Privacy Policy

Effective: March 3, 2026

1. Who We Are

Glowy is developed and operated by Bruce Rosier, an independent developer based in France. We are committed to protecting your privacy and handling your personal data responsibly in compliance with the General Data Protection Regulation (GDPR) and applicable French data protection laws.

2. Data We Collect

We collect the following categories of personal data:

  • Profile information: first name, age range, gender identity
  • Wellness data: mental health indicators, personal goals, daily habits, improvement areas, emotional state
  • App preferences: selected theme, notification settings, affirmation categories
  • Usage data: app opens, feature interactions, onboarding progress, streak activity
  • Subscription status: premium entitlement (managed by RevenueCat)
  • Device identifiers: anonymous analytics ID (PostHog distinct ID)

3. How We Use Your Data

We use your personal data to:

  • Personalize your affirmation experience based on your goals and preferences
  • Deliver daily notifications with relevant affirmations
  • Track your streak and app engagement
  • Process and manage your subscription
  • Analyze aggregated usage patterns to improve the App
  • Provide customer support

We never sell your personal data to third parties.

4. Legal Basis for Processing (GDPR Art. 6)

We process your data based on the following legal grounds:

  • Consent (Art. 6(1)(a)): for collecting wellness and mental health data during onboarding
  • Contract performance (Art. 6(1)(b)): to deliver the services you requested, including personalized affirmations and subscription management
  • Legitimate interests (Art. 6(1)(f)): for analytics and app improvement, balanced against your privacy rights

5. Third-Party Services

We use the following third-party services to operate the App:

  • PostHog (EU cloud — eu.i.posthog.com): analytics and event tracking. Data is stored on EU servers. PostHog acts as a data processor under GDPR.
  • RevenueCat: subscription and in-app purchase management. RevenueCat processes subscription status and transaction data as a data processor.
  • Apple App Store: payment processing for subscriptions. Payments are handled entirely by Apple under their own privacy policy.

Each third-party service processes data under their own privacy policies and our data processing agreements.

6. Data Storage and Security

Your profile and preference data is stored locally on your device using SwiftData. Analytics data is transmitted to PostHog's EU servers over encrypted connections (TLS). We implement appropriate technical and organizational measures to protect your data against unauthorized access, alteration, or destruction.

7. Data Retention

Local data remains on your device until you delete the App. Analytics data is retained for a maximum of 24 months and then automatically deleted. Subscription data is retained by RevenueCat for the duration of your subscription plus any legally required retention period. You may request deletion of your data at any time.

8. Your Rights Under GDPR

As a user in the European Union, you have the following rights:

  • Right of access: request a copy of the personal data we hold about you
  • Right to rectification: request correction of inaccurate data
  • Right to erasure: request deletion of your personal data
  • Right to restriction: request limitation of data processing
  • Right to data portability: receive your data in a structured, machine-readable format
  • Right to object: object to data processing based on legitimate interests
  • Right to withdraw consent: withdraw consent at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at contact@webprostudio.io. We will respond within 30 days. You also have the right to lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés), the French data protection authority.

9. International Data Transfers

We prioritize keeping your data within the EU. Analytics data is processed by PostHog on EU servers. RevenueCat may process some subscription data in the United States under Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring an adequate level of data protection.

10. Children's Privacy

Glowy is not intended for children under 16 years of age. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has provided us with personal data, please contact us at contact@webprostudio.io and we will promptly delete such data.

11. Cookies and Tracking (Website)

The Glowy website (glowy.app) may use essential cookies for functionality. We do not use third-party advertising cookies. Analytics on the website, if any, follow the same privacy principles described in this policy.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy within the App and updating the effective date. We encourage you to review this policy periodically.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact us at:

Bruce Rosier
Email: contact@webprostudio.io

For complaints, you may also contact the CNIL: www.cnil.fr