Privacy Policy

Last updated: 6 October 2026

1. Who is responsible

GlideDay (glideday.com) is a personal project in closed beta, run by an individual established in Greece. There is no company behind it, and it is not sold.

That individual is the controller of the personal data described here. For anything in this policy, including a request to exercise the rights in section 9, write to [email protected]; every such message is read by the person who runs the service.

2. What this policy covers

It covers the GlideDay website and the GlideDay application: the account area, the scheduling and analytics application at /app, the JSON API, and the MCP endpoint that lets an AI assistant read your own data on your behalf.

It does not cover the platforms you connect GlideDay to — Google, Meta, TikTok, X and the rest. What they do with your data is governed by their own policies, and connecting one of them is you instructing us to talk to it on your behalf.

3. What we collect

a. Your account

• Your username and email address.
• A profile picture, if you add one: the picture you upload, or your Gravatar picture if you choose Use my Gravatar, kept as a small square image until you remove it or delete the account.
• Your password, stored only as a one-way hash — we cannot read it.
• Two-factor secrets and passkey public keys, if you enable them.
• Sessions and access tokens, with the time and the device or client they were issued to.
• A record of sign-ins, failed sign-ins and lockouts, with the IP address and browser they came from.
• An activity log of significant actions on the account — a sign-in, a password change, a connection made or removed.

Sign-in records and the activity log exist for security: they are how a break-in is noticed and how you can check whether one happened.

b. Your organisation

GlideDay is organised around organisations rather than individuals: an organisation owns the sites, the connected channels and the history, and one or more people belong to it. We store the organisation's name and who is a member of it. Anyone in your organisation can see everything that belongs to it.

c. What you enter

• The websites you register: their address, name and timezone.
• The social accounts you register: the platform and the handle.
• Content you schedule — text, links and any media you attach — together with when it is to be published and where.
• Press releases emailed to your site's press address: the email itself is kept for 15 days; its text, attachments, sender's name and address stay with the press release. When you choose to, or set it to happen by itself, we email that sender on your behalf once the article is published, from your site's name via GlideDay, with replies going to you — or, if you set it up, from your own address, signed with a key we make for your domain or sent through your own mail server, whose password we keep encrypted. We write to nobody who did not write to you.
• If you link a Discord account to ask GlideDay's AI from Discord: its Discord id and name, so its questions are answered as you. Your questions and the answers pass through Discord, and are shown only to you unless you share them; an answer with Google figures is not posted to Discord, only a link to it. Unlinking deletes the link.

d. Credentials for the platforms you connect

When you connect a platform, it gives us an access token and usually a refresh token, together with the identity of the account that granted them and the scopes you approved. These are stored encrypted and are used for one thing: making the calls you asked for. We ask for read scopes wherever reading is all a feature needs.

e. The numbers we collect for you

This is what GlideDay is for. On a schedule, we read statistics about your channels — audience size, reach, views, sessions, search queries and impressions, per-post performance — and store each reading as a row: the moment, the channel, the metric, the value, and how confident we are in it.

These are aggregate numbers about your own properties. We do not collect the profiles, messages or contact details of the people who follow or visit you, and we do not build profiles of them.

The one exception is comments left on your own posts, which we read so you can answer them in Community: the text, and the commenter's public name, handle and picture as the platform shows them.

f. X (Twitter) profiles

X has no usable free API, so for an X account you register we read the follower and following counts from the public profile page — the same page anybody can open. We store no other part of it. Every such reading is recorded as low confidence, because a public page can change shape without notice, and a reading that fails is stored as nothing at all rather than as a zero.

g. Technical records

Our servers keep ordinary web and error logs: the request, the time, the IP address, the browser, and any error raised. They exist to keep the service up and to investigate abuse.

h. The newsletter, if you ask for it

Your email address, the language you asked in, where you signed up (the home page, your account, or the GlideDay plugin on a WordPress site you connected), the sentence you agreed to, the IP address the request came from, and when you asked, confirmed and left. Nobody is subscribed without confirming from their own mailbox, and every newsletter carries a link to leave — as does Account → Privacy. A newsletter may record whether it was opened and which of its links was pressed, on our own servers, so we know what was worth sending; nothing about it goes to anyone else.

i. The AI features

Some organisations have an assistant in the composer, Ask AI and an editorial engine that drafts articles. When you use them:

• What you ask and what it answers are kept: Ask AI conversations, so you can continue them, and which of your organisation's data each answer read.
• What Ask AI remembers about you — short facts and preferences it notes from your conversations, such as "compare with last year". Every one is listed on the Ask AI screen, where you can delete it.
• A log of each request to the AI provider — the prompt, the reply, the number of tokens, the cost and how long it took — for troubleshooting and cost control.
• A monthly count of the tokens and cost your organisation used, which is what a usage limit is measured against.
• Scheduled reports you set up — what to ask and when. Each run asks it as you, keeps the answer with your conversations, and notifies you.

Your conversations and what Ask AI remembers are visible to you only, not to the rest of your organisation. To answer, the AI is sent your question, the conversation so far, your name, your organisation's name, its sites and channels, what it remembers about you, and whatever your organisation's own data it reads to answer — statistics, posts, comments people left on them, articles. It can read; it cannot publish, reply or change anything.

j. Notifications on your devices

If you turn on notifications on a device, your browser gives us an address at its push service (Google, Mozilla or Apple, depending on the browser) and a key. We keep them to send you notifications, and the push service carries each one, encrypted, to your device. Turning notifications off, or removing the device, deletes them.

k. Data from Google

When you connect a Google account, GlideDay reads only what the features you use need:

• Google Analytics — the properties you can access, and their reports (users, sessions, page views, traffic sources). Read only.
• Search Console — the sites you can access, and their search performance (queries, pages, clicks, impressions, position). Read only.
• YouTube — your channels, their videos and their statistics, from the YouTube Data and YouTube Analytics APIs; and the comments on your videos, which you can answer or hide from Community. A reply or a hidden comment happens only when you ask for it.
• The email address of the Google account, to show which account a connection belongs to.

GlideDay's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In practice:

• It is used only to provide the features you see — your dashboard, its history, your reports, Community, and Ask AI's answers about your own channels.
• It is not sold, not used for advertising, and not used to develop, improve or train AI models.
• It reaches an AI model only when you, or a report you scheduled, ask Ask AI a question that needs it, and only to answer that question — and never through DeepSeek (below).
• Nobody reads it except where you ask us to (support), where security requires it, or where the law does.

Disconnecting the Google account in GlideDay deletes its tokens and withdraws GlideDay's access at Google. You can also remove it from your Google account permissions.

4. What we do not do

• We do not sell or rent personal data, to anyone, for any purpose.
• We do not show advertising and we do not profile you for it. What Google Analytics measures is not used for advertising.
• There is no advertising pixel and no social widget on this site. The one third-party script is Google Tag Manager, which loads Google Analytics. Neither sets a cookie unless you allow analytics (section 6).
• We do not use your content to train AI models, and we do not ask the AI provider to. The MCP endpoint reads your own data for an assistant you point at it, and nothing leaves the account that way unless you send it.
• We do not use the AI to make decisions about you. It answers questions and writes drafts; a person decides what is published.

5. Why we are allowed to process it

• To perform our contract with you (Article 6(1)(b) GDPR): running your account, connecting the platforms you asked for, collecting the statistics, publishing what you scheduled, and answering what you ask the AI features.
• Our legitimate interests (Article 6(1)(f)): keeping the service secure and available, preventing and investigating abuse, and understanding faults. Security logging is the main example.
• Your explicit consent for sending data to an AI provider outside the EEA without an adequacy decision (Article 49(1)(a)) — see section 9.
• Your consent (Article 6(1)(a)): where a feature is genuinely optional — connecting a platform is your explicit instruction, and withdrawing it is one click on the connection. The newsletter is sent only on consent you confirmed, and leaving it is one click too.
• Your consent (Article 6(1)(a) GDPR and the ePrivacy rules on cookies) for analytics cookies. Asked by the cookie banner and withdrawn from Cookie settings in the footer.
• Legal obligation (Article 6(1)(c)): accounting and tax records, once there is anything to account for.

6. Cookies and local storage

The first time you visit, a banner asks which cookies you allow. Accept all and Reject all are equally easy, Customise lets you choose per category, and Cookie settings at the foot of every page opens the same choice again whenever you want to change it. Your choice is kept in your browser for 180 days, and asked for again when this section changes. If you are signed in, it is also recorded against your account, so that we can show what you agreed to.

Strictly necessary — always on, because the service does not work without them:

• A session cookie, so that the server knows you are signed in. It is deleted when you sign out.
• A "remember me" cookie, only if you tick that box, so a session survives closing the browser.
• The cookie that holds your cookie choice, so that you are not asked on every page.
• Your browser's local storage holds your access token for the application at /app and your choice of light or dark theme. Both stay in your browser; the theme never reaches us.

Analytics — cookies only if you allow them:

• Google Analytics, loaded through Google Tag Manager (both Google Ireland Limited), to count visits and which features are used — for example that an account connected a channel or scheduled a post. What is sent is the page, the kind of action, and details of your device and browser (model, operating system, screen). It also includes your location to the level of a city, which Google derives from your IP address and does not store. Never what you wrote in GlideDay. Google sets its own cookies (_ga, _ga_*), which last up to two years.
• We do not send Google an account identifier, so Analytics cannot join your visits across devices.

Preferences and marketing appear in the banner as well, but nothing on the site uses them today: turning them on or off changes nothing. They are there so that if that changes, you are asked before it happens, not after.

Tag Manager is loaded on every page, in Google's Consent Mode. Until you allow analytics it sets no cookies and does not recognise you from one visit to the next. Google still receives a cookieless signal for each page and action: the page, the time, your browser and an approximate location. From these it estimates totals, with no identifier that would tie two visits together. The cookieless signal rests on our legitimate interest in knowing how the service is used (Article 6(1)(f)). You can stop it altogether with a content blocker. If you withdraw a consent you gave, the page reloads so that the script stops; cookies Google already set stay until they expire or you clear them.

7. How long we keep it

• Statistics about your channels: indefinitely, on purpose. Platforms throw their own history away — Search Console keeps sixteen months, most social platforms far less — and keeping it after they have is the reason GlideDay exists. This data is not deleted on a timer. It is deleted when you delete the channel or the account.
• Account data: for as long as the account exists, and then deleted.
• Platform tokens: until you disconnect the platform or delete the account, at which point they are deleted and, where the platform supports it, revoked.
• Sign-in and security records: a limited period appropriate to their purpose — long enough to investigate an incident, not indefinitely.
• Newsletter: until you leave. The record that you agreed, and when you left, is kept so that we can show we asked — and is deleted with your account, or when you ask us to.
• Ask AI conversations, what it remembers about you, and your scheduled reports: until you delete them, or your account is deleted.
• The log of requests to the AI provider: 90 days.
• Google Analytics: 14 months from your last visit. A new visit restarts the period, and after it the data is deleted by Google. Reports made of totals, which identify nobody, are kept.
• The monthly AI usage count: for as long as the organisation exists, as a billing record.
• Device notification addresses: until you turn notifications off, remove the device, or the push service says the address is no longer valid.
• Server logs: a short rolling window.
• Records we must keep by law, such as invoices, for as long as the law says.

8. Who else sees it

We share personal data only with:

• Our hosting provider — Hetzner (Hetzner Online GmbH), in Germany. The application runs on dedicated servers managed exclusively by us. We do not share or transmit application data to Hetzner. Hetzner datacenter personnel have physical access to the hardware only if physical maintenance or hardware intervention is required, governed by Hetzner's Terms & Conditions.
• The platforms you connect, and only to make the calls you asked for.
• An email provider, to deliver the messages the service sends you.
• An AI provider, only when your organisation uses the AI features, to answer what is asked of them. In use today: DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd.), in the People's Republic of China, under its API terms. The administrator of this installation may instead use OpenAI (OpenAI Ireland Ltd (for the EEA), with OpenAI, L.L.C.), in the United States; if the provider in use changes, this page changes with it. Whatever the provider in use, an answer that needs data from Google is made by OpenAI, never by DeepSeek (section 3k).
• Google, for Google Analytics and Tag Manager. It gets cookieless measurement on every visit, and cookie-based measurement only if you allow analytics (section 6). Google acts as our processor under its data processing terms.
• Your browser's push service, if you turn on notifications on a device, to deliver them.
• Gravatar (Automattic Inc.), only if you press Use my Gravatar on your profile, and only then: we send it a one-way hash of your email address to fetch the picture you keep there, which we then store ourselves. Nothing is sent to it otherwise.
• Authorities, where we are legally required to, and no further than required.

Each of these acts on our instructions under a written agreement, except the platforms, which are independent controllers of what happens on their side.

9. Transfers outside the EEA

The service runs on servers in Germany, so hosting involves no transfer outside the European Economic Area.

The platforms you connect are mostly established in the United States, so when you connect one, the requests we make on your behalf and the data they return cross that border under their own transfer arrangements — standard contractual clauses and, where it applies, the EU–US Data Privacy Framework. Not connecting a platform is the way to avoid that transfer.

Gravatar is run by Automattic in the United States. The hash of your email address goes there only when you choose Use my Gravatar, under Automattic's own transfer arrangements; uploading a picture instead avoids it.

Google Analytics data may be processed by Google in the United States, under the EU–US Data Privacy Framework, under which Google is certified, and standard contractual clauses.

The AI features send what is described in section 3(i) to DeepSeek, in the People's Republic of China, which has no adequacy decision from the European Commission. It rests on your explicit consent (Article 49(1)(a) GDPR), asked the first time you use an AI feature, after telling you where the data goes and that the country has no adequacy decision. Until you agree nothing is sent, and if you do not use the AI features, nothing is sent at all. The features that run in the background — prompts written each week, the editorial engine — run for an organisation only once one of its members has agreed, and the screen that asks says so. You can withdraw from the ⚙ menu on Ask AI; nothing more is sent on your behalf from then on.

10. Your rights

Under the GDPR you have the right to:

• ask what we hold about you and get a copy of it;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to processing based on legitimate interests;
• receive your data in a portable, machine-readable form;
• withdraw a consent at any time, without affecting what was done before you withdrew it.

Two of these do not need to be asked for. Your account has Export my data, which produces a machine-readable copy of your account, your sessions, your tokens and their activity, your organisation's data, and your Ask AI conversations and what it remembers about you, and Delete account, which removes it. For anything else, write to [email protected] and we will answer within one month.

If you think we have got this wrong, you can complain to the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα) — https://www.dpa.gr/ — or to the supervisory authority where you live.

11. How it is protected

• Everything travels over HTTPS.
• Passwords are hashed, never stored or logged in the clear.
• Platform tokens are encrypted at rest.
• Two-factor authentication and passkeys are available on every account, and sessions and tokens can be revoked individually.
• One organisation cannot read another's data: that boundary is enforced in the data layer rather than per screen, and it is covered by automated tests that fail the build if it stops holding.

No system is perfect. If a breach occurs that is likely to put your rights at risk, we will notify the supervisory authority within 72 hours and tell you without undue delay.

12. Children

GlideDay is a tool for people running a brand's channels. It is not directed at children and accounts are not knowingly created for anyone under 16.

13. Changes to this policy

We will update this page when the service changes, and the date at the top will say when. If a change materially affects your rights we will tell account holders by email rather than leaving it to be noticed.

14. Contact

[email protected] for privacy; [email protected] for everything else. The Terms of Use are the other half of this agreement.