Privacy policy

Last updated 19 October 2026

Who we are

This policy is about ai.gloath.com (the site) and Gloath's apps, run by Gloath Limited, a company registered in New Zealand ("Gloath", "we", "us"). It explains what personal information we collect, why, how we protect it, when we may share it, and what you can do about it. We follow the Privacy Act 2020.

What we collect

Your account

• Your email address, and your name if you give one.
• How you sign in: with a password, or with Google. If you use Google, Google tells us the name and email address on your Google account. Your password is handled by Firebase Authentication, a Google service: we never see it.
• When you created your account and last signed in, and the account ID Firebase gives you.
• Which version of our terms you agreed to and when, and whether you asked for emails about new models (and when you said so).
• Your custom instructions, if you write any: what you'd like models to know about you, and how replies should sound. They're used to shape replies, and aren't used for training.

To sign you in securely and stop abuse, Firebase also processes technical information such as your IP address and browser details.

Your chats, to train Gloath's models

Copies of your chats are sent to Gloath and used to develop and train our AI models: your messages, the replies, the ratings you give replies (thumbs up or down), which model wrote them, and when. They don't include your custom instructions.

• On the free plan, this is always on. It's part of how the free plan is paid for.
• On Gloath Pro, it's on unless you turn it off in Settings, under Data. Turning it off applies from then on: new chats aren't shared, while chats shared before that stay with us and may already have been used to train our models. If your Pro ends, new chats are shared again.
• If the law where you live gives you the right to object to this, as in the European Union and the United Kingdom, contact us and we'll keep your chats out of training, whatever your plan.

Shared chats are encrypted, and filed under a code instead of your name, email or account. When we use them, we first take out details we can find automatically, such as email addresses and phone numbers. People at Gloath who work on our models may read them, to check their quality. So don't type anything you wouldn't want used this way, such as passwords, or health or financial details.

If you delete a chat, its shared copy is deleted too, and all of them are if you delete your account. A model that has already been trained on a chat can't unlearn it, but the chat won't be used again.

Gloath Pro

Payments are handled by Stripe. Stripe collects your card details and billing details, such as your country, and keeps your invoices; we never see your full card number. Stripe tells us whether a payment went through, and we keep your Stripe customer and subscription IDs, your plan, whether it renews monthly or yearly, and when it renews or ends.

Chat backup, if you have Gloath Pro

Backup is on when you get Gloath Pro, and you can turn it off in Settings, under Plan. While it's on, we store your chats: your messages, the replies, chat titles, when they were written and which model wrote them. They're encrypted on our servers (see Keeping it safe). We use them only to keep your chats on all your devices.

Models that run on Gloath's servers

Some of our models may run on our servers instead of your device; the model menu says which. When you use one, the conversation is sent to our servers so the model can write its reply. The server doesn't keep it once the reply is written. The chat is then handled like any other: shared for training as described above, and kept in your backup if backup is on.

Usage analytics, if you allow them

If you choose "Allow analytics", we use Google Analytics to see how the site is used, so we can improve it and our models. It records:

• which pages you visit and how long for
• what you do: signing up or in, downloading or starting a model, sending messages, stopping or retrying replies, copying text, changing settings, looking at or buying Gloath Pro, and errors you run into
• counts and measurements, such as how many messages are in a chat, how long a message is in characters, how long a reply is in tokens, and how fast the model runs
• technical details: your browser, operating system, device type, screen size, whether the model runs on your graphics card or processor (and which kind), and your approximate location (country and city), which Google works out from your IP address

It never records the text of your messages or of the replies. Analytics data is linked to your random account ID, not to your name or email address. You can change your choice at any time in Settings, under Data. If you say no, nothing is sent.

When you visit and download

• Our hosting provider (Cloudflare) processes your IP address and browser information to deliver the site and protect it from attacks.
• On some browsers, including phones and Safari, the page loads part of Google's sign-in service (Firebase) as it opens, so Google receives your IP address and browser information even before you sign in.
• Models are downloaded from Hugging Face. When you download one, your browser connects to Hugging Face, which receives your IP address and browser information under Hugging Face's privacy policy.

When you contact us or send feedback

If you email us, or send feedback from Settings, we keep your message, your email address and your plan, so we can read it and reply.

What stays on your device

These are kept in your browser's own storage on your device:

• Your chats: your messages and the replies. Copies are also kept by us: for training, as above, and in your backup if you have Gloath Pro with backup on.
• Your settings and your analytics choice.
• The downloaded models.

Your chats stay in this browser after you sign out. If you share this computer, delete them in Settings, under Data. Clearing this site's data in your browser removes all of it.

How we use your information

• to give you an account, Gloath Pro if you buy it, and chat backup if you use it
• to develop, train and improve Gloath's AI models and services, using chats shared as described above, and your feedback
• to keep the site secure and stop misuse
• to send you emails you need, such as password resets, email confirmation, receipts, and notice of important changes to our terms, prices or this policy
• to send you news about Gloath models and features, but only if you asked for it. Every such email has a way to unsubscribe, and you can also turn them off in Settings.
• to understand how the site is used and improve it and our models, using analytics only if you allow them
• to meet our legal obligations, such as keeping tax records

Keeping it safe

• The site only works over an encrypted connection (HTTPS).
• Your email address, name, choices and custom instructions, your backed-up chats, and the chats shared for training are encrypted on our servers (AES-256), each item with its own key. The master keys are kept apart from the storage, so the company that stores the data can't read it, and a copy of the storage on its own is unreadable.
• Shared chats are filed under a code made from your account with a secret key, so they can't be linked back to you without it.
• Passwords are handled by Firebase and never stored by us.
• Only Gloath people who need to can reach account information, through a protected admin page that needs a recent sign-in for exports and deletions. Every look-up, export and deletion is recorded in a log that's also encrypted.
• If a privacy breach is likely to cause serious harm, we'll tell you and the Privacy Commissioner as soon as we can, as the law requires.

When we look at or share your information

We don't sell personal information. We use these service providers to run the site. They handle your information on our behalf, under contracts and their own security and privacy commitments:

People at Gloath who work on our models may read chats shared for training, as described above. Apart from that, Gloath may look at, use or disclose your information, including your backup, only:

• when you ask us to, for example to help with a problem with your account
• when we believe it's necessary to comply with the law, such as a court order, search warrant or production order, or a lawful request from a New Zealand public sector agency, or an overseas one where New Zealand law allows it
• when we believe it's necessary to prevent or lessen a serious threat to someone's life, health or safety
• when we have reasonable grounds to think the site is being seriously misused, for example for fraud, attacks on our systems, or breaches of our terms that put other people at risk, and we need to look into it or stop it
• to establish, exercise or defend legal claims
• if Gloath's business, or part of it, is sold or reorganised, to the new owner, who must protect it as this policy does

When we do, we share only what's needed, we record it, and we tell you, unless the law doesn't allow it or telling you would put someone at risk. We can only share what we hold: chats that stay on your device, and were never shared or backed up, aren't on our servers.

If the law requires us to keep information, for example while a police investigation or court case is under way, we may keep it, and stop it being deleted, even if you ask us to delete it. We'll delete it as soon as we're allowed to.

Information sent overseas

Our providers store and process information outside New Zealand, including in the United States, the European Union and Australia. We use providers that are bound to protect it with safeguards comparable to New Zealand's privacy law, and the profiles, backups and shared chats we store are encrypted with keys they don't hold.

How long we keep it

• Account details: until you delete your account. Deleting it in Settings removes them straight away, and Firebase removes your sign-in details.
• Chat backup: until you delete the chats, turn backup off, or delete your account. If your Gloath Pro ends, we keep your backup so your chats come back if you return; you can download or delete it at any time in Settings, under Plan. If your Pro has ended and you haven't signed in for two years, we may delete it.
• Chats shared for training: up to three years, then we delete them; sooner if you delete the chat or your account. Models trained on them keep what they learned.
• Payment records: seven years, as New Zealand tax law requires. Stripe keeps them for us.
• Our log of who looked at or shared information: as long as we may need it to show we followed the law and this policy.
• Analytics data: up to 14 months, then Google deletes it.
• Emails and feedback: as long as we need them to deal with what you said, and to improve Gloath.

Our hosting provider keeps technical logs, such as IP addresses, for a short time for security. We never log what you write.

Cookies and browser storage

• Firebase Authentication keeps you signed in by storing a sign-in token in your browser. This is needed for your account to work.
• The site stores your chats, settings and choices in your browser's storage (IndexedDB and local storage), and models in its cache storage. These are needed for the features you use.
• Google Analytics sets cookies (named _ga and _ga_ followed by an ID), only if you allow analytics. If you turn analytics off, we remove them.
• Stripe's payment pages, on stripe.com, use their own cookies to process payments securely and prevent fraud.

We don't use advertising cookies.

Your rights

• You can ask to see the personal information we hold about you, and ask us to correct it. We'll answer within 20 working days, and may need to check it's really you first. You can download your chats yourself at any time in Settings.
• You can delete your account at any time in Settings, under Account. That also cancels Gloath Pro, and deletes your backup and the chats you've shared.
• You can keep your new chats out of training with Gloath Pro (Settings, under Data), or keep all your chats out by contacting us if the law where you live gives you the right to object.
• You can withdraw consent: turn analytics off in Settings, and unsubscribe from emails using the link in any of them or in Settings.
• If you have a concern, contact us first. If we can't resolve it, you can complain to the Office of the Privacy Commissioner.
• If you live in the European Union or the United Kingdom, you also have rights under the GDPR, including to access, correct, delete, restrict and move your information, to object to how we use it, and to complain to your local data protection authority. We rely on our contract with you to run your account, Gloath Pro and backup; on your consent for analytics and marketing emails; on our legitimate interests in developing and improving our models (you can object, as above) and in keeping the site secure and stopping misuse; and on legal obligations where the law requires us to keep or disclose information.

Children

The site isn't for anyone under 16, and we don't knowingly collect information about them. If you think someone under 16 has created an account, contact us and we'll delete it.

Changes to this policy

If we change this policy, we'll update the date at the top. If the change is significant, we'll tell you by email or on the site, and ask you to read it and agree again the next time you sign in.

Contact

Privacy Officer, Gloath Limited
m1@ai.gloath.com
New Zealand