On this page
The short version
- Your studio owns your galleries and decides who sees them. We host and deliver them for the studio.
- We collect only what Glowsake needs: your email to sign in, an optional name, a notification token if you allow notifications, and simple counts of how links are opened.
- We do not sell or share your personal information, show ads, or track you across other apps and websites.
- No face recognition or biometric analysis.
- Delete your app account any time in Settings. For photos, favorites and comments, ask your studio, or ask us and we will pass it on.
This summary helps you find your way. The full policy below is what applies.
Who we are
Glowsake is a service of Semuko, Co., a California corporation ("Semuko", "we", "us"), 1776 Almaden Rd, #1705, San Jose, CA 95152, USA.
This policy covers the Glowsake app for iPhone and Android, glowsake.com, glowsake.app, studio sites at *.glowsake.com (and studio domains connected to Glowsake), and short links at glsk.to. Together we call these "Glowsake".
Photographers, event studios and other businesses ("studios") use Semuko's software to create the galleries you open in Glowsake. Their own use of Semuko is covered by Semuko's Privacy Policy, not this one.
Your studio and us: who is responsible for what
Two different organizations handle your information in Glowsake, and it helps to know which one to ask.
Your studio is responsible for
- The photos and videos in your galleries, and who may see or download them.
- Your relationship with them: bookings, contracts, invoices, orders and messages.
- What they know about you in a gallery: your name and email, favorites, comments, downloads and visits.
- Any marketing list they invite you to join.
For all of this the studio is the "business" or "controller". We host and deliver it for them as their "service provider" or "processor", following their instructions and our agreement with them. Their privacy policy applies, so please ask them first.
We are responsible for
- Your Glowsake app account: your sign-in email, the name you add, your devices and notification settings.
- The Glowsake websites and short links themselves.
- Glowsake's own counts of how links and galleries are opened.
- Messages you send to Glowsake support.
For these we are the "business" or "controller", and this policy explains what we do.
What we collect
We collect only what Glowsake needs to work.
| What | When | Why |
|---|---|---|
| Email address | When you sign in with an emailed 6-digit code or with Google. | To sign you in and to show you the galleries studios have shared with that email. |
| Name (optional) | If you type it in Settings, or Google provides it when you sign in with Google. | Shown to the studio next to your favorites and comments. |
| Sign-in requests | When you ask for a sign-in code: your email, the time and your IP address. | To keep accounts secure and stop abuse. Codes expire after 15 minutes and are stored only in hashed form. These records are deleted after 90 days. |
| Device and notification token | Only if you allow notifications: a push token, iOS or Android, and the app version. | To tell you when a studio shares a gallery or adds photos. |
| App sign-in sessions | While you are signed in: iOS or Android, app version, last used. | To keep you signed in and to sign a device out. |
| Favorites, comments and downloads | When you use a gallery. | Delivered to the studio that owns the gallery. This is the studio’s information. |
| Screenshot Shield events | Only in galleries where the studio turned on Screenshot Shield: that a screenshot was taken or a screen recording started, which gallery, when, and iOS or Android. | Reported to that studio. See Screenshot Shield. |
| Link and gallery-open counts | When a Glowsake link, code or QR code is opened: the kind of event, iOS or Android, the time and the link. | Counts for the studio and for us. These counts are not linked to you (see below). |
| "Send my gallery link to me" | If you ask a link page to email or text you the gallery link. | To send that one message. The address or number itself is not stored (see below). |
| Support messages | If you write to us: your name, email and message. | To help you and keep a record of the conversation. |
Counts that are not linked to you
When a link, code or QR code is opened we record what happened (for example "link page viewed" or "gallery opened in the app"), iOS or Android, and the time. We do not store your IP address, device ID, browser details, referrer or account with these counts. To avoid counting the same visit twice, our server keeps a short-lived, one-way hash of your IP address and browser in memory for 30 minutes. It is never written to our database.
"Send my gallery link to me"
The email address or phone number you type is used once, to send that single message, and is not stored. To enforce sending limits and prevent abuse we keep a keyed one-way hash (HMAC) of the address and of your IP address for 30 days, then delete it. Text messages are sent through the studio's own text-message provider, only after you tick the consent box, and never to a number that has replied STOP to that studio.
Android install hint
If you install the Android app from a Glowsake link, the app reads Google Play's install referrer once, on first launch. It contains the gallery link you tapped, so the app can offer to open it. We resolve it like a typed code and do not store it with any identifier. iPhone has no equivalent and we do not try one.
Websites
Like any website, our servers process your IP address and browser information to deliver pages, apply rate limits and keep Glowsake secure.
What we do not collect
Your location, contacts, the contents of your photo library (the app can only add photos you choose to save), your clipboard, advertising identifiers, your activity in other apps and websites, health information, payment card details, or crash diagnostics.
Screenshot Shield
Some studios turn on Screenshot Shield for their galleries. When a gallery uses it, the app tells you before it opens.
- Android: screenshots and screen recordings are blocked in that gallery.
- iPhone: screen recording is blocked. iPhone does not let apps block screenshots, so when one is taken we tell the studio that it happened, in which gallery, and when.
- After 3 screenshots in a protected gallery, or any screen recording, that gallery may pause for your account until the studio unlocks it. Other galleries are not affected.
A pause or screenshot count stays in place if you delete and re-create your app account. To do that without keeping your email, we keep only a keyed one-way hash of your email for that one gallery, with the pause or count (see How long we keep it).
No app can stop someone photographing a screen with another camera, so Screenshot Shield is a deterrent, not a guarantee.
How we use information
- To provide Glowsake: sign you in, show your galleries, deliver favorites and comments to studios, send the notifications you allowed and the link you asked for.
- To keep Glowsake safe: prevent abuse, enforce limits, investigate problems and protect studios' galleries.
- To give studios and us simple, non-identifying counts of how links and galleries are opened, so we can improve Glowsake.
- To answer support requests and to meet legal obligations.
We do not use your information for advertising, we do not build profiles about you, and we do not make automated decisions that have legal or similarly significant effects on you.
Legal bases (EEA and UK). We rely on contract (to provide the service you asked for), legitimate interests (security, abuse prevention and non-identifying counts), consent (notifications, text messages, and any studio marketing you opt into, which you can withdraw at any time) and legal obligations.
No face recognition or biometrics
Glowsake does not use face recognition, face grouping or any other biometric analysis on your photos or on you. We do not create or store faceprints or other biometric identifiers.
If you unlock a private gallery with Face ID, Touch ID or your device passcode, your phone does the check. The app only learns whether it succeeded, and nothing about your face or fingerprint reaches us.
Children and minors
Glowsake accounts are not meant for children. You must be at least 13 years old (or the minimum age in your country, if higher) to create a Glowsake app account. If you are under 18, please use Glowsake with a parent's or guardian's permission. We do not knowingly collect personal information from children under 13. If you believe a child has given us personal information, write to helpme@semuko.com and we will delete it.
Galleries often include photos of children, for example from a family session or a school event, shared by a studio with a parent or guardian. Those photos belong to the studio's gallery and the studio decides who can see them. Galleries a studio marks as private stay blurred until opened, are hidden in the app switcher, and never appear on studio sites. A parent or guardian can ask the studio to remove photos of their child at any time, and we will help forward that request (see Your choices and rights).
Cookies and storage on your device
We use only what Glowsake needs to work. There are no advertising or analytics cookies, pixels or third-party trackers on glowsake.com, glowsake.app, glsk.to or studio sites.
| What | Where | Why and how long |
|---|---|---|
| Gallery session cookie | Gallery pages, after you enter a gallery password or your email. | Keeps you in that gallery. Signed, not readable by scripts, one per gallery, up to 30 days. |
| Browser storage | Gallery and studio pages in your browser. | Remembers small choices on your device, such as the name and email you typed (to fill them in next time), a dismissed banner or notice, and which list you were viewing. You can clear it in your browser settings. |
| App storage | The Glowsake app on your phone. | Keeps you signed in (in the phone’s secure storage), your settings, and galleries you chose to keep offline. Removed when you sign out, delete the copies, or delete the app. |
When you pay a studio, you do so on the studio's checkout pages and with its payment provider, which may use its own cookies under its own policy.
Global Privacy Control. We do not sell or share personal information, so there is nothing to opt out of. If your browser sends a Global Privacy Control signal, we treat it as a request to opt out anyway.
How long we keep it
| Information | How long |
|---|---|
| Your app account (email, name, sessions, devices, notification history) | Until you delete it. "Delete my app account" removes it right away, along with your sessions, devices, push tokens and notification history. |
| Sign-in codes | Expire after 15 minutes. Request records (email, time and IP address) are deleted after 90 days. |
| Screenshot Shield pause or strikes after you delete your app account | Only a keyed one-way hash of your email for that gallery, with the pause or screenshot count. A pause stays until the studio unlocks it or deletes the gallery; a count without a pause is deleted after 90 days. |
| Link and gallery-open counts | 400 days, then deleted. |
| "Send my gallery link" hashes | 30 days, then deleted. |
| Duplicate-visit hash (in memory only) | 30 minutes. |
| Galleries, favorites, comments, downloads and Screenshot Shield events | As long as the studio keeps them. They stay with the studio’s gallery after you delete your app account, no longer linked to that account. If a studio closes its Semuko account, Semuko deletes its data within the period set in Semuko’s terms (30 days after the account ends). |
| Support messages | As long as needed to help you and keep a record of the conversation. |
We may keep information longer if the law requires it, or to resolve disputes and enforce our terms.
Security
Glowsake uses HTTPS everywhere. Sign-in codes are short-lived, limited to a few attempts and stored only as hashes. Gallery access is checked on every request, private galleries are blurred until opened, and each studio's galleries are kept apart from every other studio's. We limit who at Semuko can access personal information.
No method of storing or sending information is completely secure. If we learn of a breach that affects you, we will tell you and the affected studios as the law requires.
Your choices and rights
In the app
- Change or remove your name in Settings.
- Turn notifications off in Settings, or in your phone's settings.
- Sign out, or choose Settings > Delete my app account to delete your account.
Requests to us
You can ask us to access, correct, delete or give you a copy of the personal information we hold about you as Glowsake. Email helpme@semuko.com or use Glowsake support. Your Glowsake account is your email address, so we confirm requests by sending a code to that address. We answer within the time the law sets (for example 45 days under California law, or one month in the EEA and UK) and will tell you if we need longer.
Requests about photos and gallery information
Your studio controls the photos, favorites, comments and other gallery information, so the fastest route is to ask the studio directly; their contact details are on their gallery and their site. You can also send the request to us. We will find the studios that hold gallery information for the email address you confirm, forward your request to each of them within 10 business days, and tell you which studios we contacted. The studio decides and answers; we help them carry it out.
U.S. state privacy rights
Depending on where you live (including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other states with privacy laws), you may have the right to know and access the personal information we hold, to correct it, to delete it, to get a portable copy, and to opt out of its sale, sharing, targeted advertising or profiling. We do none of those last four. You may use an authorized agent; we will ask the agent for proof of authority and may ask you to confirm your request. We will not treat you differently for using your rights. If we decline a request you can appeal by replying to our answer with "Appeal", and we will respond within the time the law sets. If an appeal is denied you may contact your state attorney general.
Notice at collection (California)
| Category | Examples | Purpose |
|---|---|---|
| Identifiers | Email address, optional name, push token, IP address with sign-in requests. | Providing Glowsake, security. |
| Internet or other electronic network activity | Screenshot Shield events for protected galleries; app session details. | Providing Glowsake to you and the studio, security. |
| Sensitive personal information | Account log-in (your email together with a one-time code). | Only to sign you in. Not used to infer anything about you. |
We do not sell or share any category of personal information, and we have not done so in the past 12 months. Retention is described in How long we keep it. We do not disclose personal information to third parties for their own direct marketing.
EEA, UK and Switzerland
You also have the right to object to or restrict our processing, to withdraw consent at any time, and to complain to your local data protection authority. Glowsake is run from the United States and your information is stored there. Where the law requires, we use safeguards such as the European Commission's Standard Contractual Clauses and the UK Addendum for these transfers.
Messages we send, and studio marketing
Glowsake sends sign-in codes, the gallery link you ask for, and notifications you allowed. Glowsake does not send you marketing.
When you sign in with Google from a studio's gallery, you may see an unticked box to get updates from that studio. If you tick it, the studio receives your consent and may email you. That list belongs to the studio, and you can unsubscribe through the link in their emails or by asking them.
Changes to this policy
If we change this policy we will update the effective date above. If a change is significant we will tell you in the app or by email before it takes effect.
Contact us
Semuko, Co.Attn: Privacy (Glowsake)
1776 Almaden Rd, #1705
San Jose, CA 95152, USA
helpme@semuko.com
You can also reach us through Glowsake support.