Last updated: 1 June 2026

This Privacy Policy explains how Gloaty (“the app”, “we”, “us”) handles your information. Gloaty is a small app for sharing daily word‑game results within private friend groups. It is operated by Jay McCormack. If you have any questions, contact j@jaym.cc.

Information we collect

Account information. When you create an account we store your email address, a securely hashed version of your password (we never store your password in plain text), and a display name you choose.

Game results. When you share a screenshot of your finished word‑game board, the image is uploaded to our server and sent to a third‑party AI service to read the grid (see Sharing below). We store the parsed result — the colour grid, the number of guesses, and whether you solved it — together with the puzzle date and number. We may optionally retain the submitted screenshot image associated with your result.

Social activity. We store the groups you create or join, your membership in them, the chat messages and emoji reactions you post within a group, and who shared a result on a given day.

Device information. If you enable notifications, we store a push notification token for your device so we can send you alerts (for example, when everyone in your group has played).

We do not use third‑party advertising, and we do not include analytics or tracking SDKs that profile you across other apps or websites.

How we use your information

  • To provide the core service: creating your account, reading your shared results, and showing your group’s leaderboard, history, and chat.
  • To send notifications you have opted into (such as group activity and results).
  • To generate the puzzle’s answer and a short definition.
  • To maintain, secure, and improve the app.

Sharing your information

We share information only with service providers that make the app work:

  • Google (Gemini API) and Fireworks AI — your submitted screenshot image is sent to one of these AI vision services to automatically read your result. They process the image to return the grid; we do not authorise them to use it to train their models beyond what their API terms permit.
  • Fireworks AI — also used to generate the short word definition shown after a puzzle unlocks (no personal data is sent for this).
  • Expo (push notifications) — receives your push token and message content in order to deliver notifications to your device.
  • Railway — our hosting provider, which stores the app’s database and runs its servers.

We also fetch the official puzzle answer from a public New York Times endpoint; only the puzzle date is sent — no personal information about you is shared with the New York Times.

We do not sell your personal information. We only share it with other people in the groups you choose to join (they can see your display name, results, chat messages, and reactions).

Data retention

We keep your account and game data for as long as your account exists. You can request deletion of your account and associated data at any time by emailing j@jaym.cc, and we will delete it within a reasonable period.

Children’s privacy

Gloaty is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will remove it.

Security

Passwords are hashed, data is transmitted over encrypted connections (HTTPS), and access to the database is restricted. No method of transmission or storage is perfectly secure, but we take reasonable measures to protect your information.

Your choices

  • Access or delete your data — email j@jaym.cc.
  • Notifications — turn push notifications off at any time in your device settings.
  • Leave a group — you can leave any group from within the app.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected by the “Last updated” date above.

Contact

Questions about this policy or your data: j@jaym.cc.