Gloss privacy policy

Gloss is a Chrome extension that lets you talk with an assistant about the webpage you are viewing and change how that page looks. This policy explains what data it uses and where that data goes.

What Gloss sends, and when

• Your voice. While a conversation is on, microphone audio streams directly from Chrome to OpenAI so the assistant can hear and answer you. Gloss does not record or store it. Ending the conversation closes the microphone.
• Page content. When you ask about or change a page, the assistant reads that page's text, structure and positions. This content goes to OpenAI as part of the conversation. Gloss does not read the values you type into form fields.
• Screenshots. When the assistant needs to see the page, it captures the visible part of the current tab and our server sends it to OpenAI for analysis. Screenshots are not saved by Gloss.
• What you say during a task. If you speak while the assistant is working, the text of what you said is sent through our server to OpenAI to decide whether you changed your request. It is not stored.
• Conversation summaries. With page history on, when a conversation ends, its new text and the page's previous summary are sent through our server to OpenAI to update the summary, which comes back to your device. Our server doesn't store them, and the request asks OpenAI not to store them either. The next conversation on that page sends the summary and recent turns to OpenAI as part of the conversation.

What we store

• Your account. Sign-in is handled by Clerk, which stores your email address and sign-in details. If you continue with Google, Google shares your name, email address and profile picture with Clerk. Signing in on this website sets Clerk's sign-in cookies, which the extension reads to sign you in too.
• Credits. Our server stores each account's credit balance, the Stripe checkout IDs of its purchases, and, while a conversation is on, which conversation it is paying for. The balance is kept until you ask us to delete your account.
• Payments. Credits are sold through Stripe's Link on a checkout page run by Stripe, which acts as the seller and handles sales tax. Stripe collects your card details, email address and billing address; we never see your card number.
• Shared links. When you create a link to share a page, our server stores that page's address and title, the changes you saved on it, a screenshot of what you see, your account ID and when you shared it. Anyone with the link can see the title, address and screenshot, and if they have Gloss and choose to, see your changes on the original page. Links aren't listed or indexed, and they don't expire; delete one with Delete link right after creating it, or ask us to delete your links.
• Product events. For signed-in accounts, our server records when you reach certain steps: loading your account, starting a conversation, a screenshot check, a successful page change, starting a checkout and buying credits. It also records failures: a conversation that can’t start or ends with an error, a tool that fails, and a request it can’t complete. Each event has its name, its time, a scrambled (hashed) form of your account ID, and at most the model, tool name or credit amount involved, or for a failure, the step and error code. It never includes your email address, page content, what you say, or the addresses of pages you visit. Nothing is recorded when you use your own server. When you click an install link on this website, our server records which page it was on, with a random ID for that click and no cookie, before sending you on to the Chrome Web Store.
• Operational logs. Our server logs technical events such as connection states, tool names, timings and error codes. It does not log transcripts, page content, screenshots, audio or keys.
• On your device. Your settings, the page changes you save and, with page history on, each page's conversation memory (recent conversation text and a short summary of earlier conversations) are kept in Chrome's extension storage on your computer. Older memory is removed automatically to save space. Uninstalling the extension removes them.

Who processes data

OpenAI provides the voice and reasoning models and processes audio, page content, screenshots and conversation text under its API data policies. Clerk provides accounts and sign-in. Stripe processes payments. Vercel hosts our server and this website, Upstash stores credit balances and shared links, and PostHog stores the product events above so we can see where new users get stuck. We do not sell your data or use it for advertising.

Your choices

Using your own server. If you run npx askgloss with your own OpenAI API key, the extension sends everything to that server on your computer instead of ours, and it goes from there to OpenAI. We don't receive your requests or your key, and nothing uses credits. The key stays on your computer, saved only if you choose to.

Gloss only runs a conversation after you start it from the toolbar icon, and you can end it at any time. You can turn off page history in Settings, which also stops conversation memory; delete a page's saved changes and memory there; clear one page's memory with Forget in the conversation panel; or sign out. To delete your account and credit balance, contact us.

Contact

Questions or deletion requests: the support email on our Chrome Web Store listing.