Glob Social Privacy Policy

The short version

• You sign in with a Colli account (https://account.colli.ca). Your email address and password are held by the Colli account service, not by Glob Social.
• Glob Social keeps your public username, what you make and do on Glob Social, and the records it needs to run the service and keep people safe.
• Glob Social does not store your email address, your IP address or your location.
• Nothing on Glob Social is end-to-end encrypted. What you post, chat and upload is stored on our servers in a form we can read.
• Public content is public: anyone can see it, and a node you make public is dedicated to the public domain under CC0.
• We do not sell your information, show ads, or use advertising, analytics or third-party crash-reporting tools. When a page fails, your browser sends a short error message to our own servers, which log it so that we can fix the bug.
• You can leave Glob Social at any time, or delete your Colli account. 14 days later we delete what you made and what we hold about you, except public work that someone else has placed on their canvas or saved, which stays without your name; "Leaving and deleting your account" lists what stays.

Who can use Glob Social

Glob Social is for adults. You must be 18 or older to use it, and you confirm that you are when you join. Glob Social is not directed at children, and we do not knowingly collect information from anyone under 18.

If we learn that an account belongs to someone under 18, we close it. If you believe a child is using Glob Social, tell us at [email protected].

What we collect and why

Your account. Your public username, an internal account number, a public id, and the id of your Colli account. We use them to sign you in, to show who made what and to keep your account working. Your username comes from your Colli account. Your email address and password stay with the Colli account service, which sends your verification and password-reset emails; its privacy policy is at https://colli.dev/privacy.

Your age confirmation. When you join, you confirm that you are 18 or older, and we keep that confirmation, the version of the agreement you accepted and when you accepted it. If you joined with an invitation code, we keep a hash of the code and who invited you. If we ask for your month and year of birth, we use them only to check your age and do not store them: we keep only the result and the date. If someone is refused because they are under the minimum age, we keep a keyed hash of their Colli account identity and the time, linked to no Glob Social account, so that the check cannot simply be repeated for 30 days.

What you make. Nodes, canvases, links and tags; Pixl images; music tracks, albums, stations and Studio devices, including editable project data and audio recordings rendered in the creator’s browser for listeners; files you upload, such as PDFs, and their previews; wall posts and comments; shouts; chat messages in rooms, groups and direct messages; Freemarket listings and comments; items you save to your Listr, the folders you use to organise them, or items you send from the Glob Capture browser extension; notes; lookups and other AI results you save; and your settings. We store them to provide Glob Social to you and to the people you share them with.

Provider connections for Agent Tools. If you are allowed to add a provider connection, the key you submit is stored encrypted and is available only to your own agent settings. We use it only to check the selected provider connection. Agent execution is not available. We do not return the key to your browser, share it with other members, or use shared Glob funding as a fallback. The encrypted key stays until you revoke the connection, your administrator authority ends, or your account is erased; then we remove the encrypted key and retain only nonsecret connection records needed to show that it was revoked.

The history of a node. Glob Social keeps a record of the actions taken on each node and on the canvas inside it: what kind of action it was, when, who took it and which nodes it touched, such as a node added, moved, edited, linked, removed or shared, a member joining, or a change of a node's settings. Each node's record covers only what happened to that node and on its own canvas. The record keeps no chat messages and no votes. To show and restore a node's past, it also keeps earlier versions of the dates on a node, of a timeline's arrangement and notes, and of each Pixl picture; a picture that is identical in several places is stored once. Recording began when this feature was added: a node older than that shows only when it was made.

What you do. Follows, likes, friends and friend requests, visits, group memberships, votes, blocks, reports, invitations, and activity such as views and pins. We use activity to rank nodes and people and to show you things that are relevant to you.

Notifications. If you turn on notifications on a device, we store that browser's push address and keys. A push message carries only identifiers, never text or names; your device then fetches the notification from us. Your notifications stay in your inbox until you leave.

Credits and the Freemarket. Your credit balance and credit transactions (monthly credits, credits spent on AI features and sharing, and Freemarket sales and fees) are kept by the Colli account service. Glob Social keeps the records of Freemarket listings and sales. Credits cannot be bought with money on Glob Social, and we collect no payment card details.

Keeping the service safe. Glob Social sets a random identifier in a first-party cookie on your browser (named __Host-gp_did, kept for up to 400 days). We store it only as a keyed hash and use it to recognise when several accounts are used from one browser, so that we can stop abuse and ban evasion.

Safety records. Reports, review items, moderators' decisions, records of actions taken on content or accounts, and a tamper-evident audit log. A report keeps a copy of what was reported, so that a later edit cannot hide it.

Copyright notices. If you send a copyright notice or a counter-notice, we keep the name, email address, postal address and phone number you give, your statements and signature, and the material you name. As the law requires, we forward a notice, including the sender's name and contact details, to the people credited on the material, and we pass a counter-notice to the person who sent the notice.

Network information. Glob Social does not store your IP address or your location. Our network provider, Cloudflare, handles your IP address to deliver the site to you, and our servers use it for a moment, without storing it, to limit how many requests one connection can make. Our server logs record which page or feature was requested and when, but not your IP address. When a page fails in your browser, it sends a short error report to our own servers, which log it so that we can fix the bug: a code identifying the error when there is one, the error's name and the first 200 characters of its message, the page's path without the rest of its address, the app's version and the kind of failure. Nothing else is sent, not even the error's stack trace. No third-party crash-reporting tool is involved, and the report is not stored anywhere else or shared. It is kept only as long as the logs are; "How long we keep information" says how long that is.

Cookies and local storage. We use first-party cookies only: your sign-in session, short-lived state while you sign in and the page to return to afterwards, a one-time marker while you confirm your age, a notice if your account has been banned, and the safety identifier described above. Your display preferences are kept in your browser's local storage. Glob Studio also keeps local projects, recent recovery checkpoints and disposable audio caches in browser storage. The Pixl editor keeps the undo history of the pictures you are drawing in browser storage, and when a save to our servers fails it keeps the unsent picture there too, at most 20 of them and 16 MB, sending each one again until it arrives. When you sign out we tell you how many have not been sent, then delete them. If someone else signs in on that browser first, your unsent pictures are kept for you, and that account cannot see, open or send them; they are sent when you sign in there again, or deleted after 30 days, and the browser keeps a note of how many were deleted, with no picture in it, to tell you next time. They are not encrypted in the browser, so anyone who can open that browser's storage could read them. There are no advertising or analytics cookies.

What we do not collect. We do not collect your contacts, your calendar, your precise or approximate location, health information or payment details. The site tells your browser to deny it access to your camera, microphone and location.

How we use information

• To run Glob Social: to sign you in, store and show what you make, deliver messages and notifications, and keep your settings.
• To rank and recommend nodes and people, using activity on Glob Social.
• To keep people safe: to screen content, review reports, enforce our Terms of Service, prevent abuse and ban evasion, and meet our legal duties.
• To run the AI features you choose to use, and to charge the credits they cost.
• To answer you when you write to us.

We do not use your information for advertising, we do not sell it, and we do not use your content to train AI models.

What is public

• Your username and your public profile can be seen by anyone, including people who are not signed in.
• When you make a node public, anyone can see it and everything inside it, and it is dedicated to the public domain under CC0: anyone may copy, change and reuse it, and copies already made remain even if you later take it back.
• Pixls, tracks, wall posts, comments, shouts and Freemarket listings you publish can be seen by the people who can see the place where you put them.
• Where Glob Social shows a node's history, only signed-in people who can see the node now can see it, and only for the time they could see it: what happened while a node was private stays private after it is made public. The people who govern a node (its owner, its council members or its stewards) also see who joined or left and that moderators acted, never which moderator. Actions taken by the system, such as automatic repairs, are recorded but not shown. A node's governors can switch its history off ("Show node action history in timeline"); then nobody sees it, the owner included, but the record is still kept.
• Chat in a room can be seen by the people in that room. Chat messages fade from view after 24 hours and are deleted after 30 days, unless they are held for a moderation or legal case.
• Glob Social asks search engines not to index its pages. Not every service respects that request, and anyone who can see public content can copy it.
• An image from another website that Glob Social shows, such as one a post links to rather than uploads or a video's thumbnail, is fetched by Glob Social's servers, never by the viewer's browser. The website that hosts it sees our servers, not the viewer's IP address or browser, and we send it none of the viewer's information. We keep a re-encoded copy to show it again: we fetch the image afresh when someone views it more than 7 days after we last did, and delete each copy 30 days after we fetched it. Web nodes can show other websites inside Glob Social; those websites see the viewer's IP address and follow their own privacy policies.
• When you add a web address to Glob Social, our servers fetch that page, and may take a screenshot of it, to show a preview. The website sees our servers, not you.

Safety, moderation and reporting

Software screens chat messages, wall posts and comments, items being made public, Pixl names, Freemarket listings and music claims against our safety rules. When automated screening is switched on, the text is sent to Anthropic, whose Claude model classifies it and returns a category; we send only the text, not your username or account details. Software can hold something for review or apply a temporary chat limit. Bans and legal decisions are made by people.

When image screening is switched on, every image brought into Glob Social (an upload, a captured image, a preview of a web page, an image from another website, a shared Pixl) is checked before anyone else can see it: a copy is sent to Microsoft's PhotoDNA service, which compares it with known child sexual abuse images, and to Amazon Rekognition, which detects explicit sexual content. We send only the image, never your username or account details. An image either check refuses is not shown. An image that matches known child sexual abuse material is kept, with the account that brought it in and when, for a legal report and for 365 days, readable only by Glob's safety systems and the people who file the report.

You can report a node, a wall post, a Pixl, a chat message or a person in the app, whether or not you are signed in: a node or a Pixl from its menu, a wall post or a chat message from the flag beside it, and a person from the menu on their name or from their profile. You can also report anything by email to [email protected]. Reports go to a review queue, with child-safety reports first.

You can block a person from their profile, from your friends list or from the menu on their name. Blocking works both ways and is enforced on our servers: any friendship or follow between you ends, neither of you can message the other, you stop seeing their wall posts, comments and chat, and they are not told.

We report child sexual abuse material to Cybertip.ca, Canada's tipline, and where it applies to the UK National Crime Agency, the US National Center for Missing & Exploited Children and the police. While a legal case or appeal is open, we preserve the information it needs.

AI features

Optional AI features (lookups, summaries, brainstorming, droids and image generation) send the content you choose, with your question, to the Colli account service, which passes it to an AI provider, OpenAI or Anthropic, and returns the answer. They work on public content and on your own nodes, and they spend your credits. A lookup you run on a node is saved for you alone until you delete it or leave Glob Social. Agent Tools can store a provider connection for an eligible administrator, but saved agents remain stopped and cannot run.

Who we share information with

We do not sell your information or share it for advertising. We share it only with the service providers that handle it for us, and with authorities when the law requires it:

• Cloudflare, which carries all traffic to and from Glob Social.
• Anthropic, for automated safety screening of text and for AI features you choose to use.
• OpenAI, for AI features you choose to use or, when an eligible administrator submits an OpenAI provider connection, to check that connection.
• DeepSeek, when an eligible administrator submits a DeepSeek provider connection, to check that connection.
• The Colli account service (https://account.colli.ca), also run by Colli Labs, for sign-in, credits and AI features. If you wear a Pixl as your avatar, it also becomes your Colli account picture.
• Your browser's push service (for example Google, Mozilla or Apple), if you turn on notifications. It carries only encrypted identifiers.
• Resend, which sends email to people who send us copyright notices. It never receives members' email addresses, because Glob Social does not have them.
• Child-protection bodies, police and courts, when the law requires it.

Leaving and deleting your account

You can leave Glob Social at https://www.glob.social/settings/leave (sign in first). Nothing is erased for 14 days, and signing in again before then cancels it. After that we erase your Glob Social presence: your private nodes, profile, settings, friends, follows, likes, visits, group memberships, notifications, push subscriptions, notes, lookups, chat messages, safety identifiers, age records and blocks, and we cut the link between Glob Social and your Colli account.

Public work that someone else has placed on their canvas or saved stays, without your name and without any credit to you: it is shown as made by a former member. That is a node you made public that someone else pinned, kept on their canvas, saved to their Listr or built on; a Pixl someone else saved, bought, licensed, wears, shows on their canvas or wall, or uses as a music cover, and a Pixl you made into a public emoticon, which anyone may use in chat; and a track, album, station or Studio device someone else saved, bought, collaborated on, plays on their canvas or added to their own station or album. For this rule, a Listr save counts while it remains in the library.

Everything else you made is deleted: your private nodes, the nodes you made public that nobody else holds (every version is erased; where our records must still point to one, an empty marker with no content stays), your wall posts and comments, Pixls, music, stations and Studio devices, Freemarket listings and comments, chat messages, reactions and shouts. A wall post that other people replied to is emptied rather than removed, so that their replies stay. Dates and notes you added on a timeline go with the node they are on; a date on public work that stays, stays without your name.

Node history. The actions you took stay in the history of the nodes they happened to, shown as taken by someone with no name; your name is removed from every record of who joined, was invited or was given access, and from the earlier versions of dates, timeline notes and Pixl pictures that stay. The history of a node that is erased keeps only a note that it was erased, and its earlier versions are deleted with it. When text is removed by a moderator or the law, the earlier versions of that node's dates and notes are deleted too.

PDFs and captured images use the same file storage as other uploads. Captured images stay private before placement. When an uploaded file or captured image is erased, we remove its previews and stored original when no other retained file needs the same bytes. Identical previews or originals still used by another retained file stay available to that file’s authorised readers.

Your Colli account is separate. To delete it, and with it your email address and sign-in, use https://account.colli.ca/delete. That deletion also waits 14 days, and any sign-in before then cancels it. When it is final, Glob Social is told, and your Glob Social presence is erased in the same way as if you had left. If anything of yours is still on Glob Social after that, email [email protected] and we will erase it.

What stays after you leave:

• A blank account record with no name, no link to your Colli account and a new public id. Where something that stays must point to an author, it points to this record.
• The public work that someone else placed or saved, as described above, without your name.
• Records we keep for accountability and the law: the audit log, moderation decisions, the record that public work was dedicated under CC0, and ban records, which are kept as keyed hashes and are not tied to your account.
• Records of Freemarket and music sales you took part in, because credits moved between two people and a refund, a reversal or a dispute may need them. They keep the amounts and point only to blank records; a listing that stays keeps no description, and your Colli account id is removed from the payment lines of settled sales.
• Any legal case or appeal that names you. While one is open, erasure waits.
• Reports you made, without your name.
• Content removed after a copyright notice, and music that a copyright case names, which we keep so that it can be restored if the notice was mistaken.

You can ask for a copy of your Glob Social data in Settings. If a download is not offered there, email [email protected] and we will send you your data.

How long we keep information

• Chat messages: shown for 24 hours and deleted after 30 days.
• Shouts: deleted after 30 days.
• Activity events: kept in detail for about 14 days, then only as daily totals for each node, which name no one. Your personal interest scores are deleted after 180 days without activity.
• Safety identifiers: deleted 90 days after they were last seen. The links between accounts they produce are deleted 180 days after they were last seen, unless a moderation or legal case still needs them.
• Sign-in sessions: until they expire or you sign out. Records of ended sessions are deleted 7 days later.
• Follow notices: 30 days.
• Read notifications: deleted 90 days after you read them. An unread one stays until you read it.
• AI receipts: the record that a lookup, summary or brainstorm ran, without its content, is deleted 90 days after it is made.
• Copies of images from other websites: deleted 30 days after our servers fetched them. They record which images were shown, never who viewed them.
• Error reports from your browser: kept in our server logs, which are limited by size, not by date. Each of our services keeps only about its most recent 100 MB of log lines, deleting the oldest as new ones are written, and its logs are deleted when we install a new version of it.
• Copyright notices: at least six months, or a year when the sender says court proceedings are expected.
• Moderation records, the audit log and legal cases: as long as they are needed for safety, accountability and the law.
• Unsent Pixl pictures in your browser: until they reach our servers or you sign out, and never more than 30 days after the browser last kept them, even if someone else signs in on that browser meanwhile.
• Browser-local Studio projects: automatic cleanup preserves current project heads and recent valid recovery checkpoints. Older automatic checkpoints and disposable audio and analysis caches are removed as their storage budgets are reached; disposable caches also expire after 30 days without use. Export projects to keep a separate copy. You or your browser can clear local site data.
• Node history and the earlier versions it keeps: as long as the node is kept. They are deleted when the node is erased, and a Pixl's earlier pictures when that Pixl is destroyed; a picture is deleted when no kept version still uses it.
• Everything else: until you delete it or leave Glob Social, apart from what is listed under "What stays after you leave".

Security

Connections to Glob Social are encrypted with HTTPS. Sign-in session tokens and invitation codes are stored only as hashes, push messages are encrypted for your browser, and our server logs leave out IP addresses and the query part of web addresses.

Content on Glob Social is not end-to-end encrypted: it is stored on our servers in a form we can read, so do not post anything you need to keep secret. No system is perfectly secure. If we learn of a breach that affects your information, we will tell you as the law requires.

Where information is processed

Your information may be stored and processed outside Canada and outside the country where you live, including in the United States, where Cloudflare, Anthropic, OpenAI and Resend are based. Information held in another country is subject to that country's laws, and its courts and authorities may be able to obtain it.

Your rights

In Glob Social itself you can see and change what you have made, change your privacy settings, turn notifications off, block people, export your data and leave.

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia's Personal Information Protection Act, you can ask to see the personal information we hold about you, ask us to correct it, and withdraw your consent to how we use it. Withdrawing consent can mean that you can no longer use some or all of Glob Social. Depending on where you live, you may have other rights as well, such as asking us to delete your information or objecting to how we use it.

To make a request, email [email protected] with your Glob Social username; to delete your account or your data, you can also email [email protected]. We may ask you to show that the account is yours, for example by signing in.

If you are not satisfied with how we handle a request or a concern, you can complain to the Office of the Information and Privacy Commissioner for British Columbia or the Office of the Privacy Commissioner of Canada, or to the data protection authority where you live.

Related policies

This policy covers Glob Social. Your Colli account is covered by the Colli privacy policy at https://colli.dev/privacy. The Glob Capture browser extension has its own privacy notice at https://www.glob.social/capture/privacy. Our Terms of Service are at https://www.glob.social/terms.

Changes to this policy

When we change this policy, we update the date at the top of this page. If a change affects how we use information you have already given us, we will also tell you in Glob Social before it takes effect.

Contact

Glob Social is operated by Colli Labs Inc. (British Columbia, Canada), the organization responsible for your personal information on Glob Social. For questions about this policy or about privacy on Glob Social, email [email protected]. For requests about your account, your data or deleting it, email [email protected].