Privacy

What glossjar stores about you, why, and for how long. No ads, no analytics, no trackers.

Who runs this

glossjar is run from Lithuania. For anything about your data, write to hello@glossjar.com.

What we store

Your email address, your password as a one-way hash (never the password itself), when you signed up, how many new words you want a day, and your progress on each word you studied: when it is due again and your last rating. Trying words without an account stores nothing.

One cookie, session, keeps you logged in for 30 days. It is needed for logging in, so there is no cookie banner. There are no other cookies.

Why

To run your account and schedule your words (GDPR art. 6(1)(b), a contract with you), and to keep the site safe from abuse (art. 6(1)(f), legitimate interest). We send you only the emails your account needs: confirming your address and resetting your password.

IP addresses

The server sees your IP address with each request. It is used only in memory, to limit attempts to sign up, log in and reset passwords, and is never written to disk. Server logs record which pages were requested, not by whom.

How long

Your account and progress: until you ask us to delete them. Login sessions: 30 days. Email links: 24 hours to confirm, 1 hour to reset a password. Encrypted nightly backups: 30 days, so a deleted account is gone from them a month later.

Who else handles it

Scaleway (France) hosts the site and its encrypted backups and sends our emails. Zoho runs our mailbox in its EU data centre, so it holds what you write to hello@. Your data stays in the EU.

Your rights

You can ask to see, correct, export or delete your data, or object to how we use it. Write to hello@glossjar.com from your account's address; we answer within a month. Deleting your account removes your email, password and progress.

Complaints

You can complain to the Lithuanian State Data Protection Inspectorate (vdai.lrv.lt) or to the data protection authority where you live.

Last updated 17 October 2026.