Privacy Policy
1. Who is responsible for your data
Fluxward GmbH, In Gerichhausen 23a, 41844 Wegberg, Germany, hello@fluxward.com. Privacy contact: hello@fluxward.com.
2. In short
- Glim works without an account. Your progress then stays on your iPhone only.
- With an account, we back up your progress on our server in Germany (Hetzner Online GmbH).
- We do not sell data, show no ads and do not track you across other apps.
- You can delete your account in the app at any time: You → Account → Delete account.
3. What stays on your iPhone
Your progress, settings, your learning profile from the start (age group, goals, prior knowledge, interests, everyday life, daily goal, language) and the time for your reminder. Your iPhone schedules the reminder itself. We send nothing over the network for it.
4. What we store if you create an account
You decide whether to create an account. Without one, you can use the learning features available on your iPhone. An account needs a confirmed sign-in. Without it, we cannot sync your progress with an account. The AI chat needs an account, your age group of 16 or older and your consent. You can withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing before you withdrew it.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Email address for email sign-in, Apple or Google ID, check value of the verified email address for email or Google sign-in | Signing in, finding your account again | Contract, Art. 6(1)(b) GDPR | Until you delete your account |
| Account ID, random device ID | Syncing your progress between devices | Contract | Until you delete your account |
| Progress: lessons, results, streak, sparks, plus each entry's clock offset from UTC in minutes (such as +60), without location or a time zone name | Saving your progress; your day starts at your midnight | Contract | Until you delete your account; up to 50,000 entries |
| Learning profile from the start | Showing examples that fit you | Contract | Until you delete your account |
| Time of your last sync and your last chat message | Counting how many accounts were active in the last 7 days; helping with questions about your account | Legitimate interest, Art. 6(1)(f) GDPR | Until you delete your account; the 7-day reporting period is not a deletion deadline |
| Confirmed Apple transaction IDs, product, term and purchase status | Unlocking Plus | Contract | Until you delete your account |
| Check values of your session and used refresh keys | Keeping sign-in secure | Contract | The normal refresh period is 60 days. We delete expired entries during hourly cleanup; we delete them immediately when you delete your account. |
| AI consent decisions with text version and time | Recording your decision | Legal obligation, Art. 6(1)(c) with Art. 7(1) GDPR | Until you delete your account; up to 50,000 entries as part of the event history |
| Reports with the accounts involved, reason, time and handling status; block between the pair | Reviewing reported nicknames; preventing the pair from connecting again | Legitimate interest in safe use, Art. 6(1)(f) GDPR | Until either account is deleted; the pair stays blocked after the report is handled |
| Technical game logs with event ID, rejection reason and time, without user content | Finding errors and invalid game actions | Legitimate interest in reliable gameplay, Art. 6(1)(f) GDPR | Until you delete your account; up to 10,000 entries per account |
| Administration log with action, time and account IDs involved | Tracing changes; preventing misuse | Legitimate interest in secure administration, Art. 6(1)(f) GDPR | 365 days, then deletion during hourly cleanup. When you delete your account, we replace its IDs with placeholders. |
| Encrypted credentials for your Apple link | Revoking the link when you delete your account | Contract; for retries, legitimate interest in carrying out your deletion request, Art. 6(1)(f) GDPR | While your account exists. If revoking your Apple link fails, we keep the credentials needed for a retry in encrypted form. We delete them after successful revocation, otherwise during hourly cleanup after 90 days. |
We do not ask Apple for your name. With Google, we receive your Google ID and your verified email address. We store the ID and a check value of the address. For Plus, we store confirmed Apple transaction IDs, product, term and purchase status. We delete this account data when you delete your account. Apple handles the payment. We see no payment data.
4a. Glim in chat (AI companion)
- Before your first question leaves your iPhone, Glim asks for your permission. You can withdraw it at any time: You → Legal → Withdraw AI consent. Glim then also deletes the conversation on your iPhone.
- Glim in chat is an AI, not a person. Glim says so before the first conversation. Every answer is labeled as an AI answer.
- Your question and the latest messages of the conversation go through our server to an AI model at Microsoft Foundry. Our
Microsoft resource is located in Germany West Central. Your questions are processed in the EU. The AI answers, we show the answer.
- With every question, Glim sends two technical details to our server: the country from your iPhone settings (such as DE), so
that Glim names the right help numbers in an emergency, and your clock's offset from UTC, so that your daily allowance starts again at your midnight. Neither goes to the AI, and neither is stored.
- The app stores the conversation on your iPhone. Depending on your settings, app data may be included in a device backup. Our server only stores how many messages you sent (for the limit of your
subscription) and when you last wrote (see 4).
- Your questions are not used for training. We do not store them after the answer. Microsoft checks requests automatically for abuse. If abuse is suspected, Microsoft may store questions and answers. Authorized Microsoft staff may then review them.
- We try to detect and replace email addresses, phone numbers and IBANs. Detection can miss something. Do not write confidential data in the chat. If Glim detects signs
of a crisis in your message, the message does not go to the AI. Glim answers itself with help numbers. The detection can miss signs. For that case, the AI is instructed not to give advice and to point to help.
- Under 16, the chat is off.
- Legal basis: your consent, Art. 6(1)(a) GDPR.
4b. Friends and "Real or AI?"
- Friends are available only with an account and from 16. You connect only through a code that you share yourself. We do not
read your contacts.
- Your friends see only: your nickname, whether you learned today, your shared streak and your result in the
weekly round. Nothing more.
- For this we store your nickname, friendships, invite codes (only as a hash value) and your weekly results. Legal
basis: contract, Art. 6(1)(b) GDPR.
- You can remove or report friends at any time. A report ends the friendship. We review reported nicknames.
- The weekly round works without an account. Your result then stays on your iPhone.
4c. When you write to us
Via You → Help → Contact and via "Report answer" in the chat, Glim opens a prepared email in your mail app. For Contact, it contains the Glim version and the language. For "Report answer", it contains the reason and the reported answer. You see everything before sending. We use the email only to answer you and to fix errors, and we delete it once the matter is closed. Legal basis: legitimate interest, Art. 6(1)(f) GDPR.
4d. What happens only on your iPhone
Read aloud uses your iPhone's voice, without network. The request for a rating is shown by Apple. We do not learn whether or how you rate.
4e. Connection data, also without an account
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Technical logs (time, path, status, duration; for connection errors also the IP address) | Operation and troubleshooting, also when loading new learning content without an account | Legitimate interest in safe, reliable operation, Art. 6(1)(f) GDPR | Logs have a fixed size limit. New entries overwrite the oldest ones. |
| Derived check values of your IP address and email address | Protecting sign-in against mass attempts | Legitimate interest in secure sign-in, Art. 6(1)(f) GDPR | Normal sign-in limits apply for ten minutes. We delete expired entries during hourly cleanup. |
| Account-based rate counters | Preventing misuse of sync, chat, invitations and team codes | Legitimate interest in safe use, Art. 6(1)(f) GDPR | Until each limit expires, then deletion during hourly cleanup; when you delete your account, we delete its rate counters. |
To protect sign-in, we use derived check values of your IP address and email address. Normal sign-in limits apply for ten minutes. We delete expired entries during hourly cleanup.
5. Who processes data for us
- Brevo (Sendinblue SAS, France) for sign-in codes, as a processor.
- Microsoft Ireland Operations Limited (Microsoft Foundry) for the AI model, as a processor. Place of processing see 4a.
- Hetzner Online GmbH, Germany, for our server (accounts, progress, content).
- Apple for sign-in, purchase and subscription. Apple's terms apply in addition.
- Google (Google Ireland Limited) only if you choose Sign in with Google. Google's terms apply in addition.
Our server is in Germany. The AI processes your questions in the EU. Apple and Google have their headquarters in the USA. If you sign in with them or buy through Apple, they may also process data there. Their own privacy rules apply.
6. How long we store data
The periods in sections 4 and 4e apply to each kind of data. If you delete your account, we delete your account and progress immediately. Section 4 explains the exception for pending Apple revocation requests. We keep backups for 14 days. After that the data is deleted there as well.
7. Age
Glim is for ages 13 and up. From 13 to 15, you use the learning features without an account. Your personal progress stays on your iPhone. The app connects to our server to load new learning content. We process technically necessary connection data for this. Chat and friends are available from 16. If you are under 18, you need your parents' consent for a subscription.
8. Your rights
You have the right to access, rectification, erasure, restriction, data portability and objection. You can get your progress and account data as a file under My data. For a full access request, write to hello@fluxward.com. You can delete your account under You → Account → Delete account. You can complain to a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Germany) or the authority in your country.
9. Changes
If this policy changes, we tell you in the app. Last updated: 14 November 2026.