Privacy Policy

Glowy is owned and operated by One Man Holdings LLC (“we”, “us”). We are the controller of the personal data described here. For anything in this policy — including a request to see or delete your data — write to glowypicsai@gmail.com.

Account information

Your email address, and a password that is stored only as a cryptographic hash by our authentication provider — we never see or store the password itself. If you sign in with Google instead, we receive your name, email address and Google account identifier.

Photographs

• Selfies. The 3–15 photographs of your face that every generated photo is built from.
• Reference images. The pictures you upload to show the style, pose or setting you want.
• Generated photos. The results the service produces for you.

Photographs of a face are biometric-adjacent personal data in several jurisdictions, and we treat all three categories as sensitive regardless of what any particular law calls them.

Billing

Your purchase history, any subscription status and billing dates, and a record of every credit added to or spent from your balance. Payments are handled by Stripe on their own pages: card numbers never reach our servers and we never store them. We hold only the customer identifier the processor gives us.

Usage

A log of events — account created, photo requested, photo completed or failed, a payment settled — with timestamps and the cost each generation incurred. We use this to run the service, to find faults, and to understand whether the business works. It is not sold, and it is not used to build a profile of you for advertising.

Reports

If you report one of your own generated photos, we keep the report, the reason you chose, and any note you add.

Site analytics

Separately from the log above, which is about your account, we measure visits to the public pages using Google Analytics — including visits from people who never create an account. That means the pages viewed, roughly where the visit came from, and general device information. It is not linked to your account and it does not run in the admin area. Clause 10 explains the cookies it sets and how to switch it off.

When you ask for a photo, your reference image is used to work out the look you want, and up to 2 of your selfies are sent to our image provider, which produces the finished photograph. In the mode currently running, the reference image is sent to the image provider along with your selfies, and is not sent to Anthropic. Both steps are set out in the table below.

We do not use your photographs to train any model of our own, and we do not sell or rent them to anybody.

We use the following companies to run the service. Each one only receives what it needs for the step it performs, and each has its own privacy terms which govern what it does with that data.

Your account record and every photograph are stored in the ap-south-1 region (Mumbai, India). Our other providers process data in the regions their own terms describe, which may include the United States and the European Union. If you are in a jurisdiction that restricts international transfers, using Glowy involves your data crossing borders, and you should not use the service if that is not acceptable to you.

We keep your photographs for as long as your account exists, because the whole point of a selfie set is that it is uploaded once and reused. You are in control of removing them:

• Selfie sets and reference images can be deleted at any time from the Uploads page in your account. Deletion removes the files immediately and permanently; there is no undo and no recycle bin.
• Generated photos and your whole account cannot yet be deleted from inside the app. Email glowypicsai@gmail.com and we will delete them. We are building the self-serve version of this.

When you delete a set or ask us to delete your account, we remove the files. We keep a minimal billing and transaction record where we are required to for tax and accounting purposes, and we keep the record that a moderation decision was made — but not the content it was made about.

Links to your photographs are private and expire after 60 minutes. Nothing you upload is ever publicly readable.

Depending on where you live, you may have the right to access the data we hold about you, to correct it, to delete it, to receive a copy in a portable form, to object to or restrict how we use it, and to withdraw consent. You also have the right to complain to your local data protection authority.

To exercise any of these, email glowypicsai@gmail.com. We will respond within 30 days. We may ask you to confirm you control the account before acting on a request — the alternative is handing someone else’s photographs to whoever asks for them.

Photographs are stored in a private bucket that is not publicly readable. Access is enforced at the database level per account, so one user’s session cannot read another user’s files. Traffic is encrypted in transit. Links to your images are signed and short-lived rather than permanent.

No system is perfectly secure, and we will not claim otherwise. If we become aware of a breach affecting your personal data, we will notify you and the relevant authority where the law requires it.

Glowy is for adults. You must be 18 or older to use it. We do not knowingly collect data from anyone under 18, and we do not permit photographs of minors to be uploaded for any reason. If you believe a child has used the service or that a child’s photograph has been uploaded, email glowypicsai@gmail.com and we will delete the account and its contents.

We use cookies to keep you signed in and to keep the sign-in process secure. We do not use advertising cookies, and we do not sell or share what we collect for advertising.

We also measure how the site is used, so we know which parts are worth keeping. We use DataFast, which records the pages you visit and sets four cookies of its own to tell one browser from another: datafast_visitor_id, datafast_visitor_first_seen_at and datafast_visitor_session_count, which last a year, and datafast_session_id, which lasts thirty minutes. If you buy credits, the first and last of those are sent to Stripe with your checkout, so the sale can be matched to the visit that led to it — that is the only thing they are used for, and no other data about you travels with them. We use Google Tag Manager, which loads the measurement tags this site runs — Google Analytics among them. Those tags set cookies of their own too. None of these identify you by name, and none carries a photograph, your email address or your account identifier.

None of it runs in the admin area. The addresses recorded by the Google tags have their query strings removed apart from campaign tags, so a payment reference or a one-time link is never sent to Google. DataFast reads the address itself rather than being handed one, so that filter cannot be applied to it.

If you would rather not be counted, browsers can block these cookies. DataFast can be switched off for this site by setting datafast_ignore to true in your browser’s local storage for Glowy. Google publishes a Google Analytics opt-out add-on that switches it off across every site that uses it. Nothing about the product stops working if you do. For the current list of measurement tags in use, email glowypicsai@gmail.com.

If we change this policy in a way that materially affects how your data is handled, we will update the effective date at the top and notify account holders by email before the change takes effect.

One Man Holdings LLC, operator of Glowy — glowypicsai@gmail.com. See also our Terms & Conditions and Refunds & Cancellation policy.