Privacy Policy

• Your synced notes, tasks, links and canvases are encrypted on your device before they leave it, with a key protected by a sync passphrase only you know. We store them, but we cannot read them.
• Some things are not end-to-end encrypted, and we can read them: your account details, your username, display name and profile photo, the names and members of shared projects, chat messages in shared canvases, and anything you send to Glob’s AI.
• When you use Glob’s AI, the text you send goes to OpenAI or Anthropic so they can produce the answer.
• Glob has no ads, no analytics, no tracking and no crash-reporting service. We do not sell your information or share it for advertising.
• You can delete your account at account.colli.ca/delete. Fourteen days later everything of yours is deleted, and what you shared stays with the people you shared it with. The section Deleting your account lists exactly what, and the few records we keep.

Your Colli account

You sign in to Glob with a Colli account. Glob for Web, the Android app and the Linux app need one. On Apple devices and the command line you need one for sync, sharing and Glob’s hosted AI. For the account we collect:

• Your email address and password. We store the password only as a one-way bcrypt hash, which we cannot turn back into your password.
• Apple or Google sign-in, if you choose it. The provider, the identifier it gives us for you, and the email address it shares with us.
• Sign-in sessions and devices. For each sign-in: a hashed session token, its expiry, and a device entry recording the kind of app and a device name. Glob for Web and the Android app give every browser the same generic name, so they do not create an identifier for your particular device.
• Optional profile details. A public username, a profile photo of up to 1 MB, and the display name and colour that mark your cursor in shared canvases. Your collaborators see the display name and colour.

Your notes, tasks, links and canvases

Glob for Web, the Android app and the Linux app keep your work through Glob’s sync service. The Apple apps and the command-line tool keep your work in a database on your device, and sync it only after you sign in and set a sync passphrase.

Everything Glob syncs is encrypted on your device before it is uploaded. The section What is encrypted, and what is not explains how. To sync it, our servers also handle some technical information: the kind of item (such as a note, task, link or canvas), its size, when it changed, a version number, and which account made each change.

Shared projects

• When you share a project, we store its name, its members and their roles, and the email addresses you invite. Members of a project can see each other’s email addresses and roles.
• We email each person you invite an invitation with the project’s name and a link to accept. Invitations stop working after 14 days.
• A shared canvas’s contents and its task titles are encrypted, so we cannot read them. We can see that a task assigned to someone was completed, and when.
• While you are in a shared canvas, your display name, cursor colour and cursor position are passed live to the other people in it. We do not store them.

Chat in shared canvases

Messages you send in a shared canvas’s chat are stored on our servers in readable form, with your account ID and display name. They are not end-to-end encrypted. We keep the most recent 333 messages of each canvas; older messages are deleted as new ones arrive.

Glob’s AI

Glob’s hosted AI features are optional. They run only when you use one, for example when you ask Glob a question, look something up or summarise notes. Our servers then receive what you send: your request and the notes Glob includes with it. When you ask Glob a question in Glob for Web, that is up to about 14,000 characters of notes from the canvas you have open. We pass the request to an AI provider to produce the answer and return the answer to you. This text is not end-to-end encrypted.

Of each AI request we keep:

• a copy of the answer, for 30 days, so that a repeated request is not charged twice; then it is deleted;
• a one-way fingerprint of the request, never the text you sent;
• a usage record: the kind of request, the model, the number of tokens, the estimated cost and the credits charged. It does not contain your text.

On Apple devices, Glob can run some AI features on the device itself with Apple Intelligence; those requests are not sent to us. When on-device AI is not available, Glob may use its hosted AI or your own key instead, depending on your AI settings. If you add your own API key for OpenAI, Anthropic, Google (Gemini) or xAI (Grok) in the Apple apps, requests that use it go straight from your device to that provider, under your own agreement with it, and do not pass through our servers. Your key is stored in your device’s Keychain.

API keys and connected tools

You can create API keys in Glob’s settings to let other tools you choose, such as an AI assistant, read or change your Glob data. You decide what each key can do, and you can freeze, rotate or revoke a key at any time. A request made with a key passes through our servers to a device of yours where Glob is running, which answers it; the answer passes back through our servers to the tool. We do not keep these requests or answers. What a tool does with your data is governed by that tool’s own terms. In a shared project, a key can reach the project only after every member has agreed to AI access.

Usage, credits and security records

• Credits. Your credit balance and a ledger of the credits you received and spent.
• Security records. A log of security-related events on your account, such as sign-ins and failed sign-ins, password resets, API keys created or revoked, invitations and changes to project membership. It records what happened and when, not the content of your work.

Technical information

• Our servers use your IP address to limit abuse, such as repeated sign-in attempts. They keep it only as a one-way hash inside short-lived counters.
• Our servers keep short operational logs (for example, which kind of request was made, when, and whether it failed) so we can keep Glob running and secure. The logs are overwritten on a rolling basis.
• Our hosting and network providers, Vercel and Cloudflare, handle every request to our websites and servers. That includes your IP address and browser details, and they may keep standard request logs for a limited time under their own policies.
• When Glob for Web blocks a script or resource for security reasons, your browser may send our server a report naming the blocked address. The report does not identify you, and it goes only into our short operational logs.
• The Mac app downloaded from glob.design and the Linux app check install.colli.dev for updates. The check sends the app’s version and does not include a profile of your computer.

Encrypted on your device, so we cannot read it: the contents of your synced notes, tasks and links (titles, text, tags and their details) and the links between them, and the contents and task titles of shared canvases.

Glob encrypts them with AES-256-GCM before they leave your device. The key is locked by your sync passphrase, which Glob stretches with PBKDF2-SHA256 over 210,000 rounds. Your passphrase never leaves your device and we never receive it, so we cannot recover it for you. If you lose it, and any recovery key you made, your synced data cannot be decrypted.

Not end-to-end encrypted, so we can read it: your email address, username, display name and profile photo; shared project names, member lists and invited email addresses; chat in shared canvases; the text of AI requests and answers; answers to API-key requests while they pass through our servers; and the technical information described above.

Everything travels between your device and our servers over encrypted connections (HTTPS and secure WebSockets).

• Glob for Web, Android and Linux. To work offline, Glob keeps a working copy of your notes in browser storage on your device (the Linux app has its own, in its data folders in your home directory), together with a key that unlocks it. Glob does not encrypt this copy, so anyone who can use that browser profile or computer account can read it. On the web and Android you can remove it by clearing the site data for app.glob.design in your browser. Preferences such as your theme and panel sizes are kept in the same storage.
• Android. The Glob app for Android is a thin shell that opens Glob for Web in Chrome (or another supported browser) on your phone. It stores none of your Glob data itself; your browser keeps it for app.glob.design. Android’s “Manage space” option for the app opens those site settings.
• Apple devices. The apps keep your work in a database on your device, shared with Glob’s widgets and its Apple Watch app. Some settings and small pieces of content, such as notes you add to clusters, cluster summaries, lookups and your AI model choices, are kept in your iCloud key-value storage so they follow you across your Apple devices. If you share a project through iCloud from the Apple apps, its notes are stored in iCloud and shared by Apple with the people you invite. iCloud belongs to your Apple account and is run by Apple under its terms; we cannot read it. Your sync passphrase is kept in your device’s Keychain.
• Linux. The app keeps a diagnostics log of event codes on your computer. It is never uploaded.
• Command line. The glob tool keeps its data in a folder on your computer (~/.glob unless you choose another).

Glob uses these device permissions, and your device asks you before any of them is granted:

• Camera (iPhone and iPad), to scan documents. The scan is turned into text on your device.
• Microphone and speech recognition (Apple Watch), to record voice notes and turn them into text. Transcription uses Apple’s speech recognition, which may process the audio on Apple’s servers under Apple’s terms. Glob keeps the text, not the recording.
• Notifications (Android and Apple devices), to show Glob’s notifications.

Glob does not access your location, contacts, calendar, photo library or health data. We do not collect payment information.

We use the information described above only to:

• provide Glob: sign you in, sync your encrypted data between your devices, run shared projects and their chat, and answer the AI requests you make;
• send you email about your account and the projects you are part of, such as verifying your address, resetting your password and invitations;
• measure AI use against your credits;
• keep Glob and its users secure, prevent abuse, and find and fix problems;
• meet our legal obligations.

We do not sell your information, use it for advertising or profiling, or use your content to train AI models.

We do not sell your personal information or share it for advertising. We share it only with service providers who process it on our behalf, with people and tools you choose, or when the law requires it.

Service providers

• OpenAI and Anthropic receive the AI requests you make with Glob’s hosted AI. We do not send your name, email address or account ID with them. They process the requests under their terms for business API customers; see the OpenAI privacy policy and the Anthropic privacy policy.
• Vercel hosts glob.design and Glob for Web.
• Cloudflare carries the traffic to our servers (api.colli.dev, account.colli.ca and account.colli.dev) and to our download site, install.colli.dev.
• Our email provider delivers account email and project invitations.
• Apple and Google take part in sign-in only if you choose to sign in with them. Apple also runs iCloud and speech recognition for the features described above.

People and tools you choose

• Collaborators. Members of a shared project see the project, its canvas and chat, the member list with email addresses and roles, and your display name, cursor colour and cursor position.
• Connected tools. A tool you give an API key to can read or change your data within that key’s permissions.

Legal reasons and business changes

We disclose information when the law requires it, or when it is necessary to protect the rights, property or safety of our users, the public or Colli Labs. If Colli Labs is involved in a merger, acquisition or sale of assets, information may be transferred as part of it, and this policy will continue to apply to it.

• Glob for Web sets an encrypted, HttpOnly session cookie that keeps you signed in for up to 30 days, and two short-lived cookies (10 minutes or less) used while you sign in.
• account.colli.ca and account.colli.dev each set a session cookie for the account pages that lasts up to 30 days.
• glob.design sets no cookies.

All of these are first-party cookies needed for Glob to work. There are no advertising, analytics or third-party cookies. Glob also uses your browser’s storage as described in What stays on your device.

• Account details: for as long as you have the account. The next section describes what happens when you delete it.
• Sign-in sessions: each lasts up to six months unless you sign out or end it sooner. The records are deleted when your account is deleted.
• Your encrypted synced data: until you delete it or delete your account. Deleting an item in Glob removes it from all your devices, but earlier encrypted versions of it stay on our servers, unreadable to us, until your account is deleted. To have them erased sooner, email accounts@colli.ca.
• Shared projects: until the owner deletes the project. Deleting a project removes its contents, members, invitations and chat messages from our servers. If the owner deletes their account, the project passes to the member who has belonged to it longest.
• Chat in shared canvases: the most recent 333 messages of each canvas.
• AI answers: 30 days.
• AI usage and credit records: while you have the account, and for seven years after it is deleted, for accounting. Then they are deleted.
• Security records: for as long as we need them to protect accounts and the service. They are not deleted automatically; you can ask us to remove yours at accounts@colli.ca.
• Operational logs: overwritten on a rolling basis.

How to delete it

Go to account.colli.ca/delete, sign in (you will be asked to sign in again if you have not done so in the last ten minutes), and confirm. You can also email accounts@colli.ca from the address on your account and ask us to delete it.

Asking to delete your account signs you out everywhere straight away and starts a 14-day grace period. Signing in to any Colli app during those 14 days cancels the deletion. If your account is suspended, for example under a legal hold, the deletion waits until the suspension ends.

What is deleted after 14 days

Everything that is yours alone:

• your synced notes, tasks, links and canvases, every earlier encrypted version of them, and the encryption keys that go with them;
• projects you own that nobody else belongs to, with their contents, invitations and chat;
• your membership of projects shared with you, your copies of their keys, invitations sent to you, and invitations you sent that nobody has accepted;
• your sign-in sessions, devices and API keys;
• the copies of AI answers we keep to avoid charging twice;
• your linked Apple and Google sign-ins;
• your profile photo and your cursor name and colour;
• pending sign-in and email codes;
• your email address and password hash, which are removed from the account record.

What stays with the people you shared with

• A project you own that other people belong to is not deleted. It passes to the member who has belonged to it longest, who becomes its owner.
• What you added to a project shared with others stays in it for them: your changes to its canvas, and your chat messages still within its latest 333.
• The keys you gave other members to open a shared project stay with them, with the public half of your encryption key that their devices use to check those keys. It cannot decrypt anything.

What we keep

• A minimal record of the account: its ID and the fact that it was deleted, so the records below stay consistent. Your username is held for one year so that nobody can take it to impersonate you; then it is released and the record of your past usernames is deleted.
• Security records.
• AI usage and credit records, for seven years after deletion.

Email accounts@colli.ca and we will remove your security records. We keep the AI usage and credit records for accounting.

• Glob’s AI features are optional. Nothing is sent to an AI provider unless you use one.
• You can review and end your sign-in sessions, reset your password, and change or remove your profile photo at account.colli.ca.
• You can freeze, rotate or revoke API keys in Glob’s settings at any time.
• You can view, change and delete your notes, tasks, links and canvases in Glob.

Under Canadian privacy law, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia’s Personal Information Protection Act, you can:

• ask to see the personal information we hold about you;
• ask us to correct it if it is inaccurate or incomplete;
• withdraw your consent to our use of it, subject to legal or contractual limits. If you do, we may no longer be able to provide some or all of Glob.

To make any of these requests, write to support@colli.ca. To delete your account, follow Deleting your account or write to accounts@colli.ca. We may need to confirm who you are before we act, and we will respond within the time the law requires.

Depending on where you live, you may have further rights, such as to object to or restrict how we use your information, or to receive it in a portable form. We will not treat you differently for using any of these rights.

If you are not satisfied with our response, you can complain to the Office of the Information and Privacy Commissioner for British Columbia or the Office of the Privacy Commissioner of Canada, or to the data protection authority where you live.

• Your synced content is encrypted on your device, as described above.
• All traffic to our servers is encrypted in transit.
• Passwords are stored as bcrypt hashes. Session tokens and API keys are stored only as hashes.
• Glob for Web keeps your session in an HttpOnly cookie, so scripts on the page cannot read it, and your browser never holds the token that talks to our API.
• Repeated sign-in attempts are rate-limited.

No system is perfectly secure. If we learn of a security breach that affects your personal information, we will notify you as the law requires.

Glob is not directed at children. You must be at least 13 years old to use Glob, or older if the law where you live sets a higher age for agreeing to the use of your personal information. If you believe a child has given us personal information without the consent the law requires, email accounts@colli.ca and we will delete the account.

Colli Labs and our service providers may store and process your information outside the country where you live, including in the United States. The hosted AI providers, OpenAI and Anthropic, process your AI requests in the United States.

Information processed in another country is subject to that country’s laws, and may be accessible to its courts, law enforcement and national security authorities. Wherever it is processed, we protect it as this policy describes.

We will post any change to this policy on this page and update the date at the top. If a change materially affects how we handle your information, we will tell you in Glob or by email before it takes effect.

Colli Labs Inc., British Columbia, Canada

• Questions about privacy or this policy, and requests to access or correct your information or withdraw consent: support@colli.ca
• Account and deletion requests: accounts@colli.ca