Privacy

Everything glossjar keeps about you, and why. There are no ads and no analytics or tracking scripts.

Who runs this

glossjar is run from Lithuania. Questions about your data go to hello@glossjar.com.

What we store

Your email address and a one-way hash of your password, never the password itself. When you signed up, your daily word limit, site language and reminder settings. For each word you've studied, when it's due next and your last rating. Trying words without an account saves nothing on our servers until you sign up.

Five cookies, all needed for the site to work, which is why there's no cookie banner. session keeps you logged in (30 days). lang remembers your language (1 year). guest holds your ratings of the free words until you sign up (30 days). signup logs in the browser you signed up in when you confirm your email (24 hours). theme remembers light or dark mode, only if you switch it (1 year). There are no others.

Why we keep it

To run your account and schedule your words (GDPR art. 6(1)(b), our contract with you), and to protect the site from abuse (art. 6(1)(f), legitimate interest). We only send the emails your account needs, to confirm your address or reset your password, plus reminders if you turn them on.

IP addresses

The server sees your IP address on every request. It's kept in memory only, to limit repeated sign-up, login and password-reset attempts, and is never written to disk. Server logs record which pages were requested, not who asked for them.

How long

Account and progress: until you ask us to delete them. A sign-up whose email is never confirmed is deleted after 30 days, unless words were studied with it after signing up. Login sessions: 30 days. Email links and the sign-up browser token: 24 hours to confirm, 1 hour to reset a password. Encrypted nightly backups: 30 days, so a deleted account drops out of them a month later.

Who else handles it

Scaleway in France hosts the site and its encrypted backups and sends our emails. Zoho runs our mailbox in its EU data centre, so it holds whatever you write to hello@. Your data stays in the EU.

Your rights

You can ask to see, correct, export or delete your data, or object to how it's used. Write to hello@glossjar.com from your account's address and we'll reply within a month. Deleting your account removes your email, password and progress.

Complaints

If you're unhappy with how we handle your data, you can complain to the Lithuanian State Data Protection Inspectorate (vdai.lrv.lt) or to the data protection authority where you live.

Last updated 10 November 2026.