Glowbit is operated by SUNIKO ("we", "us"). SUNIKO is the data controller for the personal data described here.
For anything in this policy — access, deletion, complaints, questions — write to [email protected]. We answer within 30 days, as required by the GDPR.
Account data. When you sign up we store:
Session data. Each time you sign in we create a session record containing a session token, its expiry, the IP address the request came from, and the browser user agent string. We keep this to let you stay signed in, to show you your active sessions, and to investigate suspicious sign-ins.
Content you create. Displays and their configuration (text, styles, palettes, animations), playlists, schedules, walls and their layouts, canvas artwork, and the public share identifiers you generate. This is the substance of the service; we process it to store it, render it, and deliver it to the screens you connect.
Connected screen data. When you pair a TV, browser or kiosk, that device reports its own screen resolution, pixel density and browser user agent so we can render your sign correctly on it. We store this alongside the screen record together with a pairing token and last-seen timestamps.
Billing data. If you subscribe, we store your subscription status, plan, renewal date and the identifiers our payment provider gives us. Card numbers and payment credentials never reach our servers — they are handled entirely by Lemon Squeezy, which acts as merchant of record for the sale.
API keys and referrals. If you create API keys we store their hashed form and metadata. If you take part in the referral programme we store the link between the referring and referred accounts.
Support correspondence. If you email us, we keep that message and our reply so we can follow up.
Analytics. If — and only if — you consent, Google Analytics sets cookies and collects usage data such as pages viewed, approximate location derived from IP, device type and referring site. Decline and none of this is collected; the product behaves identically.
Under the GDPR we rely on a different basis for each purpose, and they are not interchangeable:
We do not sell personal data and we do not share it for advertising. We use a small set of providers who process data on our instructions:
We may also disclose data where the law compels us to, or to establish or defend legal claims.
Our servers are in Germany, inside the EU. Lemon Squeezy, Resend, Sentry and Google are based in the United States, so using them involves transferring personal data outside the European Economic Area. Those transfers rely on the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.
Delete your account and we remove your personal data and content, except where we are legally required to keep records. Backups roll off on their own schedule.
If you are in the EEA or the UK you have the right to:
Write to [email protected] to exercise any of these. We will not charge you or make the service worse because you did.
Traffic runs over TLS. Passwords are stored only as hashes. API keys are stored hashed. Authentication headers and tokens are stripped from logs and crash reports before they leave our servers. Access to production systems is limited to people who need it.
No system is perfectly secure. If a breach affects your rights, we will notify the relevant authority within 72 hours and tell you directly where the law requires it.
Glowbit is not intended for children. You must be at least 16 years old to create an account. If we learn we hold data from someone younger, we delete it.
We may update this policy as the product changes. The date at the top always reflects the current version. For changes that materially affect your rights we will tell you by email or in the product before they take effect.
SUNIKO — [email protected]
See also our Terms of Service.