Privacy policy

Effective November 6, 2026

Gloss is a Chrome extension that changes a website the way you describe it. This policy covers the extension, the Gloss server it talks to, and this website. “We” means the people who make Gloss.

When Gloss sends anything

The extension sends page content only when you explicitly ask it to create or edit a tweak: when you press Create tweak, Update tweak, or choose an example. Marking an area on its own only draws on your screen. The mark is sent with the request you write next.

Saved tweaks run locally in Chrome. Running one does not contact us.

Two other requests reach our server, and neither carries page content:

• When you open the side panel, it checks that the Gloss server is reachable. That check does not include the page, its address, or anything about you.
• If you sign in to sync, Gloss sends your tweaks when they change, so your other browsers receive them. See Sync.

What a request contains

When you ask for a tweak, the extension reads the current tab and sends:

• Your message, and the earlier messages in that tweak’s conversation.
• The page address and domain.
• A trimmed outline of the page’s structure and text. The values of form fields are left out.
• Some of the page’s CSS and a few computed styles.
• A short network snapshot. On a domain where you already keep a tweak, this can include previews of requests and responses the page made.
• A screenshot of the visible tab, only if you allowed screenshots. If you marked an area, a crop of it and the elements inside it.
• While the model is working, answers to a few read-only questions it asks about the page, such as whether an element exists or what color it is.

Before anything leaves the browser, Gloss removes query parameters that look like tokens and fields named like password or access_token. This filtering is automatic and cannot catch everything. Do not use Gloss on a page that shows information you would not want sent to a model provider.

What our server does with it

The Gloss server turns your request into a prompt, sends it to a model provider, and returns the script the model writes. It does not write page content to disk, does not keep it after the request ends, and does not use it to train models. Our own logs record only that a request happened, whether it succeeded, and how long it took.

The server runs on Google Cloud. Google keeps standard request logs for the service, such as the IP address, time, and path of each request, under Google Cloud’s privacy notice.

Third-party model providers

Gloss does not run its own model. The content of your request is sent to a third-party large language model provider, currently xAI (Grok), and possibly OpenAI as a fallback. Those providers receive everything listed under What a request contains.

Each provider handles that data under its own terms and privacy policy. Depending on those terms, a provider may log, keep, review, or use the data, for example for abuse monitoring or to improve its services. We do not control what providers do with data and are not responsible for it. If that is not acceptable for a page, do not send a request from it.

Sync

Sync is optional and off until you sign in with Google. Without it, nothing about you or your tweaks is stored on our side.

When you sign in, Google tells us your verified email address and your Google account ID. We do not receive your password, contacts, or anything else from your Google account. While you are signed in, we store:

• Your Google account ID and email address, so your tweaks belong to you.
• Your tweaks: the domain, name, script, where and when it runs, whether it is on, and when it was created and changed.
• The last 40 messages of each tweak’s conversation, so you can keep talking about it in another browser.
• A list of tweaks you deleted, so the deletion reaches your other browsers.
• A sign-in session, stored as a one-way hash. It expires after 180 days.

Synced data is kept in Google Cloud Firestore. It is not reachable from a browser directly, only through the Gloss server after you sign in. Signing out stops syncing. To delete everything we hold for your account, write to us at the address below and we will remove it.

What stays in your browser

Tweaks, their conversations, imported userscripts, and your sign-in session are kept in Chrome’s local extension storage. Uninstalling Gloss removes them from that browser. A synced copy stays on our server until you ask us to delete it.

Chrome permissions

Gloss reads a tab when you send a request, and runs saved tweaks only on domains you have allowed. Access to all sites is optional and used only for screenshots, because Chrome allows screenshots in no narrower way. You can refuse it and tweaks still work. The full reason for each permission is in the Chrome Web Store listing.

Generated scripts and no warranty

Tweaks and replies are generated by a language model. They can be wrong. A tweak can break a page, hide something you need, change what a form sends, or stop working when the site changes. A script runs with the access Chrome gives user scripts on that domain, including in the page’s own JavaScript if you choose that. Read the script before you keep it, and turn off or delete a tweak that misbehaves.

Gloss, its server, and everything they generate are provided “as is” and “as available”, without warranties of any kind, express or implied, including fitness for a particular purpose and non-infringement. To the fullest extent the law allows, we are not liable for any loss or damage that comes from using Gloss, from scripts or other output a model generates, or from third-party services, including model providers and the websites you change. You are responsible for how you use tweaks, including following the terms of the sites you change.

What we do not do

• We do not sell data, or share it beyond the model provider and the hosting described here.
• We do not use it for advertising, profiling, or credit decisions.
• We do not track you across sites, and the extension has no analytics.

Gloss’s use of information received from Chrome follows the Chrome Web Store User Data Policy, including its Limited Use requirements.

This website

This site is a set of static pages on Firebase Hosting. It sets no cookies and runs no analytics. Google keeps standard request logs for it, such as IP address and time.

Children

Gloss is not meant for children under 13, or under 16 in the European Economic Area and the United Kingdom. We do not knowingly collect their data. If you think a child has signed in to sync, write to us and we will delete the account.

Your choices

You can use Gloss without signing in, refuse screenshots, turn off or delete any tweak, and sign out at any time. You can ask us what we hold for your account, ask for a copy, or ask us to delete it. Depending on where you live, you may have further rights under laws such as the GDPR or the CCPA. Write to us to use them.

Security

Traffic between the extension and our server uses HTTPS. Sign-in sessions are stored only as hashes, and the database is closed to direct access. No system is perfectly secure, so we cannot promise that data will never be exposed.

Changes

If this policy changes, the date at the top changes with it. If a change affects what we store or who receives it, we will say so in the extension before it applies to you.

Contact

Questions, or a request to see or delete your data: gabay.ephi@gmail.com.