Privacy Policy

Last updated: October 2026

1. Who We Are

Glossa (readglossa.com) is operated by Sensus Software AS, organisation number 832 877 352, Bergen, Norway. Sensus Software AS is the data controller for the personal data described in this policy. You can reach us at [email protected].

2. Information We Collect

Information you give us

  • Account details — your email address and display name. If you sign in with Google, we receive your name and email from Google; if you sign up with email and password, your password is handled by Firebase Authentication and never stored by us.
  • Content you upload — books and documents (PDF, EPUB) you add to your library.
  • Learning data — reading progress, saved words, highlights, practice and game results, tutor lessons, and your language and reader preferences.
  • Feedback — suggestions and votes you submit through the in-app feedback board.
  • AI assistant connections — if you connect Glossa to an AI assistant such as Claude or ChatGPT (see section 4), we keep a record of each connection: the assistant's name, the access you granted, and when it was created and last used.
  • Billing information — if you buy Pro, Stripe collects your payment details. We receive only a customer reference, your plan, and its status and end date. We never see or store your card number.

Information collected automatically

  • Usage events — which pages you read and which features you use (for example, looking up a word), so we can track your progress, enforce plan limits, and understand how the product is used.
  • How you found Glossa — on your first visit we note the website that linked to you (its domain only, such as google.com, never the specific page) and any campaign tags in the link (such as utm_source), plus the Glossa page you arrived on and the date. If you later create an account, this is saved with it so we can tell which channels bring readers who stay.
  • Sign-up steps — which steps of signing up and getting started you reached and when (for example: opened sign-in, chose your languages, chose your level, started checkout), so we can see where sign-up gets stuck. Before you have an account these steps are keyed only to the visitor hash described in section 9. When you sign in, that day's steps from the same network and browser are linked to your account.
  • Technical data — IP address, browser and device type, error reports, and performance measurements, used for security, abuse prevention, rate limiting, and fixing bugs.

3. How We Use Your Information

  • To provide the service — translations, word glosses, audio narration, vocabulary practice, and lessons. Legal basis: performance of our contract with you.
  • To process payments and manage your plan. Legal basis: contract, and our legal obligation to keep accounting records.
  • To keep Glossa secure, prevent abuse and fraud, and fix problems. Legal basis: our legitimate interest in running a safe service.
  • To improve the product using aggregated usage statistics. Legal basis: our legitimate interest in improving Glossa.
  • To contact you about your account, billing, or significant changes to these policies.

We do not sell your personal data, we do not use it for advertising, and we do not build advertising profiles.

4. Who We Share It With, and How

We share data only with the service providers below, only as far as each needs it to deliver its part of Glossa, and always over encrypted (TLS) connections. Each acts under a data processing agreement or its own terms as an independent controller (Stripe, for payments).

  • Microsoft Azure — hosting, database, and file storage (Norway East region); machine translation and text-to-speech (receives the text being translated or read aloud); error and performance monitoring.
  • OpenAI — AI translations, word glosses, summaries, lessons, phrasebook sentences, generated book covers, and moderation of feedback posts. Receives text passages from the books you read and the sentences you write in your phrasebook, not your name or email. Under OpenAI's API terms this data is not used to train their models.
  • Google Firebase — sign-in and account authentication.
  • Stripe — payment processing, receipts, and subscription management. See Stripe's privacy policy.
  • Cloudflare — domain, network security, bot protection (Turnstile) at signup, and email forwarding for our support address.

To avoid paying for the same work twice, translations of text passages are cached and may be reused when another reader opens the same text. Cached translations are stored without any link to your account.

We may also disclose information if required by law or a valid legal request, or to a successor if Glossa is sold or merged, in which case this policy continues to apply to your data.

AI assistants you connect

You can choose to connect Glossa to an AI assistant, such as Claude (Anthropic), ChatGPT (OpenAI) or Gemini (Google), from Account → AI connections. Nothing is shared with an assistant unless you set up the connection yourself. Once connected, the assistant can ask Glossa for:

  • your language settings, level, plan, streak and points;
  • the books and articles in your library and how far you have read;
  • your day-by-day reading activity;
  • the words you have saved, with their review state;
  • the sentences in your phrasebook, which you wrote about yourself, with how often you have practised them;
  • searches and book recommendations from our public-domain catalog, personalised from your library.

If you also allow it when you connect, the assistant can propose new sentences for your phrasebook, built from what you have told it about yourself. Glossa writes each proposal with its own AI model (OpenAI, as for the rest of the phrasebook) and keeps it, with the words the assistant sent, until you keep or discard it in My phrases; a discarded proposal is deleted. Apart from that, the connection is read-only: the assistant cannot change your library, settings or account, or see your name, email address, payment details or the text of books you uploaded. Glossa does not receive or store your conversations with the assistant. Once the assistant has received your data, it is handled by that provider under its own terms and privacy policy, as part of your agreement with them, not ours. You can disconnect at any time (see section 7).

International transfers

Your account and library data are stored in Norway. Some of the providers above (OpenAI, Google, Stripe, Cloudflare) may process data in the United States. Those transfers rely on the EU–U.S. Data Privacy Framework and/or the European Commission's Standard Contractual Clauses.

5. How We Protect Your Data

  • All connections to Glossa and between our services use TLS encryption.
  • Our database and file storage are encrypted at rest.
  • Every request to our servers must carry a verified sign-in token, and your library, vocabulary, and progress are only accessible to your own account.
  • Database access is restricted by network firewall rules; credentials are kept out of our source code and limited to the services that need them.
  • Uploads go through short-lived, write-only links; payment notifications from Stripe are signature-verified.
  • AI assistant connections use OAuth sign-in or a personal access token. We store only one-way hashes of tokens, never the tokens themselves; access tokens expire after an hour, and a connection can only read, never change, your data.
  • Rate limits and bot protection guard against automated abuse.

No system is completely secure. If we become aware of a breach that affects your personal data, we will notify you and the Norwegian Data Protection Authority as required by law.

6. How Long We Keep It

  • Account, library, and learning data — until you delete your account.
  • Pages-read log used for free-tier limits — 30 days.
  • Tutor lessons — 180 days.
  • Detailed usage events and game results — 365 days.
  • Sign-up steps — 90 days, or until you delete your account.
  • Homepage visitor hashes — about 13 months; they cannot be traced back to you once the monthly key is deleted (see section 9).
  • How you found Glossa — with your account, until you delete it.
  • AI assistant connections — the record of each connection is kept, disconnected or not, until you delete your account. One-time sign-in codes are cleared within a day of expiring. Refresh tokens last at most 90 days and are cleared once they expire, or 7 days after they are replaced or revoked.
  • Billing records — kept by Stripe and us for as long as Norwegian bookkeeping law requires (generally 5 years), even after account deletion.
  • After deletion we keep a one-way hash of your email address so that, if you sign up again, we can tell you your previous account was deleted. The hash cannot be turned back into your email.

7. Your Rights

Under the GDPR you have the right to access, correct, delete, or receive a portable copy of your personal data, to restrict or object to how we process it, and to withdraw any consent you have given.

  • Delete your account at any time from Account settings. This cancels any active subscription and permanently removes your books and uploaded files, generated covers and images, vocabulary, progress, lessons, feedback posts, and your sign-in record in Firebase Authentication.
  • Update your profile and preferences from within the app.
  • Disconnect an AI assistant at any time from Account → AI connections. It loses access immediately. Data the assistant already received is held by its provider; ask them to delete it.
  • For a copy of your data or any other request, email [email protected]. We respond within 30 days.

If you believe we have mishandled your data, you can complain to the Norwegian Data Protection Authority (Datatilsynet) or the authority in your own country.

8. Children

Glossa is not intended for children under 13, and we do not knowingly collect personal data from them. If you believe a child has created an account, contact us and we will delete it.

9. Cookies and Local Storage

Glossa does not use advertising or cross-site tracking cookies. We do not embed Google Analytics, Facebook Pixel, or similar trackers. Under the Norwegian Electronic Communications Act (ekomloven §2-7b) and the EU ePrivacy Directive, the items listed as strictly necessary and the preferences you set yourself need no consent. The one other item, how you found Glossa, is described separately below with how to remove it.

Strictly necessary

  • __cf_bm — set by Cloudflare for bot detection and security. First-party cookie, ~30 minutes, no personal data.
  • Cloudflare Turnstile — a bot check shown at signup.
  • Firebase Authentication token — stored in your browser's localStorage under keys prefixed firebase:authUser:. Required to keep you signed in. Cleared when you log out.
  • Error and performance monitoring — Azure Application Insights runs in cookieless mode: it sets no cookies and does not track you across sessions or sites.
  • Visitor counting — to count unique visitors to our homepage we store, on our servers, a one-way hash of your IP address and browser type, combined with a random key that changes every month and is then deleted, together with a coarse label of your browser (its name and major version, operating system and language settings, for example “Safari 26 · macOS · en-GB”) so that several page loads by one person within a few minutes count once, and so the sign-up steps that follow them can be matched to the same visit. Visitor counting itself stores nothing in your browser. The hash cannot be traced back to you once the key is gone, and it is removed after about 13 months. The same hash records the sign-up steps described in section 2. If you create an account, that day's steps are linked to it for up to 90 days and deleted with your account.

Preferences you set

Stored only in your browser's localStorage and never sent to advertisers, for example:

  • reader_settings — font size, theme, gloss reveal level, reading mode.
  • streak_last_celebrated, streak_pending_celebration — prevents replaying streak milestone animations.
  • uiTranslate_* — cached translations of UI labels into your target language, so they load instantly on return visits.

How you found Glossa

glossa:attribution in your browser's localStorage holds the referring domain, campaign tags, landing page and date from your first visit, as described in section 2. It is written only when you arrive from another website or a tagged link, never overwritten, and sent to us with the visitor count and, if you sign up, saved with your account. It contains no identifier. You can remove it by clearing site data for readglossa.com.

Payment processing

When you buy Pro, you are redirected to Stripe Checkout on stripe.com. Any cookies set during checkout are first-party to Stripe and governed by Stripe's privacy policy.

You can clear all browser storage for readglossa.com at any time from your browser's site settings. Doing so will sign you out and reset your reader preferences.

10. Changes to This Policy

We may update this policy from time to time. The date at the top shows when it last changed. We will notify registered users of significant changes by email before they take effect.

11. Contact

Sensus Software AS, Bergen, Norway — [email protected].