Glue Glue

Last updated: August 3, 2026

Privacy Policy

This Privacy Policy explains how Glue (gluestick.sh) collects, uses, and shares information when you use our website, accounts, and software.

Glue is operated by an individual (“Operator,” “we,” “us,” or “our”). There is currently no registered company behind this Service. We are committed to protecting your privacy and, where applicable, complying with the EU General Data Protection Regulation (GDPR) and similar data-protection laws.

1. Who is responsible

The Operator of gluestick.sh is the data controller for personal data collected through the Service, except where a third party (such as Paddle) acts as an independent controller for payment processing.

2. Information we collect

2.1 Account information

When you register or sign in, we collect information such as:

  • email address;
  • display name (if you provide one);
  • password (stored in hashed form);
  • email verification and password-reset tokens as needed to operate auth flows.

2.2 Subscription and billing

If you purchase Pro, checkout is handled by Paddle.com Market Limited (Merchant of Record). Paddle collects payment details, billing address, and tax information as needed to process the transaction. We receive limited customer and subscription metadata from Paddle (for example email, country, plan, and subscription status) so we can unlock Pro features on your Account. We do not store full payment card numbers.

2.3 Product and service data

Depending on which features you use, we may process:

  • Cloud backup and sync (Desktop Pro): package manifests, configuration snapshots, device registration metadata, and related synchronization data that you choose to upload so we can provide multi-device backup, restore, and sync features;
  • subscription entitlement and license status;
  • comments or other content you post on the website (for example blog comments);
  • support messages you send to us by email.

Snapshot and sync payloads are stored only to deliver those Pro features. You can stop using sync features at any time; Account deletion requests are handled as described in Section 9.

2.4 Technical logs

Our servers and hosting providers may automatically record technical data such as IP address, browser or client type, request timestamps, and error logs needed to operate and secure the Service.

2.5 Cookies and local storage

We use essential browser storage (for example local storage) to keep you signed in and to remember language preferences. We do not use advertising cookies.

3. How we use information

We use personal data to:

  • provide, maintain, and improve the Service;
  • authenticate users and protect accounts;
  • process subscriptions and deliver Pro features;
  • respond to support requests;
  • send transactional emails (verification, password reset, billing-related notices);
  • monitor abuse, security incidents, and service reliability;
  • comply with legal obligations.

4. Legal bases (GDPR)

Where the GDPR or similar laws apply, we process personal data only when we have a legal basis. Under GDPR Article 6, we rely on:

  • Contractual necessity (Art. 6(1)(b)): creating your Account, providing the Service, and fulfilling a subscription;
  • Legitimate interests (Art. 6(1)(f)): securing the Service, preventing abuse, diagnosing issues, and improving reliability — balanced against your rights and freedoms;
  • Consent (Art. 6(1)(a)): where we ask for it (you may withdraw consent at any time without affecting prior lawful processing);
  • Legal obligation (Art. 6(1)(c)): when we must retain or disclose information under applicable law.

5. Sharing of information

We do not sell your personal data. We share data only as needed with:

  • Paddle — payment processing, tax, and invoicing as Merchant of Record;
  • Hosting and infrastructure providers — to run gluestick.sh and related APIs;
  • Email delivery providers — to send transactional mail;
  • Authorities — when required by law or to protect rights and safety.

Open-source package downloads you initiate may contact third-party package mirrors or GitHub; those parties have their own policies.

6. International transfers

Our Service and vendors may process data in more than one country, including outside the European Economic Area (EEA). Where the GDPR applies and personal data is transferred outside the EEA, we use appropriate safeguards such as European Commission adequacy decisions or Standard Contractual Clauses (SCCs), or other lawful transfer mechanisms.

7. Retention

We keep Account and subscription records for as long as your Account is active and as needed for billing, support, security, and legal compliance. You may request deletion of your Account as described in Section 9; we will delete or anonymize personal data unless we must retain it (for example tax, dispute, or security records).

8. Security

We use reasonable technical and organizational measures to protect personal data. No method of transmission or storage is completely secure; please use a strong unique password and protect your devices.

9. Your rights (including GDPR)

Depending on where you live — and in particular if the GDPR applies to you as an EU/EEA (or UK) data subject — you have the following rights regarding your personal data:

  1. Right of access: request a copy of the personal data we hold about you.
  2. Right to rectification: request correction of inaccurate or incomplete personal data.
  3. Right to erasure (“right to be forgotten”): request deletion of your personal data in certain circumstances.
  4. Right to restrict processing: request that we limit how we use your personal data in certain circumstances.
  5. Right to object: object to processing based on legitimate interests (including profiling, where applicable).
  6. Right to data portability: request that we provide your personal data in a structured, commonly used, machine-readable format, or transfer it to another controller where technically feasible.
  7. Right to withdraw consent: where processing is based on consent, withdraw it at any time.
  8. Right to lodge a complaint: complain to a supervisory authority in your country or EU Member State (for example your local data-protection authority).

To exercise these rights, email support@gluestick.sh from the address associated with your Account (or explain how we can verify your identity). We will respond within the timeframes required by applicable law (under the GDPR, generally within one month).

Some rights are not absolute; we may refuse or limit a request where the law allows (for example to comply with legal obligations, resolve disputes, or protect security). If we cannot fully fulfill a request, we will explain why.

10. Children

The Service is not directed to children under 16, and we do not knowingly collect personal data from them.

11. Changes

We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. Continued use of the Service after an update means you acknowledge the revised policy.

Related: Terms of Service · Refund Policy