Privacy policy

• The Glauco app never sends us anything about your clusters, contexts, kubeconfig files, credentials, resources or how you use the app.
• Glauco contacts us for two things only: to check for updates and to check your license.
• We do not use third-party analytics, advertising or tracking, in the app or on this website.
• We count licensed installs by app version and operating system, from the license checks.
• We do not sell personal data.

Koode is the controller for the personal data in this policy. Glauco is a product of Koode.

• Postal address: Postbus 8830, 1006 JA Amsterdam, the Netherlands
• Chamber of Commerce (KvK): 71804005
• Contact for privacy questions: support@glauco.app

About once an hour, Glauco asks releases.glauco.app whether a newer version exists. On macOS and Windows, the address of that request contains only the platform and processor type, for example darwin/arm64. On Linux, Glauco reads latest.json, an address with nothing about your computer in it, and shows a notice when a newer version is out. If you installed the .deb or .rpm, your package manager also asks apt.glauco.app or rpm.glauco.app for the package list each time you update your system. Like every request on the internet, these requests also carry your IP address and standard technical headers, which can include the app version and the operating system. The release service keeps no list of who checked for updates, but its request log records each request (see "Logs" below). The download buttons on this website ask the same service for the newest version.

The 14-day trial and the free mode run on your computer. They send nothing to us.

When you enter a license key, Glauco sends these details to licenses.glauco.app:

• the license key
• an install id: a random number the app creates; it is not a hardware fingerprint
• the email address of your seat
• an install label, by default "Mac (macOS)", "Windows PC" or "Linux PC", never your computer's name; you can change it so a team admin can tell your computers apart
• the app version and the type of operating system (macOS, Windows or Linux)

While Glauco is online, it renews its license once a day. That call sends the current license token, the app version, and the install label if you changed it. When you remove the license from the app, it sends the license token so the server can free the install.

The license server stores:

• per license: the license key, the plan, the number of seats, the status, the paid-until or end date, the email of the buyer or team admin, Stripe's references to the customer, subscription and checkout, and for complimentary licenses a note from Koode
• per seat: the email address and when the seat was claimed or released
• per install: the install id, label, app version, operating system type, the time of the last check, when it was removed, and the end date of an offline license file if one was issued
• an audit log of what happened to a license and who did it (you, a team admin, Koode or the system), with the time: for example a seat released (with its email address), an install removed (with its label), billing opened or the key email sent again
• the messages Stripe sends us about purchases, renewals and cancellations; they contain the details you gave at checkout, such as your email address, name and billing country

We do not store IP addresses. To slow down abuse, the license server counts requests per IP address in its memory for a short time. That count is never written to disk. The license server does not write license keys, license tokens or email addresses to its logs.

From these records we count active installs and new activations, by app version and operating system, to know which versions and systems to support. The counts come only from the license server's own records. No analytics service is involved.

A team admin can see, for their license, the email address of each seat and the label, app version, operating system and last check time of each install.

When you buy a license, or ask for the key email again, the license server emails the key and its activation link to the buyer or team admin. It sends that email from licenses@glauco.app through Cloudflare Email Sending.

Purchases go through Stripe. For these sales, Sold through Link, LLC, a Stripe company, is the merchant of record; buyers see it as "Link". It sells the license to you, processes your payment details and handles tax, invoices and refunds. Stripe does this as an independent controller under the Stripe privacy policy, which Link uses too. We never see your card details.

Checkout and the billing portal run on Stripe's own websites, not on glauco.app. There, Stripe collects information about your device, browser and network to prevent fraud, and sets its own cookies (see the Stripe cookie policy). Stripe's dashboard shows us statistics about purchases, such as how many checkouts were completed.

glauco.app is hosted on Cloudflare. Cloudflare processes your IP address to deliver the website and protect it from attacks. To show prices in US dollars or euros, we use the country that Cloudflare derives from your IP address. We do not store it.

When you sign in at glauco.app/account, we check with the license server whether the email address you enter has a license. Only if it does, we send one email with a 6-digit code and a sign-in link, from account@glauco.app, through Cloudflare Email Sending. We store the email address with a hash of the code and of the link, never the code or link itself. They work for 10 minutes and once only. We delete the record one day after it expires. To stop abuse, Cloudflare counts code requests per email address and per IP address, and code checks per IP address, each for one minute; we do not store those counts. We also allow at most 5 code requests per email address and IP address per hour, and 20 per email address per hour. To count them we store a keyed hash of the email address and of the IP address (for an IPv6 address, of its first 64 bits) with the time, never the addresses themselves, and we delete it within two hours. After 25 wrong codes for an email address in an hour, we accept no more codes for it that hour; the sign-in link still works.

This website sets only these cookies:

• glauco_account: keeps you signed in, for 12 hours. It is sent only to pages under /account. The contact form reads it through an address under /account, to attach your licenses to your message.
• glauco_account_pending: remembers the email address between the two sign-in steps, for 15 minutes, only under /account.
• glauco_currency: set when you choose a currency, which is any glauco.app address with ?currency= in it, such as the switch on the pricing page; it remembers your choice for one year.

These cookies are needed for things you ask for, so we do not ask for consent. There are no analytics, advertising or tracking cookies. There are no third-party scripts, except Cloudflare Turnstile on the contact form when you are not signed in (see "The contact form"). Fonts and all other files load from glauco.app itself.

The Cloudflare Workers that run this website and the release service have Cloudflare Workers Logs turned on. These logs record each request, including its full address, and the messages our code writes while handling it. The address of a sign-in link contains its one-time token, so the log holds that token too; it stops working after 10 minutes or once it is used. The logs also hold each response's status code. Cloudflare keeps them for at most 7 days. We use these logs only to find and fix problems.

The license server and the tunnel in front of it write their own logs on the server they run on. These logs are not collected or copied anywhere else. They are overwritten as the log files rotate, and deleted when the server process is replaced. They contain no IP addresses, license keys, license tokens or email addresses: those are filtered out.

When you write to support@glauco.app or sales@glauco.app, we use your message and address to answer you. These mailboxes run on Google Workspace.

The contact form at glauco.app/help/contact sends your message by email to support@glauco.app, from help@glauco.app through Cloudflare Email Sending. The email holds what you fill in: your email address, the topic, your message, and, if you give them, your name and your Glauco version and operating system. It also holds the time and the country that Cloudflare derives from your IP address. If you are signed in to your account, it holds your verified email address and, for each of your licenses, its plan, status, number of seats and ID. It never holds your license key.

The website does not store your message. It is only in the support mailbox on Google Workspace, and we keep it like other support email (see "How long we keep data"). We do not send a copy to the address you typed in.

If you are not signed in, Cloudflare Turnstile checks that a person sends the message. It loads a script from challenges.cloudflare.com, and Cloudflare processes your IP address and information about your browser and device for this check. Signed-in messages skip it. To stop abuse, Cloudflare counts messages per IP address for one minute; we do not store those counts.

• Cloudflare: website hosting and its logs, DNS, sending the sign-in, license-key and contact-form emails, Turnstile on the contact form, and the connection in front of the license server
• Google Workspace: the support and sales mailboxes
• Hetzner Online GmbH: the server that runs the license server and its database, in a data centre in Helsinki, Finland. This data stays in the European Union.

Stripe processes payments as an independent controller, see "Buying a license".

Cloudflare, Google and Stripe have US parent companies and may process data outside the European Economic Area. They use these safeguards that the GDPR allows:

• Cloudflare: the EU-US Data Privacy Framework and the EU Standard Contractual Clauses, in its customer data processing addendum.
• Google: the EU-US Data Privacy Framework and the EU Standard Contractual Clauses, as described on its data transfer frameworks page and in the Cloud Data Processing Addendum that covers Google Workspace.
• Stripe (including Link): the EU-US Data Privacy Framework and the EU Standard Contractual Clauses, in the Stripe privacy policy.

• To deliver the license you bought and your account: performance of a contract.
• Update checks, security and abuse prevention: our legitimate interest in a working, safe service.
• Counting installs by app version and operating system: our legitimate interest in knowing which versions and systems to support.
• Keeping purchase records: our legal duty under Dutch bookkeeping law.

• License, seat and install data: while the license exists, and deleted 1 year after the license ends. Records we must keep for bookkeeping: 7 years, the Dutch fiscal retention period.
• Removed installs and released seats: deleted 1 year after removal.
• Audit log: 2 years.
• Stripe purchase messages: 7 years.
• Sign-in codes and links: valid for 10 minutes, deleted one day after they expire.
• Sign-in request records (keyed hashes of the email address and IP address): deleted within two hours.
• The sign-in cookie: 12 hours.
• Support and sales email, including messages from the contact form: 2 years after the last message.
• Cloudflare Workers Logs: at most 7 days.
• License server and tunnel logs: until the log files rotate or the server process is replaced.

You can ask us to see the personal data we have about you, to correct it, to delete it, to give it to you in a portable form, or to limit how we use it. You can also object to processing based on our legitimate interest. Write to support@glauco.app. We answer within one month.

If you think we handle your data wrongly, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

When we change this policy, we update this page and the date at the top. If a change matters for how we use your data, we tell license holders by email first.