1. Who we are

Glance is operated by nlap ("NLAP.APP", "we"), a sole proprietorship in the Republic of Korea represented by Jinho Park (business registration no. 445-13-02685; 44 Manwol-ro, Namdong-gu, Incheon 21515, Republic of Korea). We decide how the personal information described in this policy is used.

One privacy contact handles all privacy matters. This role also acts as our privacy officer (Korea), data protection officer, encarregado (Brazil), grievance officer (India) and privacy contact for any other region that requires a named contact:

• Role: Privacy Officer — Jinho Park, Representative
• Email: contact@nlap.app

We write back in English or Korean. You may write in your own language.

2. In short

No email or social-login sign-up is required, and we do not use our own analytics SDK. Clock, alarm, and timer settings are local by default; optional supporter backup follows section 3 and excludes photos. Google may process limited network and device information for AdMob advertising and Google Fonts delivery. When your privacy choices allow advertising requests, eligible BASIC screens have a top banner, which PRO removes. The main clock and ringing screens have no banner.

Purchases and restoration are verified through the store and our support service. When you use support features, Glance and RevenueCat process random installation/customer identifiers and purchase records for verification, restoration, fraud prevention and purchase analytics. Glance stores its ledger through Cloudflare. Optional public names and messages are processed only when you choose to submit them. We do not receive your store-account password or payment-card details.

If you submit a message after agreeing to the new screening notice, its public name and text may be sent to OpenAI for automated safety screening. We do not send purchase, installation or ledger identifiers, receipts, alarms or photos for screening. Automated screening is not perfect; suspicious messages and screening failures await administrator review. We retain attempt, consent time, outcome and model records to avoid duplicate screening and operate safely, without copying the name or text into those records. You can use the basic clock without posting a message.

The App may request a public version-policy file hosted through Cloudflare to check update guidance. This connection includes an IP address and ordinary HTTP request information, not alarm contents or selected photos.

3. On-device information

Display, rotation, night color, vibration and snooze preferences; shower and alarm state; onboarding state are stored in SharedPreferences or equivalent operating-system storage. Local copies are removed when you clear App data or uninstall the App.

Supporters with at least one stamp may choose backup and restoration while they have 3 or more stamps or an active PRO period from a purchase or a verified rewarded ad. Selected clock/common settings, saved looks without photos, and alarm, timer and D-DAY definitions, names and dates are stored as JSON through Cloudflare, linked to the supporter ledger, and are not public. Photos, photo paths, receipts, passwords, authentication secrets, device permissions and native alarm identifiers are excluded. Restored alarms start turned off. Weekly backup is separately opt-in: the app checks on opening after at least seven days since the last success and when records have changed, not continuously in the background. The latest and previous copy remain until replaced or a verified deletion request is processed. PRO expiration and uninstalling do not automatically delete backups. Contact contact@nlap.app for deletion.

Turning weekly backup off or deleting an item locally does not erase server copies. Opting in permits automatic uploads under these conditions without confirmation each time. Backup and reward records share a random ledger identifier; connections include ordinary request information such as IP addresses. Backups are not end-to-end encrypted and the operator can access server data. Names you enter are included; avoid sensitive details in names.

The device also keeps a local copy of PRO status and expiration. Purchase-based stamps and PRO benefits are separately verified and recorded on the server for restoration; they are not device-only data. The ledger records store, product and transaction identifiers, purchase/refund state, currency and amount when provided, and verification and restoration records.

4. Google services

Versions using server-side ad reward verification send a random, short-lived ticket to Google's ad SDK. The server verifies Google's signed callback containing the ticket, ad unit, transaction and time, and links it to ledger reward records for validation and duplicate prevention. Email addresses, photos and alarm contents are not sent to Google for this purpose.

If a BASIC banner is displayed, you choose a rewarded ad, or you complete a consent flow, Google AdMob and UMP may process IP-based approximate location, product and advertising interactions, diagnostics, performance data, and device or advertising identifiers for ads, analytics, security, and fraud prevention. Data is encrypted in transit using TLS.

Google Fonts requests may include IP address, requested URL, and device or operating-system HTTP headers. Google states that this information is used to deliver fonts and protect the service, not for user profiling or targeted advertising.

5. Where data is stored and who processes it

Most Glance data stays on your device. Data leaves the device only for the features listed below.

Our own server. The supporter ledger, purchase records, ad-reward records, optional supporter backup, Hall of Fame posts and related moderation records are stored in a Cloudflare D1 database operated for us by Cloudflare, Inc. The database's location is set to the Asia-Pacific (APAC) region. This is a location hint: Cloudflare treats it as a preference, not a guarantee. Read replication is off. Cloudflare's network may handle requests in the data center nearest to you. We turned request logging off for our server (Worker observability disabled). IP addresses are used briefly for rate limiting and are not written to our database.

Service providers that process data for us:

Companies that receive data as independent controllers (their own privacy policies apply; for ads, under the Google Ads Controller-Controller Data Protection Terms):

We do not sell personal information and do not share it for purposes other than those above.

International transfers. We are based in Korea, and the providers above are mainly in the USA. Glance is not distributed in the EU, EEA or UK. For users in Switzerland: transfers to US providers rely on their data processing terms (Standard Contractual Clauses or the Swiss–US Data Privacy Framework where the provider is certified). For users in other countries: we transfer data abroad only as needed to provide the feature you use, under the providers' contracts, and we list the countries here. You can avoid the transfers to our server and its providers by not using purchases, backup or the Hall of Fame. The clock, shower, timer and alarms work without them. Ads (Google AdMob) and fonts (Google Fonts) are handled directly by Google's SDKs in the app, so this does not avoid them (see section 6 for ad choices).

6. Choices and permissions

Ads are requested only after the consent step for your region is complete. You can change your ad choices as follows.

• Where Google shows a privacy form (for example Switzerland and US states with privacy laws): open Common Settings → Privacy → Change personalized ad consent to change or withdraw your choice at any time.
• iPhone: Glance asks for tracking permission (App Tracking Transparency). You can change it in iOS Settings → Privacy & Security → Tracking. The request is optional, and declining it does not block the BASIC clock.
• Android: you can delete or reset your advertising ID in the device settings (usually Settings → Google → Ads, or Settings → Security and privacy → Other privacy settings → Ads, depending on the device).
• Everywhere: if the in-app row is not shown in your region, use the OS setting above. With the advertising ID removed or tracking refused, Google can still show non-personalized ads.

Ad choices do not affect Google Fonts downloads. You can use the BASIC clock without a rewarded ad. The main clock has no banner; other eligible screens may show one. Alarm permissions are used only to deliver alarms and do not read screen content, contacts, photos, files, or precise location.

7. How long we keep data

The shorter periods in this table apply from the date this policy takes effect.

Google, Apple, RevenueCat, OpenAI and Cloudflare keep their own records under their own retention policies. Deleting data from Glance does not refund a purchase. Refunds go through the store.

8. Your rights

You can ask us to:

• tell you what personal information we hold about you and give you a copy;
• correct it;
• delete it;
• stop or restrict a use, or withdraw a consent you gave (for example, Hall of Fame screening or personalized ads).

Send the request to contact@nlap.app. Because Glance has no account, we need a way to find your records: create a Privacy inquiry code in the app (Common Settings → Privacy → Privacy Policy → Privacy inquiry code) and send it with your request. If you cannot create one, write to us anyway and we will agree another way to confirm the records are yours. Never send passwords, payment-card details or store sign-in data.

We answer within 45 days, or sooner where your local law requires it — for example within 10 days in Korea and within 30 days in Switzerland. If we need more time, we tell you why before the deadline. Before deleting anything that affects your benefits (for example PRO or restore), we tell you the effect and ask you to confirm. We may keep some records when we need them for a legal duty, a refund or a dispute; we will tell you which ones and why.

You can delete your own Hall of Fame message in the app at any time.

If you are not satisfied with our answer, you can complain to the data protection authority in your country. Korean users: see the Korea-only additional notice in the Korean part of this page.

9. Deletion and contact

When you generate a privacy inquiry code, we retain its hash and existing installation/store/ledger association for up to 7 days. Minimal records of a used code (request reference, association, operator and time) are retained for 90 days. Generating a new code invalidates the previous code. The code identifies the inquiry scope; it does not authorize deletion or disclosure of personal data by email. You can contact contact@nlap.app even if code generation is unavailable.

Photo scenery reads only photographs you select in the system picker, up to 10. Cropped PNG copies stay in app-private storage, without source filenames or photo metadata. Photos are not sent to our servers or advertising SDKs. Originals remain untouched. Removing an app photo also removes its references from saved looks. The photo directory is excluded from cloud backup, so a new device may require selecting photos again. System-picker downloads from iCloud or other providers follow those providers' policies. No camera, microphone, or broad photo-library permission is requested.

Clear App data or uninstall the App to delete local data. Google-processed information follows the Google Privacy Policy. Platform backups may retain and restore settings; photo copies are excluded from app cloud backup. Uninstalling does not itself delete store purchase history, server records or records held by service providers.

Deleting your supporter message clears its public name and text; consent, posting-credit and purchase records remain for their separate purposes. Purchase and restoration records support continuing benefits, restoration and refund/dispute handling. For a request about other server data, contact contact@nlap.app. We verify ownership and explain the scope, effects and any justified retained records before processing; a receipt number alone is not deletion authority. Do not send passwords or secret authentication values. Whole-ledger erasure is not an in-app function. Contact us to request a review of the scope and effects before any such processing. Deleting RevenueCat records does not itself refund a store purchase. Provider records and backups require separate handling; we do not promise instant erasure everywhere.

10. Security incidents

If a security incident affects your personal information, we will contain it, assess the risk, and notify the authorities that require notice — generally within 72 hours of learning about it, or sooner where local law requires. Where there is a real risk to you, we will also tell you without undue delay what happened, what data was involved, what we did and what you can do. Because Glance has no account email, we tell affected users in the app and on this page, and by email if you have written to us.

11. Children

Glance is not directed to children. We do not knowingly collect personal information from children under 14 in Korea, under 13 in the United States, or under the age of digital consent in your country, without a parent's or guardian's consent. If you believe a child has sent us personal information — for example, a Hall of Fame message or a support email — contact contact@nlap.app and we will delete it.

12. Changes and contact

If our practices change, we will update this page and the in-app notice. Contact contact@nlap.app.