Privacy Policy for glosy
Effective date: September 21, 2026
Data controller: Mohammad Matin Marzie, operating as an individual developer based in Greece
Contact: support@glosy.gr
glosy ("the App", "we", "us") is a language-learning mobile application that lets you learn new languages through short subtitled videos ("reels") and vocabulary practice, including reels uploaded by other users. This Privacy Policy explains what data we collect, why, how it's used, and the rights you have over it.
This policy applies to the glosy mobile app and its backend services. It does not apply to third-party services we link to or integrate with (like Google Sign-In, Wiktionary, or YouTube), which have their own privacy policies.
1. Data We Collect
1.1 Account & profile data
- Email address
- First name and, optionally, last name
- Username
- Password — stored only as a irreversible cryptographic hash, never in plain text
- Age
- Profile picture (optional)
- Language preferences (native language, language you're learning)
- Notification preference (on/off)
- App usage/progress data: vocabulary learned, in-app "energy" and "coins" gamification balances
1.2 If you sign in with Google
We receive your Google account ID, name, email address, and profile picture, as permitted by the scopes you approve during Google Sign-In. We do not receive your Google password.
1.3 Content you create
- Videos ("reels") you upload, plus any title, description, thumbnail, and subtitle/dialogue text you add to them
- Comments you post
- Likes and saves
- Reports you file against other users' content, including the reason you select
Reels, titles, descriptions, comments, your username, and your profile picture are visible to other users of the App by design — that's how the social/learning feed works. Don't upload anything you don't want other users to see.
1.4 Technical data
Like virtually any networked app, our servers automatically log standard technical data with each request — IP address, device/OS type, timestamps, and similar metadata. We use this only for security, debugging, and abuse prevention, not for tracking or profiling you.
If you enable practice reminders, your device schedules them locally. Our servers do not send them, and we do not receive or store any push-notification token.
1.5 What we do not collect
- We do not request precise location data.
- We do not access your contacts.
- We do not currently process payments — the App has no in-app purchases or subscriptions.
- We do not use advertising SDKs or third-party analytics/tracking SDKs.
2. How We Use Your Data
- To create and operate your account and authenticate you
- To provide the core learning experience — serving reels matched to your languages, tracking vocabulary progress
- To operate the social features of the App — the reels feed, likes, comments, saves
- To send account-related emails: email verification codes and password reset codes
- To review and act on content reports and enforce our Terms of Use
- To provide optional daily practice reminders, which your device schedules locally, if you've enabled them
- To maintain the security and integrity of the App
3. Legal Basis for Processing (EU/EEA users)
| Processing activity | Legal basis |
|---|
| Account creation, authentication, core app functionality | Performance of a contract (our Terms of Use) with you |
| Security, fraud/abuse prevention, technical logs | Legitimate interest |
| Optional practice reminders (local notifications on your device) | Consent (you can withdraw it anytime in Settings) |
| Responding to legal requests | Legal obligation |
4. How We Share Your Data
We do not sell your personal data, and we do not share it with advertisers.
We share data only with:
- Other users of the App — your username, profile picture, and any content you post publicly, as described in 1.3.
- Service providers acting on our behalf, strictly to operate the App:
- An email delivery provider (Brevo), used solely to send verification and password-reset codes to your email.
- Google, if you use Sign-In with Google, to authenticate you.
- Third-party services your device contacts directly, only when you use the related feature. These requests go from your device to the provider, not through our servers, so the provider receives your IP address and the request itself, and handles them under its own privacy policy:
- Wikimedia (Wiktionary), when you look up a word definition. The word you look up is sent to
en.wiktionary.org.
- YouTube (Google), when you watch an embedded grammar video. The video player and its metadata are loaded from YouTube.
- Legal authorities, only if required to comply with a legal obligation, protect our rights, or protect the safety of users or the public.
5. Data Retention
We keep your account data for as long as your account is active. If you delete your account (see Section 7), we permanently delete your account record and associated content — profile, reels, vocabulary progress, comments, likes, reports you filed — except where we're legally required to retain certain records for a longer period.
Note: if another user reported one of your reels, and you later delete your account, the report record referencing that reel is also removed (both your reels and any reports tied to them cascade-delete with the account).
6. Your Rights
If you're in the EU/EEA (or wherever local law grants equivalent rights), you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data (most profile fields are editable directly in the App)
- Erase your data (see Section 7 — account deletion)
- Restrict or object to certain processing
- Port your data to another service, where technically feasible
- Withdraw consent at any time, where processing is based on consent (e.g., notifications)
- Lodge a complaint with your local data protection authority — in Greece, the Hellenic Data Protection Authority (HDPA)
To exercise any of these rights, email support@glosy.gr. We'll respond within a reasonable time and in any case within the timeframe required by applicable law.
7. Deleting Your Account & Data
You can permanently delete your account and all associated data at any time:
- In the App: Go to Profile → More → Account → Delete Account.
- Without the App installed: email support@glosy.gr from the address associated with your account and request deletion; we'll verify and process the request without needing you to reinstall the App.
Account deletion is permanent and irreversible. It removes your profile, uploaded reels and their video files, vocabulary progress, comments, likes, and reports you've filed.
8. Children's Privacy
glosy is intended for users aged 16 and older. We do not knowingly collect personal data from anyone under 16. If we become aware that we've collected data from a user under 16, we will delete that account and its data. If you believe a child under 16 is using the App, please contact us at support@glosy.gr.
9. Data Security
We use reasonable technical measures to protect your data, including password hashing and access controls on our servers. However, no method of transmission or storage is 100% secure, and we can't guarantee absolute security.
10. International Data Transfers
Some of our service providers (e.g., Google) may process data outside the EU/EEA. Where this happens, we rely on the safeguards those providers offer (such as Standard Contractual Clauses) to ensure your data remains protected to a standard consistent with EU law.
11. Changes to This Policy
We may update this Privacy Policy from time to time, for example as the App's features change. We'll update the "Effective date" above when we do. Material changes will be flagged in the App.
12. Contact Us
Questions, requests, or complaints about this policy or your data: support@glosy.gr