Privacy Policy

Data Collection

We do not collect:

• Your project names, paths, or configurations (devglow)
• Your process logs or output
• Any content from other applications on your device

We collect or process only:

• License key and device identifier (for license activation)
• Device identifier and trial dates (for trial registration)
• Email address (only if you opt in to cloud sync by signing in to todoglow or noglow)
• Your synced content (only if you opt in to cloud sync; todoglow todos and time logs, or noglow notes; see "Cloud Sync" below)
• Device name you set yourself for sync (e.g. "Work MacBook")
• A push notification token (noglow on iOS and Android, only when cloud sync is on; see "Cloud Sync")
• Minimal anonymous usage analytics (see "Analytics")
• IP address, temporarily, for rate limiting sign-in and sync requests

If you never sign in to cloud sync, your notes, todos, and time logs stay on your device and we never see them.

Cloud Sync (todoglow and noglow, optional)

Both todoglow and noglow offer optional cloud sync to keep your content in step across your devices. In todoglow (from v1.9) this syncs your todos between Macs; in noglow it syncs your notes across macOS, iOS, and Android. Sync is opt-in, and both apps work fully without an account.

When you sign in:

• You sign in with a one-time code sent to your email address. There are no passwords, and no third-party sign-in providers. Email delivery is handled by Resend.
• Your email address is stored on our server and tied to your account.
• We issue a session token (JWT) so your device can talk to the sync backend without signing in again each time.
• Each device you sign in on is recorded with a name you can edit and a per-device sync cursor.
• On iOS and Android, we register a push notification token with Apple (APNs) or Google (FCM) so your other devices can be notified when your notes change and pull the update. The push carries no note content.

What gets synced:

• todoglow: your todos (title, completion state, archive/delete state, and related metadata) and your time logs (start/end timestamps tied to todos)
• noglow: your note slots and archived notes, plus related metadata
• The local copy on each device stays the source of truth. Sync is the transport, not the system of record.

Sync data is stored in Cloudflare D1 (a managed SQLite database) hosted in the East North America region. You can sign a specific device out at any time from that app's settings, or remotely from any other signed-in device. Signing out leaves the local data on the signed-out device untouched.

To delete your account and everything synced under it, use delete account in the app's settings while signed in (noglow: settings → sync). You can also contact us at privacy@devglow.app from the email address tied to your account. See Data Retention below for what deletion covers.

AI Polish Feature (todoglow)

todoglow includes an optional AI Polish feature that can use Google's Gemini API or OpenAI's API to help polish your text. This feature requires you to provide your own API key for your chosen provider.

• Text you choose to polish is sent directly to your chosen AI provider (Google Gemini or OpenAI)
• Your API key is stored locally on your device and is never sent to us
• We do not have access to your polished text or API usage
• This feature is entirely optional and disabled by default

Please review Google's Gemini API Terms and OpenAI's Terms of Use for their respective data handling practices.

AI Search (noglow)

noglow includes an optional AI-assisted search. AI is used only at the moment you run a search; there is no background indexing of your notes.

• When you choose to search with AI, the notes relevant to your query are sent to an AI provider to return results, then discarded.
• Your notes are not used to train any model and are not retained by us for search.
• This feature is optional; plain text search works without sending anything to an AI provider.

Free Trial (devglow and todoglow)

The paid Apps (devglow and todoglow) offer a free trial period. noglow is free and has no trial. When the trial begins, a device identifier (hardware UUID) and trial start/expiry dates are stored on our server to prevent abuse. No personal information, name, or email is stored alongside this data. Your IP address is processed transiently for rate limiting but is not stored against your trial record.

Trial eligibility records are retained to prevent abuse.

License Verification (devglow and todoglow)

noglow is free and requires no license. For the paid Apps, license verification communicates with our server to validate your purchase. This includes only the license key and a device identifier necessary for activation. Payment is processed securely through Polar (powered by Stripe). We never see or store your payment card details.

Analytics

Our website (devglow.app) uses Google Analytics and Umami to understand how visitors find and use our site.

The Apps send minimal, anonymous usage data to help us improve them. This applies to noglow on all its platforms (macOS, iOS, and Android) and to the desktop apps:

• App version and platform
• Selected theme (todoglow only)
• Device identifier
• Sync-related events, such as a sync failure or a sync conflict (noglow, only when cloud sync is on)

No personal data, project names, commands, paths, note text, or todo content is included. These events are sent irregularly (not on every launch) and are used solely for understanding which versions and features are in active use.

Data Storage

Your configurations, preferences, and data are stored locally on your device in each application's data folder.

If you opt in to cloud sync (todoglow or noglow), your synced content (todoglow todos and time logs, or noglow notes) is additionally stored on our backend (Cloudflare D1, East North America region) so it can reach your other signed-in devices. We have technical access to this data for the purposes of running and supporting the sync service, but do not read your content for any other purpose.

Encryption

todoglow and noglow do not use end-to-end encryption. Synced content is transmitted over HTTPS, and is stored as plaintext in Cloudflare D1, which means we have technical access to it as described under Data Storage.

This follows from the sign-in design: these apps have no passwords, and a password is what an end-to-end encrypted service would use to derive a key that only you hold. We chose sign-in without passwords instead.

If you never turn on sync, your content stays on your device and never reaches us.

Third-Party Services

We use the following third-party services:

• Polar - Payment processing and license management for the paid Apps (powered by Stripe)
• Cloudflare - Hosts our sync backend (Workers) and database (D1). Applies only when you opt in to cloud sync (todoglow or noglow).
• Resend - Delivers sign-in code emails for cloud sync. Applies only when you opt in.
• Google Analytics - Website analytics
• Umami - Website analytics (privacy-friendly)
• Google Gemini API - Optional AI text polishing (todoglow, user-provided API key)
• OpenAI API - Optional AI text polishing (todoglow, user-provided API key)

Data Retention

Trial and license activation data (device identifier and dates) is retained for the duration of use to ensure proper functionality and prevent abuse.

Cloud sync data (account, devices, todos, time logs, notes) is retained for as long as your account is active. You can sign individual devices out at any time.

To delete your account, open the app's settings while signed in and choose delete account (noglow: settings → sync). This erases the account and everything stored under it — your email address, devices, notes and archive, and sync events — immediately and permanently. Notes stored locally on your own devices are not touched, and you can clear those from the same settings screen. You can also request deletion by contacting us from the email address tied to your account.

Sign-in codes are short-lived and are deleted automatically after they expire or are used. Rate-limit records (which may include hashed IP addresses) are kept only for the length of the rate-limit window and are then cleared.

Anonymous analytics events are not tied to identifiable individuals and are retained indefinitely in aggregate form.

Your Rights

Depending on your location (including the EU/EEA under GDPR, the UK under UK GDPR, California under CCPA/CPRA, and other jurisdictions), you may have the right to:

• Request access to the data we hold about you (account, devices, synced todos and time logs)
• Request correction or deletion of that data
• Request a portable export of your synced data
• Withdraw consent and stop using cloud sync at any time (sign out and your local data stays on your device)
• Object to processing of your data

To exercise any of these rights, contact us at privacy@devglow.app from the email address tied to your account, and we'll be happy to assist.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of any material changes by updating the date at the top of this page.

Contact

For privacy-related questions, contact us at privacy@devglow.app