Privacy Policy
Last updated: 17 October 2026
Storeglow is built so that as little personal data as possible leaves your device. Your projects, screenshots and designs stay in your browser. We do not use analytics, advertising or tracking cookies.
1. Who is responsible
Marius Gehler, Blissestraße 56, 10713 Berlin, Germany Email: [email protected]
2. Visiting the website
Our website and editor are hosted by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). When you open a page, your browser sends technical data that every web server receives: IP address, date and time, the page requested, referrer and browser type. Cloudflare uses it to deliver the site and protect it from attacks and keeps it only briefly. Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-US Data Privacy Framework; we have a data processing agreement with Cloudflare.
Fonts are served from our own server. Your browser does not contact Google or any other font provider.
3. Your projects stay on your device
Projects, screenshots, uploaded fonts and settings are stored in your browser (IndexedDB and local storage) and are not sent to us. Images are rendered and exported in your browser. If you clear your browser data, they are gone, so keep backups by saving project files from the projects menu.
4. Account and sign-in
You can design without an account. To export, you create a free account with your email address. We store your email address, a user ID, your plan, when a pass ends and how many free exports you used. Legal basis: providing the service you signed up for (Art. 6(1)(b) GDPR).
- Supabase (Supabase, Inc., USA) runs our sign-in and database on servers in Frankfurt, Germany. Data processing agreement in place; EU standard contractual clauses for any access from outside the EU.
- Resend (Resend, Inc., USA) sends the sign-in emails from servers in the EU (Ireland). It processes your email address and the email content. Data processing agreement and EU standard contractual clauses in place.
Your browser keeps a sign-in token in local storage so you stay signed in. This is strictly necessary for the service you asked for (§ 25(2) no. 2 TDDDG); no consent is needed.
We only email you about your account (sign-in links, receipts, important changes). We will not send marketing emails without your separate consent.
5. Payments
Purchases are handled by our reseller Paddle.com Market Limited (Judd House, 18–29 Mora Street, London EC1V 8BT, United Kingdom), the merchant of record for all orders. Paddle collects your payment and billing details directly, as an independent controller under its own privacy notice (paddle.com/legal/privacy). The checkout window loads from Paddle's servers only when you open it. We receive your email address, what you bought, your Paddle customer and subscription IDs and the subscription status, so we can unlock your plan. Legal basis: Art. 6(1)(b) GDPR; billing records are kept as tax law requires (Art. 6(1)(c) GDPR). The UK has an EU adequacy decision.
6. Features that contact other services when you use them
These run only after you start them:
- Import from the App Store. When you paste an App Store link or search for an app, your browser asks Apple's public iTunes Search API and loads the app's icon and screenshots from Apple's servers (Apple Inc., USA). Apple receives your IP address and the search.
- Editable captions from finished screenshots (text recognition). The first time you use it, your browser downloads the open-source text recognition engine from the jsDelivr CDN. jsDelivr receives your IP address. Your images are read in your browser and are not uploaded.
Legal basis: carrying out the action you requested (Art. 6(1)(b) GDPR).
7. How long we keep data
Account data: until you delete your account (email [email protected]). Billing records: for the periods tax law requires (usually 10 years, kept by Paddle and us). Server logs: a few days at most.
8. Your rights
You can ask us for access to your data (Art. 15 GDPR), correction (Art. 16), deletion (Art. 17), restriction (Art. 18), a copy in a portable format (Art. 20), and you can object to processing based on legitimate interests (Art. 21). Write to [email protected].
You can also complain to a data protection authority, for example the one in your country or ours: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, Germany.
9. No automated decisions
We do not make decisions about you based solely on automated processing.
10. Changes
We update this policy when our services change. The date at the top shows the current version.