Privacy policy
The short version
- The Glowbeam SDK processes camera frames on the device only. It sends no images, video, face landmarks or face measurements to us or to anyone else. The engine contains no network code.
- The app that uses the SDK contacts our licence server to get a licence token and to report usage. For that, the licence server stores device-key thumbprints and per-device monthly usage counts.
- This website sets no tracking cookies and runs no analytics.
Who we are
Glowbeam ("we") is operated by [legal entity name, registered address, company number]. You can reach us at hello@example.com. [Name a data protection contact if one is required.]
What the SDK does on the device
The SDK finds a face in each camera frame, fits a face mesh to it and draws beauty, makeup and effects on the GPU. All of this happens inside the app on the user's device. Camera frames, face landmarks, masks and any other pixel data stay in device memory, are never written to disk by the SDK, never appear in its logs and are never sent over the network. We never receive them.
What the licence server stores
An app that ships the SDK runs a small licence client. It asks our server at glowbeam.devx.ro for a short-lived licence token when the app starts and while it runs, and reports monthly usage. These requests contain no images. The server keeps the following:
| Data | What it is | Why we keep it |
|---|---|---|
| Device-key thumbprint | The SHA-256 hash of a public key the licence client creates on the device. The matching private key stays in the device's secure key store and never reaches us. | To bind a token to one device, enforce the device limit of a licence and let a customer revoke a device. |
| Per-device monthly usage counts | For each licence, app and month: which feature modules a device used, keyed by a pseudonymous device identifier, with the date it was first seen that month. | To count monthly active users per feature, which is how licences are billed. |
| Device records | The app ID, first and last time the device was seen, the time of its last token and the SDK version it runs. | To show customers their devices, spot misuse of a licence key and support integrations. |
| Daily request totals | For each licence and day: how many tokens were issued or refused, per app and platform. Not per device. | To monitor the service and detect leaked or shared keys. |
| IP address | Seen by our server with every request. | To deliver the response and rate-limit abuse. [Confirm how long server and reverse-proxy logs keep IP addresses.] |
A token request also carries the licence key, the app ID, the platform, the app's signing identity, the SDK version and, where available, a platform attestation from Google Play Integrity or Apple App Attest. These are used to decide whether to issue a token and are not kept beyond the records above. [Confirm whether attestation verdicts are logged.]
Whose data this is
For the people who use our customers' apps, the app maker is the controller and we process licence and usage data on its behalf, under our data processing addendum. For our customers' own staff, such as the people who sign in to the customer console, we are the controller.
Customers and the customer console
For customer accounts we keep names, work email addresses, company details, licence and payment records, and notes from our conversations. Signing in to the customer console uses cookies that are needed to keep you signed in. We send service emails such as sign-in links and licence notices.
This website
The marketing pages set no cookies and load no analytics or advertising scripts. Your choice of light or dark theme is saved in your browser's local storage and never sent to us. If you email us, we keep the email to answer it.
Where data is kept and for how long
- Data is stored on our own server in [country] and in its database backups, which are kept for 14 days. [List any sub-processors, such as the hosting provider and the email provider.]
- Device records and usage counts are kept for the life of the customer's licence plus [period] for billing and disputes, then deleted. [Confirm periods.]
- Daily request totals are kept for [period].
Security
Licence keys are stored only as keyed hashes, never in plain text. Traffic is encrypted with TLS. The admin console requires a second factor, and every admin change is written to an audit log. The database denies its tables to public clients.
Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict or object to the processing of your personal data, and to complain to a data protection authority. If you use an app that includes Glowbeam, contact the app maker first, because they decide how their app uses our service. We will help them answer. You can also write to us at hello@example.com.
Changes
We will post changes to this policy on this page and update the date at the top.