Privacy Policy

Effective Date: June 1, 2026
Last Updated: May 30, 2026

Welcome to Gliocas (referred to as "Gliocas," "we," "us," or "our"). We provide an online and mobile Integrated Writing Environment (IWE) that assists authors with text editing, world-building organization via our Story Codex, and generative AI features.

This Privacy Policy describes how we collect, use, process, share, and protect your personal data when you use the Gliocas platform, available via our website and mobile application (collectively, the " Service"). It also explains your privacy rights and how you can exercise them under the European Union General Data Protection Regulation (GDPR), the United Kingdom General Data Protection Regulation and Data Protection Act 2018 (as amended by the Data [Use and Access] Act 2025) ( UK GDPR), and United States federal and state privacy frameworks (including the California Consumer Privacy Act/California Privacy Rights Act (CCPA/CPRA) and other applicable state statutes).

1. Important Information and Who We Are

1.1 Data Controller

For the purposes of the GDPR and UK GDPR, Gliocas is the Data Controller of your personal data. This means we determine the purposes and means of processing the personal information collected through the Service.

1.2 Data Protection Officer & Contact Information

If you have any questions about this Privacy Policy, your rights, or how your data is handled, please contact our support team or Data Protection lead via Contact Support and Feedback .

1.3 Eligibility and Children's Privacy

The Service is intended for adults and individuals at least 13 years of age (or older, depending on regional legal requirements for contract execution). We do not knowingly collect personal data from children under 13 in the US or under 16 in the EEA/UK without parental consent. If we learn we have collected personal data from a child below these thresholds, we will delete it immediately.

2. What We Collect

We collect information that you directly provide to us, data generated by your use of the Service, and automated data collected during your session.

2.1 Information You Provide to Us

• Account and Authentication Data: Your email address, name, password, and profile metadata (such as pen names or real-name attributions configured in account settings).
• User-Generated Content (Your Manuscripts): The entire text, titles, outlines, chapter structures, text selections, and data blocks you write within the app, including books, chapters, and entries in your Story Codex (characters, locations, lore, items).
• AI Interaction Data: The text prompts, queries, and contextual excerpts you submit when using the Glio AI Assistant, the text completion and revision features, the Codex entry generator, or the Write-Together prompt workflows.
• Community and Collaboration Content: If you participate in our "Write-Together" community spaces, we collect your voting logs, submitted continuation proposals, author name (real or pen-name) for winning proposals, and collaborative session activity.
• Payment and Subscription Data: If you subscribe to a premium tier, transaction processing is handled via secure, third-party payment gateways (e.g., Stripe). We collect your subscription status and basic tier metadata, but do not directly store credit card numbers on our servers.

2.2 Information Automatically Collected

• Log and Usage Data: We collect information required to operate and maintain the stability and security of the Service. This includes IP addresses, browser types, device operating systems, unique device identifiers, time stamps, and features used.
• System Tokens and Consumption Credits: To prevent abuse and manage API costs, we monitor your resource consumption.

3. How We Use Your Data and Our Lawful Basis

Under the GDPR and UK GDPR, we must have a valid legal framework—known as a Lawful Basis—to process your personal information. The table below details exactly how and why we utilize your data.

4. Artificial Intelligence (AI) Processing & Guarantees

Because Gliocas functions as an Integrated Writing Environment driven by cutting-edge language infrastructure, your data undergoes specialized AI processing. We enforce rigorous structural safeguards to protect your intellectual property.

4.1 How Data is Transmitted to Models

When you invoke an AI tool—such as selecting a paragraph for refinement, requesting a dialog generation, or asking the Glio Assistant to perform a global story search—relevant pieces of your manuscript are compiled into a temporary data packet. This packet may include:

1. Your explicit prompt.
2. The current selection or chapter paragraph context.
3. Relevant structural traits extracted from your Story Codex (e.g., characters present in the scene).

This bundle is sent via secure, encrypted APIs to our integrated AI providers (such as Anthropic, Google AI, or OpenAI).

4.2 Our Strict No-Training Guarantee

We recognize that your manuscript constitutes your exclusive intellectual property and creative livelihood.

• No Third-Party Machine Learning Training: We execute formal commercial API agreements with all downstream AI sub-processors. These legal boundaries state that none of your text inputs, outputs, prompts, or Story Codex details can be stored, retained, or utilized by third parties to train public machine learning or Large Language Models (LLMs).
• No Internal Training: Gliocas does not use your private stories to train underlying foundational models. Your texts are treated exclusively as dynamic inputs for real-time prompt completion.

4.3 Data Retention by AI Processors

Downstream AI providers process inputs entirely statelessly or hold them in highly locked, non-public logs for a maximum period of thirty (30) days solely for the purpose of compliance monitoring, abuse detection, and security auditing, after which they are automatically expunged.

5. Sharing and Disclosure of Information

We do not sell your personal data or your manuscripts to any third parties. Your work is kept private unless you explicitly instruct the application to share it.

We share information only under the following strict conditions:

• With Downstream Service Processors: We work with trusted vendors who support our technical ecosystem (e.g., Supabase for database hosting, Lovable for app deployment, Stripe for transactional billing, and designated API providers for AI execution). These entities process data under strict Data Processing Agreements (DPAs) and cannot use it for secondary purposes.
• In Collaborative Environments (User-Initiated): When you submit a proposal to a public or multi-contributor book in the "Write-Together" interface, your pen name, user profile card, and submitted story continuation will become visible to other participants on that project's public page (/write-together/:wtBookId).
• By Explicit Publication: If you voluntarily select the option to publish your finished manuscript to the public Gliocas Books Catalog, your book metadata, cover, and story pages will be exposed to the public marketplace.
• Legal and Regulatory Compliance: We may disclose details to external entities if reasonably necessary to comply with a binding court subpoena, active regulation, or national security protocol, or to protect the baseline legal rights and physical safety of our users or company.

6. International Data Transfers

Gliocas operates globally, and its backend database hosting nodes may be positioned primarily in the United States or Western Europe. If you access our Service from the European Economic Area (EEA) or the United Kingdom, your data will be transferred outside your home territory. To guarantee an equivalent baseline of protection, we implement appropriate safety mechanisms:

• Standard Contractual Clauses (SCCs): We incorporate the European Commission's approved Standard Contractual Clauses (and the UK Addendum, where applicable) into our legal agreements with infrastructure hosts and API sub-processors.
• Adequacy Frameworks: We rely on verified regional adequacy determinations where data processors utilize recognized international data bridges.

7. Data Retention & Autosave Architecture

• Autosave Framework: To prevent data loss, our client architecture automatically synchronizes and updates your workspace text changes to our secure databases at short, repetitive intervals (every 5 seconds or upon typing idle).
• Retention Account Limits: We retain your account files and creative manuscripts for as long as your profile remains active in our system, or as long as necessary to fulfill the operational paths outlined in Section 3.
• Deletion Deferral (Backups): When you manually delete a chapter, a Story Codex entity, or an entire book, it is immediately removed from your active dashboard UI. The data may remain inside encrypted database recovery logs or system backups for up to thirty (30) days before being completely purged from our structural archives.

8. Your Regional Privacy Rights

Depending on where you reside globally, you have legal rights regarding the collection and handling of your personal information.

8.1 EEA and UK Data Subjects (GDPR / UK GDPR)

You are entitled to the following capabilities:

• Right of Access (Article 15): Request a full statement of the personal data we hold about you and copies of your manuscripts.
• Right to Rectification (Article 16): Update or fix inaccurate user profiles or attribution pen names.
• Right to Erasure / Right to be Forgotten (Article 17): Request that we permanently delete your account and associated books.
• Right to Restriction of Processing (Article 18): Block the ongoing processing of your data while an accuracy or lawful dispute is pending.
• Right to Data Portability (Article 20): Export your manuscripts, metadata, and chapters in a standard, machine-readable digital layout (such as Markdown or JSON).
• Right to Object (Article 21): Oppose specific processing tasks executed under Legitimate Interest assumptions.
• Right to Lodge a Complaint: You have the right to contact a regional Supervisory Authority (such as the CNIL in France, the BfDI in Germany, or the Information Commissioner's Office [ICO] in the UK).

8.2 United States Consumer Rights (CCPA / CPRA / State Frameworks)

If you are a resident of California or a US state with active comprehensive privacy regulations, you have the following rights:

• Right to Know / Access: Learn what categories of personal metrics we have collected, their sources, and commercial applications over the past 12 months.
• Right to Deletion: Have your account information and writing history scrubbed from our system.
• Right to Opt-Out of Sale or Sharing: We do not trade or sell your manuscripts or data. We do not engage in behavioral advertising that shares your private data with ad networks.
• Right to Non-Discrimination: We will never penalize or alter your writing tool metrics, latency, or credit tiers for exercising your legal privacy options.

9. How to Exercise Your Choices and Control Your Data

We provide immediate, user-facing tools directly inside the Gliocas application so you can exercise control over your data without waiting for support response times:

• Exporting Data: Navigate to your writing environment or project settings screen at any time to run a full manuscript export. This compiles your text structure into standard files.
• Deleting Content: You can individually drop database records for chapters, books, or Codex assets directly inside the UI.
• Account Termination: To completely close your account, wipe out your credentials, and remove your manuscripts from our systems, visit your Account Settings dashboard and click "Delete Account."
• Manual Requests: If you wish to execute a manual privacy request or have trouble using our automated dashboard features, please Contact Support and Feedback with the subject line Privacy Rights Request. We will verify your identity before releasing or removing any data blocks.

10. Security Safeguards

We protect your manuscripts and data using multi-layered security measures:

• Encryption in Transit: All network communication between your browser or mobile app and our servers is secured using Transport Layer Security (TLS).
• Encryption at Rest: Our databases and storage buckets are encrypted using industry-standard AES-256 protocols.
• Access Control Gating: We enforce strict Row Level Security (RLS) policies within our database layer (Supabase), ensuring that no user can read or query your manuscripts unless you have explicitly added them to a project or made it public via community publication features.

11. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect shifts in our product design, downstream AI infrastructure, or emerging global regulations. When material changes are introduced, we will notify you by updating the "Effective Date" at the top of this policy and publishing a prominent banner notice on your /dashboard or sending an email notification. Continued use of the Service after such adjustments constitutes your acknowledgment of the modified terms.