Privacy policy — Glow Meetings

This policy explains what Glow Meetings — operated by AXI Technologies ("we", "us") — collects when you use the website, the web app and the desktop and mobile apps, and why.

Operator: AXI Technologies — meet@glow-workspace.com
Privacy contact: privacy@glow-workspace.com
Jurisdiction: Pakistan

What you give us#

When you create an account:

Name — first and last name, shown to other participants.
Email address — used for sign-in and verification codes.
Date of birth — required at signup.
Company — optional.
Password — we store a scrambled check value, never the password itself.

When you verify your email or reset your password, we issue a 6-digit code by email. Codes are valid for 10 minutes, stored scrambled, and deleted about a day after they expire.

Guests join meetings from a link with just a display name — no account. A guest gets a throwaway identity for that visit, cleared from the device when they leave.

What your devices tell us#

Each device you sign in on registers:

A device name and type (for example, "iPhone" or "Pixel 9").
Public security credentials — the keys that identify the device to the encrypted meeting system.
Attestation details where the platform provides them (for example, whether the device passed its manufacturer's integrity checks, and security patch levels).
When it was registered and last active.

You can see and manage this list yourself under Devices, including signing a device out.

What meetings tell us#

To run meetings we store:

Meeting details — the title (which the host chooses — keep sensitive names out of it), the schedule, admission settings, and a scrambled check value for the passcode — not the passcode itself.
Who took part — display names and guest labels, roles, when each person joined and left, and their network (IP) address at join. The IP of the account that started the session is recorded too.
A session timeline — durable records of who was admitted, denied, removed or left, and role changes. This timeline doesn't store IP addresses.
That messages and files moved — encrypted chat and files pass through our servers as ciphertext; we see that something was sent, when, and how large an encrypted file is — never the contents, filenames or file types.
Call ratings you choose to give — an optional 1–5 rating, any reasons you pick (audio, video, connection, other), and basic device and app-version details. Rating a call is always your choice.

What we can't see#

End-to-end encryption is architectural, not a promise we could quietly break:

We can't see or hear your audio, video or screen shares.
We can't read chat messages.
We can't see the contents or names of files you share.
We can't read the chat history your own devices keep.
We don't record meetings — there's no recording feature.

On your own devices#

The apps keep some data locally, under your control:

Chat history — each device that was in a meeting saves its own encrypted copy, kept for 7 days and erased when you sign out. Guests' copies are erased when they leave. You can clear it any time in Settings → Security & privacy → Clear now.
Sign-in secrets — on the desktop apps, your sign-in and keys are kept in your computer's system keychain or credential store.
Cookies — the web app uses a session cookie to keep you signed in. With Keep me signed in off, you're signed in for the browser session (up to about a day); with it on, you stay signed in across restarts.
We don't run advertising or analytics trackers, and the apps don't embed third-party analytics or crash-reporting kits.

Security and abuse signals#

To protect accounts and the service we also process:

Security events — failed sign-ins, password resets, rate limiting and suspensions, logged with IP addresses.
Anti-abuse checks — a third-party human-verification step may run at signup, sign-in or guest join when our abuse counters trip; your IP address is shared with that provider for the check.
Connection integrity reports — the mobile and desktop apps can report whether the encrypted connection to our servers was intercepted, including hostname, app version, platform and IP.

What we use it for#

Running the service — accounts, meetings, admission, encrypted media relay, delivery of chat and files.
Securing it — verifying devices, preventing abuse, keeping the audit trail.
Enforcing plan limits — meeting length, people, concurrent meetings, devices.
Communicating with you — verification and password-reset emails, service notices.

We don't sell your personal data, and we don't use meeting metadata to build advertising profiles.

Email delivery — verification and reset emails go through an email provider.
Anti-abuse verification — as described above.
Legal requests — we may disclose stored data where the law requires it. Meeting content still can't be provided — it isn't readable on our servers.

How long we keep it#

Participant records (names, roles, join/leave times, IPs) — deleted about 7 days after the meeting ends.
Encrypted chat and file records on our servers — deleted about 7 days after the meeting ends; abandoned file uploads after about 2 hours.
Session timelines — kept while the meeting is in your list; deleted when you remove the meeting or delete your account.
Meeting history lists — past meetings are shown for 7 days.
Guest accounts — deleted once their sessions end and nothing still references them (at least a day old).
Sign-in records — kept while a sign-in is active, up to about 12 months after a sign-in chain begins.
Devices — inactive devices are signed out automatically after a long, operator-set period.
Verification codes — deleted about a day after they expire.
Local chat history — 7 days on your device, erased on sign-out.

Your choices#

See and fix — your name, devices and meetings are visible in the app; you can rename devices, edit meetings and correct your details there.
Clear local data — Clear now erases chat history on the device you're using; signing out erases it too.
Delete your account — in Settings → Account. It permanently removes your account, devices, meetings, participant records and the encrypted data tied to them from our servers. It can't be undone.
Other requests — access, portability, correction, restriction or other privacy requests: privacy@glow-workspace.com

Children#

Glow Meetings is a business service. You must be at least 13 years old to use the service. If you are under 18, you may use it only with a parent or guardian's consent.

International transfers#

Our servers may be in a different country to you. As of now, our servers are in Pakistan. By using the service you consent to your data being transferred to and processed in that country.

Changes#

If we change this policy we'll update this page and the date above. For significant changes we'll aim to give reasonable notice through the service.