Privacy Policy

1. Who is responsible for your data

The controller of the personal data described here is Glixy LLC, a limited liability company formed under the laws of the State of Delaware, United States.

For anything about your data or your rights over it, write to privacy@glixy.ai. That address covers access, correction, deletion, portability, objection and restriction requests, and everything else in section 8. For an image that depicts you, abuse@glixy.ai is faster, and section 9 sets out what happens. For accounts, credits and billing, support@glixy.ai. All three are read by a person, and we will provide the details of our registered agent for service of process on request.

We have not appointed a Data Protection Officer, and we do not believe one is required: we are a small operation, we do not monitor anyone systematically at scale, and processing personal data is not our core activity — it is a 24-hour side effect of doing a job you asked for. Writing to privacy@glixy.ai reaches the people who actually run the service.

2. What we collect

Your account

An e-mail address and a password, held by our authentication provider. The password is stored as a hash; we never see it. We ask for nothing else — no name, no address, no phone number, no date of birth.

The files you upload, and the results

The face photo, the photo or video you want it put into, and the file we produce. A face is biometric information about a real person, and in several jurisdictions it is a special category of personal data. We treat it as one: it exists only for as long as it takes to do the job you asked for, and then it is deleted.

A record of each run

The file names you uploaded, whether the target was a photo or a video, its duration and frame size as your browser measured them, the options you chose, when the run started, how long it took, and whether it succeeded. This record is what draws your history page. It is deleted along with the media.

Payments

Which pack you bought, the price, when it was paid, and the reference the payment provider gave the transaction. We hold no card details, because there are none — settlement is in cryptocurrency. We do not receive your wallet address; that stays between you and the payment provider, unless you send it to us yourself to ask for a refund.

Technical data

Our network provider processes your IP address to route and to protect the service against abuse, as any network provider must. We keep aggregate, cookieless analytics for the marketing site — page views and referrers, with no identifier that follows you between sites or between visits.

3. What we do with it

• Run the swap you asked for, and let you download the result.
• Show you your own history until it expires.
• Keep your credit balance correct, and keep an accurate record of money paid.
• Protect the service from abuse and from being used to run up costs nobody agreed to.

That is the complete list. We do not profile you, we do not advertise to you, we do not sell anything to anyone, and there is no third party receiving your files for their own purposes.

We do not train models on your files. The models Glixy uses are fixed and third-party; they are shipped with the service and learn nothing from your runs.

4. The legal bases

Where the GDPR or a similar law applies: running the service and taking payment are the performance of our contract with you (Article 6(1)(b)); keeping records of payments is a legal obligation (Article 6(1)(c)); protecting the service against abuse is our legitimate interest (Article 6(1)(f)).

Face images are the sensitive part, and we treat them as such even where we may not have to. Article 9 of the GDPR restricts biometric data processed for the purpose of uniquely identifying someone. That is not what Glixy does — it alters a face, it does not recognise one, and we never build or store a template that could match a face against anything. On that reading Article 9 is not engaged at all.

We would rather not rest your privacy on a reading, so we do not stop there. Processing your own uploads is necessary to perform the contract you entered into (Article 6(1)(b)) — you asked for a face to be swapped, and swapping it is the whole of what we do with the file. On top of that we publish, in section 5 below, a specific written schedule for how long face images are held and when they are destroyed, and we hold to it in 24 hours. Laws that define biometric data more broadly than the GDPR — the Illinois Biometric Information Privacy Act among them — ask for exactly that published schedule, and you are reading it. You can end the processing at any moment by deleting the file or the account, and within a day there is nothing left to end.

The face has to be one you are entitled to upload. Where you upload someone else's face, you are telling us you have their agreement, and as between the two of us that agreement is your responsibility to hold — see the terms of service. If someone else's face reached us without their agreement, section 9 below is the route to getting it dealt with, and it does not require you to have an account.

5. How long we keep it

• Uploads and results: 24 hours. Two independent mechanisms enforce this. The storage bucket has a lifecycle rule that deletes objects by age, and the app sweeps anything past its expiry whenever you open your history — the second exists because the first runs only about once a day, which on its own would mean "between 24 and 48 hours". You can also delete a run, a single file, or everything, from the app at any moment.
• The record of a run: deleted with the media, in the same sweep.
• Credit and payment records: kept. The financial ledger deliberately outlives the media it paid for — it holds no media and no file contents, only the fact that a run was paid for, which is what lets both of us reconstruct a purchase afterwards. Retained for 7 years, which is the period United States tax records must be capable of supporting.
• Your account: until you delete it. Deleting it from Settings removes the account, the history and the credit records, and cannot be undone.

6. Why we can make those promises — the technical part

These are properties of how Glixy is built rather than policies we follow, which is why they are stated specifically enough to check.

Your files never pass through our server

This is unusual and it is worth explaining plainly. In most upload forms, your file travels to the operator's server, which then stores it: the server sees every byte, and how carefully it handles them is a matter of trust.

Glixy does not work that way. When you pick a file, our server issues your browser a short-lived, single-purpose link and your browser uploads directly to the storage bucket. Downloads come back the same way. The server never receives, buffers, caches or logs the file itself — it moves nothing but small JSON messages describing the job. There is no copy on it to leak, and no configuration mistake on it that could expose your media.

The storage is not public, and its links expire

The bucket permits no anonymous access of any kind: it cannot be browsed, listed or read without a signature. Every link is signed, expires quickly, and is issued only to the account that owns the file. Download links are further routed through a short opaque token, so a link you copy does not reveal anything about the storage account behind it.

The database enforces the boundary, not the app

Every database statement Glixy makes is executed as you, under PostgreSQL row-level security. Our server does not hold an administrative database key — it holds only the same public configuration that is shipped to every browser. The practical effect: if the application had a bug that tried to show you someone else's history, the database would refuse it independently. The isolation does not depend on our code being correct.

Payment credentials are not in our systems

Checkout runs in isolated functions at our database provider, not on our application server, so the payment provider's key never enters the environment the app runs in. You pay on the provider's own hosted page. We never see a wallet, a card or a credential.

Cookieless analytics

We use Cloudflare Web Analytics on this marketing site. It sets no cookie, stores nothing in your browser, builds no cross-site identifier and does not fingerprint you; it reports page-level totals only. Glixy itself sets no cookies. The app keeps your login session in your browser's local storage, where it stays on your device and is cleared when you sign out. Our network provider may set a strictly necessary security cookie to distinguish automated traffic; it is not used for analytics or advertising.

7. Who else processes your data

Four providers, each doing one job, none of them receiving your data for their own purposes:

• Google Cloud — file storage and the GPU that runs the swap. Processing takes place in the United States.
• Supabase — accounts, the database holding your run history and credit records, and the checkout functions. Hosted in the United States (AWS us-east-1, Northern Virginia).
• Cloudflare — DNS, network protection and the cookieless analytics described above.
• NOWPayments — creating the invoice and confirming that it was paid. They see the payment; they never see your files, and no payment credential of theirs is ever held by us.

If you are in the EEA or the UK, your data is processed in the United States. That is true of Glixy itself, which is a US company, and of every provider above. For those transfers we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum) as incorporated into each provider's data processing agreement, and, where the provider is certified under it, the EU–US Data Privacy Framework. We will send you the relevant terms on request.

The 24-hour deletion is what limits this in practice. A transfer of something that no longer exists a day later is a materially smaller thing than a transfer into indefinite storage, and it is the reason we can describe this honestly in a paragraph instead of a schedule.

We will disclose data to a public authority only where we are legally required to. Given the 24-hour window, in most cases there is simply nothing left to disclose.

8. Your rights

Depending on where you live, you have the right to ask for a copy of your data, to have it corrected, to have it deleted, to restrict or object to processing, and to receive it in a portable form. Two of those you can exercise immediately and without asking us: your history is visible in the app, and Settings deletes your account and everything attached to it.

For anything else, write to privacy@glixy.ai. We respond within one month, which we may extend by up to two further months for a genuinely complex request — if we do, we will tell you why inside the first month. We do not charge for this.

You also have the right to complain to a data protection authority. There is no single "lead" authority for Glixy: we have no establishment in the European Union, so the one-stop-shop mechanism does not apply to us, and you should complain to the supervisory authority of the country you live in. In the United Kingdom that is the Information Commissioner's Office. We would rather you came to us first, but nothing requires you to.

9. If a result depicts you

If you believe a Glixy result depicts you and you did not agree to it, write to abuse@glixy.ai. You do not need an account, and you do not need to prove anything beyond a good-faith statement that it is you and that you did not agree to it.

Where the material is an intimate depiction published without your consent, we remove it and any identical copy within 48 hours of a valid report, and we close the account responsible. Because media is deleted after 24 hours we will usually no longer hold the file at all — but the account behind it can still be dealt with, and we act on credible reports either way. Section 10 of the terms of service sets out what to include.

10. Children

Glixy is not for children. See the minimum age in the terms. If we learn that an account belongs to someone under it, we close the account and delete the data.

11. Security

Everything is encrypted in transit, and files at rest are encrypted by the storage provider. The architecture above is the substance of the security story: the less data exists, and the fewer systems it passes through, the less there is to lose. No system is perfectly secure, and we will not pretend otherwise — but a 24-hour window means a breach cannot reach a back catalogue, because there isn't one.

12. Changes

If this policy changes materially we will say so in the app or by e-mail before the change takes effect. The date at the top always reflects the current version.