Privacy Policy

Effective 26 May 2026 · last updated 31 August 2026

This Privacy Policy explains how Glassbreak ("we", "us", "our") collects, uses, stores, and protects personal information when you use our platform, website, and related services (collectively, the "Service"). It is written to address the requirements of the EU General Data Protection Regulation (GDPR), the UK GDPR, the Swiss FADP, the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA), the Virginia Consumer Data Protection Act (VCDPA), the Connecticut Data Privacy Act (CTDPA), the Colorado Privacy Act (CPA), the Utah Consumer Privacy Act (UCPA), the Australian Privacy Principles under the Privacy Act 1988, and the Singapore Personal Data Protection Act (PDPA), among others.

1. Overview

Glassbreak is a break-glass emergency access platform. Secrets, contacts, and messages are encrypted on your device before transmission to our infrastructure. Glassbreak does not have the ability to decrypt your content. Privacy is foundational to how we design, build, and operate the Service.

2. Our Roles — Controller and Processor

Under GDPR, UK GDPR, and equivalent regimes, Glassbreak acts in two distinct capacities:

Controller — for the personal data we collect to operate the Service and our business (account registration data, authentication credentials, billing data, security telemetry, and support communications). We determine the purposes and means of processing this data.
Processor — for the personal data that our customers submit to the Service in the course of using it (collectively, "Customer Data", which is end-to-end encrypted and which we cannot decrypt). The customer is the controller; we process this data only on documented instructions, as set out in our Data Processing Agreement.

Equivalent role distinctions under CCPA/CPRA (business vs. service provider) and the Australian Privacy Principles (APP entity) apply.

3. Information We Collect

We collect the minimum data required to create and maintain your account, ensure security, and provide the Service:

Account information — name and email address provided during registration
Authentication data — an OPAQUE registration record (see section 6; it is not a password and cannot be used as one), an Argon2id password hash for accounts not yet migrated to OPAQUE, MFA credentials (TOTP secrets, WebAuthn public keys, recovery code hashes), and refresh tokens
Security metadata — IP addresses, user agent strings, device identifiers, and login timestamps, recorded in audit logs for fraud detection and compliance
Organisation and team data — organisation name, team names, membership roles, and subscription details
Encrypted content — secrets, contact records, and messages stored in encrypted form that we cannot decrypt
Usage metrics — anonymous, aggregate site usage via Plausible Analytics (no personally identifiable information, no cookies)
Payment information — processed and stored by Stripe (see section 9)
Approximate location, if you choose to share it — when you acknowledge an emergency notification, the acknowledgement page offers an explicit, default-off option to share your device location with the sender. It is collected only if you turn that switch on and your browser then grants permission, and it is encrypted on your device to the sender before it is transmitted. See section 3a.
Contact details of people you are not — phone numbers and email addresses of emergency contacts, submitted by a customer. See section 3a.

3a. Emergency Recipients and Location

Two categories of data deserve to be called out separately, because they concern people who may never have created a Glassbreak account.

Emergency contacts. A customer stores contact records — typically name, email address, and phone number — for the people they would need to reach in an emergency. Those records are encrypted on the customer's device and we cannot read them. The customer is the controller of that data; we process it on their instructions. There is one unavoidable exception: sending an SMS or placing a voice call requires a plaintext phone number at the moment of dispatch, so at that moment the number is handled in the clear by our delivery pipeline and passed to the carrier (Twilio). It is not retained in the clear afterwards.

Location. The acknowledgement page for an emergency notification includes a "Share my location" switch. It is off by default. If you turn it on, your browser asks for permission, and the coordinates are encrypted on your device to a per-message key belonging to the sender before being uploaded. Glassbreak cannot decrypt them — we relay ciphertext to the sender. If you decline the browser prompt, or leave the switch off, the acknowledgement is sent without any location and nothing is lost. We do not derive location from your IP address for this purpose, and we do not track location in the background or at any other time.

Some laws treat precise geolocation as a heightened category — it is "sensitive personal information" under the CCPA/CPRA, for example. We do not use it for any purpose other than showing it to the sender of the emergency notification you chose to answer, we do not sell or share it, and we could not use it for profiling even if we wanted to, because we hold no key for it.

4. Lawful Bases for Processing (GDPR Art. 6 / UK GDPR Art. 6)

Where GDPR or UK GDPR applies, we rely on the following lawful bases:

Performance of a contract (Art. 6(1)(b)) — to create and operate your account, deliver the Service you have asked for, and process payments.
Legitimate interests (Art. 6(1)(f)) — for security monitoring, fraud prevention, rate limiting, audit logging, and the day-to-day operation and improvement of the Service. We have assessed these interests against your rights and freedoms and consider them proportionate.
Consent (Art. 6(1)(a)) — where required, for any optional marketing communications. The only marketing communication we send today is our newsletter, which is double-opt-in (you confirm by email before receiving anything) and carries a one-click unsubscribe. Any other marketing would likewise require affirmative consent in advance.
Legal obligation (Art. 6(1)(c)) — for tax, accounting, anti-fraud, anti-money-laundering, and law enforcement requests.

We do not engage in solely automated decision-making with legal or similarly significant effects on data subjects (GDPR Art. 22).

5. How We Use Your Information

Create and manage user accounts, organisations, and teams
Authenticate users and manage session security (JWT tokens, refresh token rotation)
Enforce access controls and role-based permissions
Process payments and manage subscriptions via Stripe
Send service-related communications (account verification, password resets, security alerts)
Maintain audit logs for security monitoring and compliance
Detect and prevent fraud, abuse, and unauthorised access
Enforce rate limits to protect Service availability
Comply with legal obligations and enforce our Terms

We do not use Customer Data (encrypted content, contacts, or messages) to train, fine-tune, or evaluate artificial intelligence or machine learning models, and do not share Customer Data with any third party for those purposes. The zero-knowledge architecture means we could not do so even if we wished to.

6. Data Security and Encryption

Secret encryption — secrets are encrypted using AES-256 on your device before transmission. Decryption keys remain exclusively in your control.
Key protection — every asymmetric operation pairs a post-quantum primitive with a classical one, so an attacker must break both. Secret shares are wrapped under RSA-OAEP-4096 (SHA-512) and ML-KEM-1024. Chat and call keys use a hybrid KEM combining ML-KEM-1024 with X25519; group messaging runs MLS on the X-Wing ciphersuite. Identity signatures are made twice, with ML-DSA-65 and Ed25519, and both must verify. Private keys are encrypted at rest and never leave your device in a form we can read.
Long-lived signatures — recovery-kit manifests, which may need to be verified decades from now, additionally carry a hash-based SLH-DSA signature, so forging one would require breaking lattice cryptography, elliptic-curve cryptography, and SHA-2.
Contact encryption — personal contact information (email, phone, address) is encrypted with a Content Encryption Key (CEK) per team, with blind indexes enabling search without decryption.
Message encryption — chat messages are end-to-end encrypted with per-conversation keys wrapped for each participant.
Password security — sign-in uses OPAQUE, an augmented password-authenticated key exchange. Your password never leaves your device — not in the clear, and not as a hash or any other value that could be replayed in its place. The server holds a registration record it cannot use to impersonate you, and an attacker who stole our entire database would still have nothing to log in with and nothing to run an offline guessing attack against in the usual way. Accounts created before we moved to OPAQUE keep an Argon2id hash (memory-hard, per-user salt, server-side pepper) until their next sign-in migrates them. We have never stored plaintext passwords.
Transport security — all data in transit is protected by TLS. All data at rest is encrypted at the infrastructure level.

Glassbreak staff, systems, and infrastructure providers have no access to your decrypted secrets, messages, or encrypted contact data.

7. Cloud Infrastructure and Data Residency

We operate one always-on box per cloud — a Docker Compose stack of Caddy (TLS, static web, and /api proxy with a web application firewall), the Node API, and an in-box, volume-backed PostgreSQL database. We run these boxes across multiple independent clouds so that no single provider failure can take the Service offline:

AWS — a box (compute + block storage) in us-east-1 (United States), and Amazon SES for transactional email
Scaleway — a box (compute + block storage) in fr-par (Paris, France / EU), Scaleway Transactional Email (TEM), and the EU-direct door (glassbreak.cloud)
Microsoft Azure — a Japan (Tokyo) data-residency vertical, currently being provisioned and imminent. Unlike the AWS and Scaleway boxes, which form one replicated cluster, this vertical runs hard-disconnected: data entered through it stays in Japan and is not replicated to the US or EU boxes. Japan is the subject of a European Commission adequacy decision, so transfers to it from the EEA need no additional safeguard. It holds no Customer Data yet
Fastly — multi-origin CDN with health-checked failover and DNS/TLS for glassbreak.io

The two boxes form a single cluster kept in sync by native PostgreSQL streaming replication (managed by Patroni with an etcd arbiter): one box runs the primary/writer and the other a hot standby, with automatic failover. Replication traffic runs over a post-quantum-secured (Rosenpass) WireGuard mesh. Each box runs its own PostgreSQL, so there is no shared single point of failure. The primary-writer role moves between the boxes on failover or planned switchover, and all data is continuously replicated to both boxes — so Customer Data is stored on both EU (Paris) and US (us-east-1) infrastructure.

The glassbreak.cloud door routes directly to the EU (Scaleway, fr-par) box. Because the two boxes are one replicated cluster — data is replicated to both boxes, and the primary writer may run on the AWS (US) box — writes may transit to, and are stored on, the US box. Full EU-only data residency — with writes isolated to the EU — is delivered by our Enterprise EU data-residency zone, which is currently in rollout.

8. International Data Transfers

Where personal data originating in the EEA, the United Kingdom, or Switzerland is transferred to a country that has not been the subject of an adequacy decision, we rely on appropriate safeguards:

the European Commission's Standard Contractual Clauses (SCCs), Module 2 (controller-to-processor), executed with the relevant sub-processors and incorporated into our customer DPA;
the UK International Data Transfer Addendum (UK IDTA) for transfers subject to the UK GDPR;
the Swiss FADP addendum to the SCCs for transfers originating in Switzerland; and
encryption of data in transit (TLS) and at rest, as a supplementary technical measure.

9. Payment Processing

We use Stripe to process payments and manage subscriptions. Stripe collects and stores your payment information (card number, billing address) in accordance with their Privacy Policy and is PCI DSS Level 1 certified. Glassbreak stores only your Stripe customer ID, subscription ID, payment-method ID, and the card's last four digits and brand (for display in billing settings); we never receive or store full payment card details.

10. Analytics

We use Plausible Analytics, a privacy-respecting, cookie-free, EU-hosted analytics tool, to monitor aggregate site usage. Plausible does not collect personally identifiable information, does not use cookies, and does not track users across sites.

From 1 October 2026 we also use PostHog on our public marketing website only, to measure which pages lead people to sign up and where visitors come from. PostHog, Inc. is a US company; our project is hosted in PostHog's EU region (Frankfurt). We run it in its cookieless mode: it sets no cookies, writes nothing to your device, keeps no persistent identifier, and does not build a profile of you. Session recording, heatmaps, automatic click capture, error capture, surveys and feature flags are all switched off, and the tracker cannot load code or configuration from PostHog at runtime. Every request goes through our own servers, which truncate your IP address (IPv4 to a /24 network, IPv6 to a /48) before anything reaches PostHog, and page addresses are stripped to their campaign parameters before they leave your browser. If your browser sends the Global Privacy Control or Do Not Track signal, PostHog is not loaded at all. PostHog is never loaded on the secure application (the app. domains), where your content is decrypted.

We do not use Google Analytics or similar invasive tracking tools.

11. Email Communications

Transactional emails (account verification, password resets, security alerts) are sent via Amazon SES (AWS box) and Scaleway Transactional Email (TEM). The only marketing email we send is our newsletter, which requires double-opt-in confirmation and includes a one-click unsubscribe link in every message. We will never sell or share your email address with third parties for marketing purposes.

12. Cookies and Local Storage

Glassbreak uses only essential cookies and storage:

Session — JWT and refresh token cookies for authentication (gb_access, gb_refresh, and gb_access_pfx), plus gb_pq, which carries the post-quantum co-signature over the same request and exists so a token cannot be accepted on the strength of the classical signature alone
Sign-in with your identity provider — gb_sso_state holds the OAuth state and PKCE verifier for the few seconds an SSO login is in flight, so the response can be matched to the request you started. It is discarded once you land
CSRF token — anti-cross-site-request-forgery cookie set on authenticated requests
Theme preference — light/dark mode stored in localStorage
Routing — where enabled, a gb_vertical cookie scoped to .glassbreak.io records which of our two boxes served you, so that follow-up requests in the same session land on the same one and fail over cleanly if it stops responding. It holds only the name of a box (aws or scaleway), carries no identifier, and expires after one day. A second routing cookie, gb_sticky_read, keeps your reads on a consistent replica so a page you just wrote to does not appear stale — relevant to data residency, since it is what stops a read hopping between regions mid-session.
Encryption key material — your device stores encrypted key material and related state in localStorage and IndexedDB so that you can decrypt your own content. This never leaves your device in a form we can read.

We do not deploy advertising cookies, marketing cookies, or third-party tracking cookies. Plausible Analytics operates without cookies, and PostHog (marketing website only, from 1 October 2026) runs in cookieless mode and likewise stores nothing on your device.

13. Data Retention

We retain personal data only for as long as necessary for the purposes set out in this Policy or as required by law. The default retention periods are:

Account data (name, email, organisation membership) — retained while the account exists. When you delete it, erasure is immediate: there is no grace period and no restoration window, so export anything you want to keep first. Your personal data — name, email, encryption keys, sessions, tokens, MFA enrolments — is destroyed or irreversibly anonymised in a single transaction. Records that belong to a team rather than to you (a secret you created for the team, a message you sent, the ownership of a team) are preserved but severed from your identity: they cannot be hard-deleted without destroying other people's data. That is a deliberate design decision and the practical meaning of erasure here.
Audit logs — the audit trail is deliberately append-only: the database revokes UPDATE and DELETE on it from the application role, so neither the running service nor an attacker who obtains its credentials can rewrite or erase history. That is what makes the log tamper-evident, and it is the reason entries are not aged out automatically. Audit records are therefore purged out of band by a privileged operator rather than by the running service. That purge is scheduled monthly and deletes audit records older than12 months, or 24 months for organisations on an active Enterprise subscription. Audit records hold IP addresses, user agents, user and organisation identifiers, and the type of action taken — never decrypted content. You can ask us to account for what the log holds about you under section 15.
Backups and recovery — recovery is provided by a continuously-replicated hot standby with automatic failover, plus continuous WAL archiving and a scheduled pgBackRest regime on the production boxes: a full backup weekly, incremental backups daily, and an archive-integrity check every hour. The backup repository is encrypted with AES-256 using a key we hold, and its retention is configured per deployment. The repository is held in two places: on the box itself, and off-box in Backblaze B2 in the EU (Amsterdam), under Object Lock, which makes each object immutable for 30 days by default — a backup that ransomware, or someone holding our own storage credentials, cannot delete or overwrite. The off-box copy receives the continuous WAL stream as well as the scheduled backups, so recovery to a point in time is possible from it and not only recovery to the last full backup. It is encrypted on the box before upload with a key Backblaze never receives, under a passphrase separate from the one protecting the on-box repository, so compromising the box does not unlock the copy meant to outlive it. A full backup-restore-and-point-in-time-recovery drill runs in Docker, and the wider disaster-recovery suite (including a restore round-trip) runs nightly in CI
Billing records and invoices — 7 years, as required by applicable tax and accounting law
Encrypted content (Customer Data) — retained until the customer or team administrator deletes it, then purged from primary storage; any deletion also propagates to the replicated standby
Rate-limit counters — expire with the rate-limit window they belong to (minutes), and expired rows are swept every few minutes
Failed-login records — a failed sign-in records the email address attempted and a counter, so a lockout can be enforced. The lockout window itself is 15 minutes, but the row is kept for up to 30 days and then purged on a daily job. It holds the address in the clear, which is why it is called out separately from the rate-limit counters above rather than lumped in with them
Website analytics events (Plausible; PostHog on the marketing website from 1 October 2026) — aggregate and anonymous. They carry no cookie, no persistent identifier and no full IP address, so there is nothing in them that can be tied back to you or deleted on request; they are held in the vendor's project for as long as our account with that vendor retains them

14. Sub-processors

We use the following sub-processors. None has access to your decrypted secrets or encrypted content. The authoritative, current list is at /legal/sub-processors.

AWS (US) — box compute and block storage (us-east-1), Amazon SES for transactional email
Scaleway (EU) — box compute and block storage (fr-par), Scaleway Transactional Email (TEM)
Microsoft Azure (Japan — adequacy) (imminent) — Tokyo data-residency vertical, being provisioned; holds no Customer Data yet
Fastly (US/Global) — multi-origin CDN, routing, and DNS
Grafana Cloud (US; telemetry hosted in Australia) — observability (metrics, logs, traces)
Twilio (US) — SMS and voice emergency-notification delivery; also one of four TURN call-relay vendors
Cloudflare (US/Global) — TURN call relay and a STUN endpoint for NAT discovery
Metered (US) — TURN call relay
Xirsys (US) — TURN call relay
Stripe (US / EU) — payment processing (billing not yet live)
Plausible (EU) — privacy-respecting analytics
PostHog (US company; project hosted in the EU, Frankfurt) — cookieless analytics on the marketing website only (planned; from 1 October 2026)
GitHub (US) — source code hosting and CI/CD
1Password — internal secrets management (Glassbreak staff)
Backblaze (US company; storage in EU Central, Amsterdam) — off-box immutable backup storage (B2 with Object Lock); holds only the backup repository, encrypted before it leaves the box
Tailscale — private administrative network; the only path to the production boxes, which expose no public SSH
DNS and registrars (deSEC, Gandi, Porkbun, DNSimple, Scaleway) — authoritative DNS and domain registration; they answer resolvers, not end users, and see no Customer Data

Call relays. When two people on a call cannot connect directly, their media is relayed through a TURN server operated by one of the four vendors above. A relay sees both participants' IP addresses and the timing and volume of the traffic it forwards, but not its content: call media is encrypted with a per-call key before it leaves the device. We deliberately spread calls across at least two vendors so that one vendor's outage cannot take calling down. For NAT discovery the client may also contact public STUN endpoints run by Google, Cloudflare, Mozilla, and Nextcloud, which learn only the client's public IP and port.

We give at least 30 days' notice by email and on the sub-processor list before onboarding a new sub-processor or materially changing the role of an existing one.

15. Your Rights

Depending on where you are located, you may have the following rights regarding your personal data. We will respond to verifiable requests within the period required by the applicable law (typically 30 days; up to 45 days under CCPA/CPRA where extended).

EU GDPR and UK GDPR (Art. 15–22):

Access (Art. 15) — a copy of the personal data we hold about you
Rectification (Art. 16) — correction of inaccurate or incomplete data
Erasure / "right to be forgotten" (Art. 17) — subject to legal retention requirements
Restriction of processing (Art. 18)
Data portability (Art. 20) — a structured, machine-readable export
Objection (Art. 21) — including objection to processing based on legitimate interests
Rights related to automated decision-making and profiling (Art. 22) — we do not engage in such decision-making
Withdrawal of consent where processing is based on consent
Right to lodge a complaint with a supervisory authority

US state privacy laws:

CCPA / CPRA (California) — right to know, right to access, right to delete, right to correct, right to opt out of "sale" or "sharing" of personal information, right to limit use of sensitive personal information, right to non-discrimination. We do not sell personal information and do not "share" it for cross-context behavioural advertising as defined by CPRA.
VCDPA (Virginia) — access, correction, deletion, portability, opt-out of targeted advertising, sale, and certain profiling.
CTDPA (Connecticut) — same suite of rights as VCDPA.
CPA (Colorado) — same suite of rights, including a universal opt-out mechanism where applicable.
UCPA (Utah) — access, deletion, portability, and opt-out of certain processing.

Other jurisdictions:

Australia (Privacy Act 1988 / Australian Privacy Principles) — access, correction, complaint to the Office of the Australian Information Commissioner (OAIC).
Singapore (PDPA) — access, correction, withdrawal of consent.
Switzerland (FADP) — access, correction, deletion, and equivalent rights.

To exercise any of these rights, contact us at privacy@glassbreak.io or use the data-subject request form at /legal/data-request. We may need to verify your identity before responding. We cannot provide access to your encrypted content because we do not hold the decryption keys; you can export your own decrypted content directly from the Service.

16. Data Breach Notification

In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR Art. 33 and UK GDPR Art. 33. Where the breach is likely to result in a high risk to your rights and freedoms, we will notify affected data subjects without undue delay (GDPR Art. 34). Notifications under other regimes (including the Australian Notifiable Data Breaches scheme, Singapore PDPA, and US state breach notification laws) will be made in accordance with the applicable statutory timelines and content requirements.

Where we act as processor, we will notify the customer (controller) without undue delay after becoming aware of a breach affecting Customer Data, in accordance with our DPA.

17. Children's Privacy

Glassbreak is not directed at children under 16 years of age. We do not knowingly collect personal information from children under 16. If we become aware that a child under 16 has provided us with personal data, we will take prompt steps to delete it.

18. DPO, EU Representative, and UK Representative

Glassbreak is currently appointing a formal Data Protection Officer and statutory Article 27 representatives in the EU and the UK. In the meantime, all data protection enquiries can be directed to:

Data Protection Officer (interim contact): privacy@glassbreak.io
EU GDPR Article 27 representative (TBD): privacy@glassbreak.io
UK GDPR Article 27 representative (TBD): privacy@glassbreak.io

Named contacts will be added to this page once appointed.

19. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes (changes that expand the categories of data collected, the purposes of processing, the sub-processor list, or that materially reduce your rights) will be communicated by email to the account's primary contact and via a prominent in-product notice at least 30 days before they take effect. Non-material changes (typographical, clarifying, or required by law) may take effect on posting. The "Effective" date at the top of this page indicates when this Policy was last revised.

20. Governing Law

Governing law and dispute resolution for this Policy follow the multi-jurisdiction clauses in our Terms and Conditions. Nothing in this Policy limits your statutory rights or the jurisdiction of your local supervisory authority.

21. Contact

For questions, data requests, or complaints:
Privacy inquiries: privacy@glassbreak.io
Data-subject request form: /legal/data-request
Security: security@glassbreak.io
Complaints: complaints@glassbreak.io

If you are not satisfied with our response, you may lodge a complaint with your local supervisory authority — for example, the UK Information Commissioner's Office (ICO), the relevant EU data protection authority (e.g. CNIL in France, the Irish DPC), the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au, the Singapore Personal Data Protection Commission (PDPC), or the relevant US state attorney general.

By using Glassbreak, you agree to this Privacy Policy.

This document is provided for transparency and does not constitute legal advice.