Privacy Policy

Last updated: 22 October 2026

This policy covers the Gloss desktop app (macOS, Windows and Linux) and the Gloss browser extension (Chrome, Firefox and Safari). Gloss is free, open-source software made by Aayush Chawla. Its source code is public at github.com/aayushch/gloss, so every statement below can be checked against the code.

1. What Gloss stores, and where

Everything Gloss keeps is stored on your computer, in the .gloss folder in your home folder:

• Your conversations, the clarifications you ask in them, and your settings, in a local database (gloss.db).
• Files you attach to messages, and the artifacts (pages, drawings, documents) the agent writes.
• For web pages you ask about through the extension: the page's address and title, the passages you highlighted with a few words of surrounding text so the highlight can be found again, your questions and the replies.
• Application logs, used only for troubleshooting on your computer.

None of this is sent to the maker of Gloss or to any server operated for Gloss. There is no such server.

2. The AI agents you use

Gloss does not contain an AI model and never calls a model provider's API itself. It runs the command-line agent you installed and chose (Claude Code, Codex CLI, Gemini CLI, Pi or Cursor Agent) on your computer, under your own account with that agent's provider.

When you send a message or ask about a passage, Gloss gives that agent your message, the quoted passage, any attached files and, for web pages, the page's address and title. If Send page text is on in Gloss's settings, it also includes the visible text of the page (shortened when the page is very long), so the agent can answer in context; it does this once per version of a page. The agent then sends this to its provider to produce a reply.

What the provider does with that data is governed by your agreement with them (for example Anthropic, OpenAI, Google or Cursor), not by this policy. Turn off Send page text, or add sites to Gloss's list of sites to leave alone, to limit what reaches them.

When you add a project folder, Gloss reads the session history those agents already keep on your computer for that folder, so you can open and continue those sessions. It reads these files locally and does not upload them anywhere.

3. The browser extension

The extension works only together with the Gloss desktop app on the same computer. It talks to the app through the browser's native messaging (Chrome and Firefox) or through a connection to the app on your own computer (127.0.0.1) protected by a secret token (Safari). It does not send data to any other place, and it does not make network requests of its own.

What the extension reads and sends to the app:

• The text you highlight and the question you type, when you ask about it.
• The address and title of the page you ask on, so the note is saved for that page and shown again when you come back.
• The page's visible text, when you ask and Send page text is on.
• On pages where you already have notes, the extension searches the page's text in your browser to place their highlights. It reports to the app only whether each note was found.

The extension runs on every site because you can ask about text anywhere, but it reads a page's content only for the purposes above. It does not record your browsing history, does not run in private or incognito windows, and stays off on the sites you list in Gloss's settings.

In the browser's own storage, the extension keeps a copy of the settings the app sends it (such as the sites to leave alone), its connection status, and where you placed the note navigator on screen. This stays in your browser.

The extension's use of information received from Chrome APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Data is used only to provide the extension's single purpose: asking Gloss about text you highlight. It is never sold, never used for advertising, and never transferred to anyone else.

4. Network connections Gloss makes

• Update checks. The desktop app checks GitHub for a newer release and downloads it from GitHub when you choose to update. The Firefox extension checks GitHub for updates, the Chrome extension is updated by the Chrome Web Store, and the Safari extension updates with the app. As with any download, GitHub, Google or Mozilla can see your IP address under their own privacy policies.
• The agents. The agent programs connect to their providers as described in section 2. Gloss does not see or change those connections.

Gloss sends no analytics, telemetry, usage statistics or crash reports, to its maker or to anyone else.

5. This website

This site is hosted on GitHub Pages and has no analytics, cookies or trackers. It loads its fonts from Google Fonts, and the download list asks GitHub for the latest release, so Google and GitHub receive your IP address when you visit. The site remembers your light or dark theme choice in your browser's local storage.

6. Keeping and deleting your data

You control all of it. Delete a conversation, a note or a page in Gloss to remove it from the local database. To remove everything Gloss has stored, quit Gloss and delete the .gloss folder in your home folder. Removing the extension from your browser deletes what it keeps in the browser. Data you sent to an agent's provider is kept under that provider's policy; contact them to delete it.

7. Children

Gloss is a general-purpose tool and is not directed at children under 13. It collects no personal information from anyone.

8. Changes to this policy

If Gloss starts handling data differently, this page will be updated with the release that makes the change, and the date at the top will change. The history of this page is public in the repository.

9. Contact

For questions about privacy in Gloss, open an issue at github.com/aayushch/gloss/issues.