Privacy policy

Last updated: 16 October 2026

Mark Boyes-Smith, trading as Glitterball ("Glitterball", "we") runs glitterball.dev and the Glitterball package that people add to their prototypes. This policy says what we collect, why, who we share it with, and what you can do about it.

What we collect

Your account. Your email address, your name, and your profile picture if you sign in with GitHub or Google. If you sign in by email, we look up a public Gravatar picture for your address, sending Gravatar only a hash of it. We also keep the workspaces you belong to, your role in each, and where you came from when you signed up (for example, a shared walkthrough link).

Walkthroughs you record.

• A recording of the prototype page and what you did on it: cursor movement, clicks, scrolling and changes to the page. This is a recording of the page's structure, not a video of your screen.
• A copy of the page as it was when you started.
• Your narration audio, its transcript and a short summary.
• Your camera video, if you turned the camera on.
• The walkthrough's title and any feedback questions you added.

Password, email and phone fields are masked in recordings. Anything else typed into the prototype is recorded, so use test data.

Comments and feedback. The text, any video you record, where it's pinned, your reactions, your answers to feedback questions, and approvals.

Viewing data. When someone watches a walkthrough, we record how far they got, so the person who recorded it can see who watched. If the viewer is signed in, this includes who they are.

Chat apps and coding agents. If you connect Glitterball to Claude, ChatGPT, Cursor or another app, that app can see what you ask it to fetch: your walkthrough titles, who watched them, comments and narration summaries. It can also mark comments resolved. Each connection is a key listed in Settings under the app's name, and deleting the key disconnects it. What those apps do with the answers is covered by their own privacy policies.

Uploads. The files of any prototype you upload for us to host.

Technical data. Your IP address, used for rate limiting to stop abuse and kept for up to one hour per limit window. Server error logs, which can include the page or route that failed, kept for 90 days. A security log of account events (sign-ins, failed sign-in codes, keys, membership and plan changes, account exports and deletions), with the IP address each came from, kept for one year to detect and investigate misuse.

Payments. If you pay, Stripe processes your payment and handles sales tax. We keep only the plan and the subscription status. We never see your full card number.

What we don't do

• We don't sell your data.
• We don't use advertising or third-party tracking. The app has no tracking cookies. Your sign-in is kept in your browser's local storage only so that you stay signed in.
• We don't use your recordings to train AI models. The AI providers below process your audio and text only to produce transcripts and summaries for you, under their API terms, which don't allow training on that data.

Why we use it

• To run the service you asked for: storing and playing back walkthroughs, sharing them, comments, and team workspaces.
• To transcribe and summarise narration.
• To send the emails you need: sign-in codes, invites, replies to your feedback requests, and trial and billing notices. Tips and reminders can be turned off from any of those emails.
• To keep the service secure and working: rate limits, error monitoring and abuse prevention.
• To understand how many people sign up and record. This uses counts, not individual tracking.

Under UK GDPR, our legal bases are contract (running the service), legitimate interests (security, product statistics) and consent (camera and microphone, which your browser asks for each time).

Who sees it

• Your workspace members see the workspace's prototypes, walkthroughs and comments.
• Anyone with a share link sees what that link shows. Private links work only for the people they're for.
• Our service providers (subprocessors), who process data for us only to provide the service. The full list, with what each one handles, is on the subprocessors page.
• Authorities, only when the law requires it.

How long we keep it

We keep your data until you delete it or delete your account. Deleting a walkthrough removes its recording, narration, transcript, summary and camera video straight away. Database backups roll over within 30 days.

Your choices and rights

• Download your data: in the app, go to Account, then Download your data.
• Delete your account: go to Account, then Delete account. This deletes your personal workspace and any team where you're the only member, plus your walkthroughs, comments and approvals in teams that carry on without you.
• Stop tips and reminders: use the unsubscribe link in any of those emails.
• Anything else (correction, objection, questions): email help@glitterball.dev. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.

Children

Glitterball is for work. It isn't meant for anyone under 16.

International transfers

Our providers may process data in the United States and the EU. Where data leaves the UK, we rely on the UK's adequacy regulations (including the UK–US data bridge) or the International Data Transfer Addendum to the EU Standard Contractual Clauses.

Changes

If we change this policy in a way that matters, we'll email account holders before the change takes effect.

Contact

Mark Boyes-Smith, trading as Glitterball. Email help@glitterball.dev. A postal address is available on request at team@glitterball.dev.