What we know about you.
Effective 28 July 2026. This is the first version of this notice.
The short version
- Your manuscripts never reach us. They are written to storage on your own device. We have no copy, no backup, and no way to read them.
- What we hold is your email address and which platforms you have bought. That is the account.
- We do not sell or share your personal information, and we do not track you across other websites.
- No analytics, no advertising, no third-party cookies. One cookie, to keep you signed in.
- Ask us to delete your account and we will, keeping only what tax law makes us keep.
The rest of this page is the detail behind those five lines. It is worth reading if you want to know exactly who else touches your email address and for how long — but the five lines are not a simplification of the policy. They are the policy.
Who we are
Glacier is made and sold by Obake Studio Ltd, a company registered in England and Wales. Obake Studio Ltd is the data controller for the personal information described in this notice, which means we are the ones who decide what is collected and why, and we are the ones answerable for it.
Obake Studio Ltd
Company number: Add company number
Registered office: Add registered office address
Email: hello@glacierwriting.com
We are not required to appoint a Data Protection Officer, and we have not appointed one. Privacy questions go to the address above and are answered by a person, not a queue.
What we hold — and what we do not
What we do not hold
Your writing. Glacier keeps your manuscript in storage belonging to your own browser or, on desktop, as a file on your own drive. It is never uploaded to us, in whole or in part. There is no sync service, no server-side draft, no cloud copy. Your characters, your scenes, your notes and your prose are not personal data that we process, because we never receive them.
We also never see your card details. Payment happens on Stripe's own pages — see section 4.
What we do hold
| Information | Where it comes from |
|---|---|
| Your email address | You type it into the sign-in box, or your sign-in provider passes it to us. |
| Which platforms you own, and a short purchase history — the item bought, when, and Stripe's reference for it | Created by us when a payment succeeds. |
| A sign-in session, held in a cookie on your device | Created when you sign in. |
| Short-lived counters against your email address and your IP address, used to stop someone using our sign-in form to spam a stranger | Created automatically when a sign-in link is requested. Deleted after 15 minutes and one hour respectively. |
| Any email you send us, and our reply | You. |
| Ordinary server logs, which can contain an IP address and — where something went wrong with a sign-in — an email address | Generated automatically by our host. |
What your sign-in provider tells us
If you sign in with Google, Apple, Microsoft or GitHub, we ask that provider for the least that identifies you: a verified email address. Some of them return a display name alongside it. We keep only the email address; anything else is discarded at the moment we receive it. Signing in this way tells the provider that you use Glacier, which is unavoidable — if you would rather it did not, use the email link instead.
We never ask for access to your files, your repositories, your contacts or your calendar. Glacier may one day offer to back your story up to your own GitHub account; if it does, that will be a separate permission, asked for separately, and only if you go looking for it.
Why we hold it, and on what legal basis
| What we do | Why | Lawful basis (UK & EU GDPR) |
|---|---|---|
| Sign you in and keep you signed in | You cannot have an account without an email address — it is the account. | Performance of our contract with you (Art. 6(1)(b)) |
| Record what you have bought, and issue the licence your copy of Glacier checks | So the thing you paid for opens, including when you are offline. | Performance of our contract with you (Art. 6(1)(b)) |
| Take payment, and handle refunds and chargebacks | Selling you the software. | Performance of our contract with you (Art. 6(1)(b)) |
| Answer your emails | Support, and dealing with complaints. | Performance of our contract, or our legitimate interests (Art. 6(1)(b) and (f)) |
| Rate-limit the sign-in form, verify payment webhooks, and keep logs | Stopping abuse, fraud and technical faults. Our legitimate interest is in running a service that is not used to attack other people, and in not being defrauded; it is hard to see how that works against you. | Legitimate interests (Art. 6(1)(f)) |
| Keep records of what we sold and to whom | UK company and tax law requires it. | Legal obligation (Art. 6(1)(c)) |
We do not use your information to make any automated decision that has a legal or similarly significant effect on you, and we do not profile you. There is no marketing list. We will not email you about anything except your account, your purchase, or a reply you asked for.
Who else sees it
Four companies are involved in running Glacier, each doing one job. None of them is allowed to use your information for their own purposes, and none of them receives your writing.
Stripe
Takes the payment. Stripe receives your email address so it can send a receipt and match the payment to your account. Your card details go directly to Stripe and never touch our systems. Stripe is a data controller in its own right for parts of what it does — its own privacy policy is at stripe.com/privacy.
Cloudflare
Serves this website and the application, and stores the small record of your email address and what you own. Your requests pass through Cloudflare's network, which is how the site is fast and how it stays up under attack. Cloudflare's privacy policy is at cloudflare.com/privacypolicy.
Resend
Delivers your sign-in link. Resend receives your email address and the contents of that one message. It is not a mailing-list provider and we do not run a mailing list on it. Resend's privacy policy is at resend.com/legal/privacy-policy.
Google, Apple, Microsoft and GitHub
Only if you choose one of them. They are the source of your email address rather than a recipient of it — we send them nothing about you beyond the fact that a sign-in has been requested. What they do with that is governed by their own privacy policies.
Beyond those four: we will disclose personal information if the law requires it of us, and we would tell you unless we were forbidden from doing so. If Obake Studio Ltd were ever sold or transferred, account records would go with it, and this notice would go with them.
We do not sell your personal information, and we do not share it for advertising — to anyone, for any price, in any jurisdiction.
Where in the world it goes
Stripe, Cloudflare and Resend are US-headquartered and operate international networks, so your email address is transferred outside the UK and the European Economic Area.
Those transfers are covered by the UK's International Data Transfer Addendum to the European Commission's Standard Contractual Clauses, and by the Standard Contractual Clauses themselves for transfers out of the EEA — the safeguards recognised under Article 46 of the UK and EU GDPR. Where a recipient is certified under the UK–US Data Bridge or the EU–US Data Privacy Framework, we also rely on that adequacy decision.
You are entitled to a copy of those safeguards. Email hello@glacierwriting.com and we will send them to you.
How long we keep it
| What | How long |
|---|---|
| Your email address and what you own | For as long as you hold a licence, and until you ask us to delete it. |
| Records of what you bought and what you paid | Six years from the end of the accounting year the purchase falls in. UK company and tax law sets this period, not us — it is the one thing we cannot delete on request. |
| Your sign-in cookie | 60 days, or until you sign out. |
| The licence stored on your own machine | 30 days, then it is quietly replaced next time you are online. Signing out removes it. |
| Sign-in link | 15 minutes, and it works once. |
| Anti-abuse counters | 15 minutes for the one against your email address, one hour for the one against your IP address. They expire on their own. |
| Support email | Two years after the conversation ends, so we can pick up a thread you return to. |
| Server logs | Short-term, as our host retains them — currently a matter of days. |
Cookies, and the storage Glacier uses on your device
Glacier sets one cookie. It is called gl_session, it holds a signed
token saying that this browser is signed in as your email address, and it lasts 60 days or until
you sign out. It is marked HttpOnly, Secure and SameSite, so it cannot be read by scripts and is
not sent to other sites.
That cookie is strictly necessary: it exists only to keep you signed in to a service you asked to be signed in to, and it is used for nothing else. Under the Privacy and Electronic Communications Regulations, strictly necessary storage of this kind does not require consent, which is why this site has no cookie banner. There is nothing to consent to. We set no analytics cookies, no advertising cookies and no third-party cookies, and there are no embedded trackers, social widgets or font services on this site.
During sign-in we briefly set a second, temporary cookie holding a random value that ties the sign-in you started to the browser it finishes in. It is deleted as soon as you land back on the site, and it exists purely to stop someone hijacking the sign-in.
The storage your manuscript lives in
Glacier also writes to your device far more substantially than any cookie — that is the whole design. Depending on your browser it uses the Origin Private File System, IndexedDB, or a real file on your drive, plus a little local storage for your preferences and your licence. All of it stays on your device. We mention it here because the rules on storing things on your device are not limited to cookies, and because you should know where your book actually is.
The practical warning: if you clear your browser's site data for glacierwriting.com, you delete your work along with it. Glacier has Back up and Export built in precisely so this never has to matter. Use them.
Your rights
You have the following rights over the personal information we hold about you. Exercising any of them is free, and we will respond within one month.
- Access — ask what we hold and get a copy of it.
- Rectification — have anything wrong corrected.
- Erasure — have it deleted, except where tax law makes us keep the record of a sale.
- Restriction — have us stop using it while a dispute about it is sorted out.
- Portability — receive it in a machine-readable form, or have it sent elsewhere. (Your manuscript needs none of this: it is already yours, already a file, and Glacier exports it to plain text on demand.)
Your right to object
Separately from the rights above, you have the right to object to our using your information where we rely on legitimate interests — that is, the anti-abuse counters, the logs, and the handling of support mail. Tell us and we will stop, unless we can show compelling grounds that override your objection.
You also have an absolute right to object to direct marketing. We do not do any, so there is nothing here to object to — but the right stands regardless.
To use any of these rights, email hello@glacierwriting.com. We may need to check you are who you say you are, which for an account identified only by an email address normally means sending the request from that address.
Complaining to us
If you think we have handled your personal information badly, tell us first — we would rather fix it than have you take it elsewhere unresolved.
You can complain by email to hello@glacierwriting.com, putting "data protection complaint" in the subject line, or by post to the registered office in section 1. Either route is fine and you do not need to use any particular form of words.
We will acknowledge your complaint within 30 days, take appropriate steps to investigate it, and tell you the outcome. That is the standard set by the Data (Use and Access) Act 2025, and it applies to us from 19 June 2026.
Complaining to the regulator
You do not have to come to us first, and nothing here takes away your right to go straight to the regulator. In the UK that is the Information Commissioner's Office:
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
If you are in the European Economic Area, you can complain to the supervisory authority in the country where you live or work instead.
If you are in California
This section is here because California's Online Privacy Protection Act asks for it specifically. None of it changes what we do — it restates it in the terms that Act uses.
- What we collect: identifiers, meaning your email address and IP address; and commercial information, meaning what you bought and when. Nothing else. No biometric, geolocation, browsing-history, employment, education or inferred-characteristics data, and no sensitive personal information.
- Who it may be shared with: the four companies named in section 4, each for the single purpose given there.
- Reviewing and changing it: email hello@glacierwriting.com and ask. We will tell you what we hold, change what is wrong, and delete it if you want it gone.
- Do Not Track: Glacier does not track you across websites or over time, so a Do Not Track signal makes no difference to how this site behaves — there is nothing for it to switch off. We do not allow anyone else to collect information about your activity across other sites from here.
- Selling and sharing: we do not sell your personal information, and we do not share it for cross-context behavioural advertising. We never have.
- Material changes to this notice are announced as described in section 12.
Changes to this notice
If we change this notice we will change the effective date at the top and keep a note of what changed below. If a change is material — if it alters what we collect, why, or who receives it — we will email everyone with an account before the change takes effect, and we will not start using your information for a new purpose until we have.
Version history
- 28 July 2026 — first version.
Children
Glacier is sold to adults and we do not knowingly collect personal information from children under 13. If you believe a child has given us their email address, tell us and we will delete it.