Privacy policy

Who is responsible

Ivan Korost, an independent developer, is the data controller for glidepad.app and the Glidepad extension. Contact: support@glidepad.app.

No company has been registered for Glidepad yet. When one is, its name and registered address will be stated here, before the first sale.

The extension

• What it processes. Scroll events from your touchpad — two numbers and a timestamp each — to recognise gestures. This happens in the page, in memory, and is discarded immediately. It is never written down and never leaves the machine.
• What it does not read. Page content, form fields, passwords, browsing history, the addresses of pages you visit. None of it is read, and none of it is needed to detect a swipe.
• What it stores. Your own settings: whether Glidepad handles swipes at all, the addresses you assigned to each direction, what two flicks at the top of a page do, which pinch gestures are on, and the recognition thresholds. They are stored through the browser’s own storage API.
• Where those settings go. If you are signed into your browser with sync switched on, your browser copies them to your browser account — that is a transfer to Google, Microsoft or Mozilla under their own privacy terms, not to us. We have no access to it and no copy of it.
• Network. The extension makes no network requests of any kind. There is no analytics, no crash reporting, no update ping beyond the browser’s own extension updates.
• Permissions. The only permission in the manifest is storage. The extension does run on every site, which the browser reports as “read and change all your data on all websites”. That is the permission gestures require, because gestures happen everywhere; it is not a description of what Glidepad does with it.
• Chrome Web Store Limited Use. The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. In practice there is nothing to adhere to: the extension asks for no Google API access and sends no data anywhere.

This website

• Hosting. Static pages served by Cloudflare Workers. Cloudflare processes IP addresses and request metadata to deliver and protect the site, as our hosting provider.
• Cookies. None from us. No tracking pixels, no session cookies, no consent banner, because there is nothing to consent to. Cloudflare may set a short-lived security cookie of its own where its bot protection is switched on; it carries no identifier we can read and is not used to track you.
• Analytics. No analytics service, no script, no profile of you. We do count requests to a couple of our own pages on our own side, in our own database, to see whether anyone is interested in the paid version. What is stored is a number per day and nothing else — no cookie, no identifier, no IP address, no user agent, and nothing leaves our hosting.
• Fonts. Typefaces are loaded from Google Fonts, so your browser makes a request to fonts.googleapis.com and fonts.gstatic.com, and your IP address is visible to Google in the process. Nothing else is sent, and no cookie is set by that request.
• The live gesture check. Runs entirely in your browser. The numbers it shows are never transmitted anywhere.

The launch notification list

If you enter an email address to be told when Pro opens, we store that address for one purpose: sending that one message. The legal basis is your consent, given by submitting the form. The address is deleted once the message has gone out, or sooner if you ask. It is never sold, never shared and never added to any other list.

Payments

Nothing is for sale yet, so no payment data is collected at this stage — not by us and not by anyone on our behalf.

When Pro opens, purchases will be handled by a third-party merchant of record: an authorised reseller that becomes the seller of the licence. It will collect your name, email, billing address, tax location and payment details as an independent controller of that data, and it will be named on this page, with a link to its own privacy notice, before the first sale. We will never see or hold your card details.

What we will receive is order-level information: your email address, country, which plan you bought and what it cost. We use it to issue your licence and answer support questions, and we keep it only as long as the tax law of the place the business is registered in requires records of a sale to be kept — several years in any jurisdiction it could end up being. The exact period is named here once that registration exists.

Support email

If you write to us, we keep the correspondence for as long as it takes to resolve the matter and a reasonable period after, then delete it.

Your rights

You can ask for a copy of what we hold about you, ask for it to be corrected or deleted, object to processing, or ask for it in a portable form. One email to support@glidepad.app is enough; there is no form and no fee, and the answer usually arrives the same week. If you are in the EEA or the UK you may also complain to your national data protection authority.

International transfers

The site is served from Cloudflare’s global network, so data may be processed outside your country; Cloudflare relies on standard contractual clauses for those transfers. The same will apply to the payment provider once one is in place.

Children

Glidepad is not directed at children under 16 and we do not knowingly collect their data.

Changes

If this policy changes, the date at the top changes with it. Changes that affect what we collect are announced on this page before they take effect.