updated. Unless law requires otherwise, material changes will usually be notified at least 14 days in advance.

Continuing to use Glifaro after changes become effective means that you acknowledge the updated Privacy Policy. If you do not agree to the update, you may stop using Glifaro and request account or data deletion according to this Policy.

17. Contact Us

If you have any questions about privacy, data, security, or this Policy, please contact:

• Application usage, login, device, and feature issues: [email protected]
• Payment, billing, refund, chargeback, and other money-related issues: [email protected]
• Privacy, data requests, account deletion, legal, security, and other issues: [email protected]
• Operator: Wu Yujie
• Mailing address: Hongyi Huacheng Phase 2, Huicheng District, Huizhou City, China
• Phone: phone support is not currently provided. Please contact us through the email addresses above.
• Service hours: Monday to Friday, 09:00-21:00 (China Time, UTC+8), excluding statutory holidays.

Wu Yujie - Glifaro - https://glifaro.com - Last Updated: 2026-07-04