Privacy Policy

What we store

We store your email, a password hash (argon2id), your subscription state, and metadata about your connections (service, status, connected account email, daily request counts). We also keep a count of your account's MCP calls for each month, which we use for the Free plan's monthly limit of 1,000 calls.

For the AI apps you sign in and the API keys you create, we keep each app's name and the host it returns to, the name and version it reports, each key's label and first characters, and when each was created and last used.

OAuth tokens and API keys are stored only as SHA-256 hashes, never in plaintext, so nobody can read them back. The dashboard shows a key in full only once.

Connected accounts and requests

OAuth credentials for connected services (for example, Google refresh tokens) are stored encrypted in Glesso's database, under a key only Glesso's background worker holds. Each call to Google uses a short-lived access token for that one account.

Request contents are proxied, not stored. Our application logs carry connection IDs, never tokens or message bodies. The Google Workspace server's logs on Glesso's own servers can include the account's email address, the tool name and its arguments.

Payments and email

Payments are handled by Stripe. We never see your card number.

We use your email only for account verification, password resets and service notices. No marketing without consent, and no selling data, ever.

Deleting data

Deleting a connection destroys its container and archives its data for a short retention window before removal. Contact us to delete your account entirely.

Unofficial Telegram connector

The Unofficial Telegram connector is an unofficial client built on the Telegram API. Glesso is not affiliated with Telegram. Connecting it signs in to your Telegram account as a device called “Glesso”.

Chats, messages and contacts are fetched from Telegram on demand, only when your AI app calls a tool, and passed to that app. We do not keep copies of your messages. Glesso never uses Telegram data to train AI models.

The Telegram login session is stored only in the container dedicated to your connection, as a file on our server. It never enters our database or logs and is never backed up or copied. Besides the login it holds Telegram's usual cache of the accounts and chats it has seen (IDs, usernames, names and, where Telegram shows them to you, phone numbers) and any contact aliases you create through the connector. All of it is deleted with the session.

Our database keeps your Telegram user ID, the account label shown in your dashboard (your username or first name, deleted when that session is signed out), and a history of your sign-in attempts and disconnections.

Disconnecting signs Glesso out of your Telegram account on Telegram's side and deletes the session. If Telegram stays unreachable for 24 hours, we delete the session anyway and ask you to end the “Glesso” device yourself, under Settings and then Devices in Telegram.