← Gloslyn

Privacy Policy

Last updated: 2026-09-08

Related: Terms of Service · Support

1. Who operates Gloslyn

Gloslyn is operated by the operator of Gloslyn (beta). Contact for privacy requests: support@example.com.

This policy describes beta product behavior as implemented in software. It is not a substitute for counsel-reviewed corporate disclosures after entity details are finalized.

2. What Gloslyn does

Gloslyn is a Discord application and web dashboard that helps multilingual communities configure channel language pairs, translate messages (and optionally voice features when enabled), manage glossaries and approved translation memory, track usage, and (when configured) bill through Stripe.

3. Data categories we process

We distinguish how data is handled in the running system:

  • Discord account data (STORED): Discord user ID; display name/username; email when Discord returns it under OAuth scopes; avatar URL reference.
  • Discord OAuth (PROCESSED then session STORED): OAuth authorization code exchange; short-lived OAuth state/PKCE verifier; signed session cookie; server-side session row with expiry, user agent, and hashed IP (raw IP is not stored).
  • Server / channel / message identifiers (STORED): guild/server IDs, channel IDs, message IDs needed to map translations and configuration.
  • Message content: required transiently to perform translation. Default product configuration sets STORE_MESSAGE_CONTENT=false, and durable translation mapping tables do not store original message bodies. However, message text may still appear in operational job payloads and translation cache entries while those records exist, and short observed terms may create glossary suggestions for admin approval.
  • Voice audio / transcription: defaults STORE_VOICE_AUDIO=false and TRANSCRIPTION_RETENTION_DAYS=0. When voice features are enabled, audio may be processed by speech providers; PCM may exist briefly in job payloads. Voice features remain gated off in the controlled text beta.
  • Glossary / translation memory (STORED): terms and approved corrections you or workspace admins save; suggestions are not auto-approved.
  • Usage and cost metrics (STORED): character/unit counts, provider codes, estimated costs, correlation IDs — not full message bodies in the usage ledger.
  • Billing (OPTIONAL / PROVIDER-SHARED when enabled): Stripe customer IDs, subscription status, invoice metadata. Email may be shared with Stripe to create a customer.
  • Support assistant metrics (STORED): category, confidence, escalation flags, helpfulness — not full free-text questions in the metrics table.
  • Ephemeral channel context (NOT STORED in database): short in-memory window used only to disambiguate translations; may be sent to a provider as temporary context.
  • Analytics SDKs: no third-party product analytics SDK is integrated in the current codebase. Optional monitoring DSN env vars exist but are unused unless configured later.

4. Discord OAuth data

Login uses Discord OAuth with scopes needed for identity and server listing (including identify, email, and guilds as configured). We use this to authenticate admins, create/link workspaces, and show servers they can manage. We do not use Discord user tokens as bot credentials; the bot uses a dedicated bot token.

5. Translation processing and providers

To translate text, Gloslyn sends the message text (after protecting mentions/URLs/code where applicable), language pair, glossary constraints, and optional short context to the configured provider(s): DeepL, LibreTranslate, and/or OpenAI when enabled. Those providers process data under their own terms and privacy policies. Disable or avoid paid AI providers if your community policy forbids that sharing.

6. Cookies and sessions

We use an HTTP-only session cookie to keep dashboard users signed in, plus short-lived OAuth state cookies during login. These are required for authentication, not advertising.

7. Hosting and subprocessors

Application hosting and managed PostgreSQL are intended to run on Render (or an equivalent cloud host configured by the operator). Translation may be processed by configured providers such as DeepL, LibreTranslate, and/or OpenAI when enabled. Paid subscriptions are processed by Stripe when billing is configured.

8. Retention

  • Sessions expire and can be invalidated on logout.
  • Usage/billing records may be retained for operational, fraud-prevention, and accounting needs.
  • Job payloads and caches are operational artifacts; operators should apply retention/purge policies appropriate to their deployment.
  • Default flags favor not retaining message bodies or voice audio in dedicated content tables.

9. Security

Access to tenant data is constrained by workspace membership checks and server-side authorization. Secrets (bot token, Stripe keys, session secrets) are environment-configured and must not be committed to source control. No security measure is perfect; report issues to support@example.com.

10. Your rights and deletion requests

Depending on your location, you may have rights to access, correct, or delete personal data we hold. For beta, deletion is handled manually via support:

  1. Email support@example.com from the Discord-linked account email when possible.
  2. Identify the workspace/server and the scope (account, guild configuration, glossary, memory).
  3. We will remove or anonymize deletable operational data. Invoice/accounting records required by law may be retained for the legally required period.

Removing the bot from a Discord server stops new processing for that guild but does not by itself cancel a paid Stripe subscription or delete historical billing records.

See also Support → Request deletion.

11. Children and Discord's audience

Gloslyn is intended for Discord server administrators configuring community tools. It is not directed at children. You must comply with Discord's Terms and age requirements for your servers.

12. International processing

Depending on hosting and provider configuration, processing may occur in regions where Render, Stripe, Discord, or translation providers operate. If you require a specific region, configure providers and hosting accordingly before production use.

13. Changes

We may update this policy as the product matures. The “Last updated” date will change. Material beta-to-production changes should be communicated to workspace admins when practicable.

14. Contact

Privacy contact: support@example.com