Privacy policy

Effective and last updated: November 6, 2026
App: GlowRally · Android package: com.abelchanger.glowrally
Developer: AbelChanger · Contact: abelchanger@gmail.com

This policy describes the current GlowRally Android app and this support website. GlowRally processes creations and visualization inputs on your device. The app has no app account or advertising SDK. Versions that include Google Analytics for Firebase and Firebase Crashlytics offer them only through the optional adult choices described below; versions without those SDKs do not perform this collection. Subscription features use Google Play Billing and an AbelChanger verification service when available. We do not sell your personal information.

1. Information used on your device

• Creations and settings: text, styles, clock preferences, favorites, works, drafts, effect parameters and calibration are stored in private app storage.
• Selected images: Android’s document picker lets you select an image. A private copy is used as a background. The app does not request access to your entire photo library or upload the image.
• Audio: when you select microphone rhythm, audio samples are analyzed in memory to drive effects; the app does not save audio recordings or send audio to a server. Supported device-music rhythm uses Android audio visualization data locally. Automatic rhythm is available without microphone input.
• Media access: if you enable Android notification access for media-related behavior, the app can access media sessions and notifications to identify the media app, playback state and artwork for local visual behavior. Known media app package names may be retained in local settings. Notification message text is not retained by the app. Android grants notification-listener access broadly; only enable it if you want the media features.
• App visibility: the app declares usage access and can query launcher apps. If foreground-app filtering is enabled, foreground app events and selected app identifiers are processed locally to decide where a floating display is visible. These are not sent to us.

2. Permissions and background operation

Microphone permission supports microphone and supported device-audio visualization. Overlay permission allows a display above other apps. Notification permission supports a visible playback notification and stop action. A foreground service keeps a user-started floating display active; microphone input may continue while that display runs after you leave the app, with Android’s microphone indicator and an ongoing service notification. Stop playback to end capture. Notification access and usage access are separate Android special-access settings. You can deny or revoke access in Android Settings; related optional features may then be unavailable.

3. Optional adult analytics and crash reports

In versions that include these services, open Settings → Help improve GlowRally to choose independently whether to enable usage analytics or crash reports. Collection is off until an adult explicitly agrees. No age is preselected. The age range is stored only on your device, not sent to Firebase. Choosing under 18, declining to state an age, or leaving age unknown keeps both services off. App access does not depend on consenting, and there is no mandatory startup consent prompt.

On the first adult selection, both switches are preselected only in the uncommitted settings draft. You can turn either off. Nothing is authorized by selecting an age alone: Agree and enable explicitly saves any enabled services; Apply saves an all-off choice. Cancel, Back or dismissing the sheet does not save the draft. Previously committed adult opt-outs are retained rather than automatically turned on again. Firebase is not initialized at session startup without an eligible adult opt-in; builds without working collection configuration do not collect data.

• Usage analytics: helps us understand feature use and improve usability. Our custom events use fixed categories for screens, creative categories, editor entry type, save outcomes and playback outcomes. After opt-in, the SDK also processes automatic app/session events, device and app information, and pseudonymous app-instance/session identifiers. It may derive approximate location from an IP address; we do not request precise location for analytics. The SDK may automatically record in-app purchase interaction metadata, such as product, currency and value. This is separate from purchase-token verification.
• Crash reports: helps diagnose reliability problems. Diagnostics initialization starts on a later cold launch after consent. Reports can contain fatal stack traces, supported application-not-responding reports, application/device state, technical exception context, and pseudonymous installation/session identifiers. Our manually recorded nonfatal diagnostics use fixed category/stage values rather than arbitrary messages. Fatal exception messages and stack context can contain technical metadata, potentially including user-derived values such as paths; we do not claim every SDK-generated exception context is sanitized.

Our custom events and manually recorded diagnostics do not include your created text, work names or IDs, file names or files, images, audio, purchase tokens, payment credentials, review codes or review tokens. We do not set a personal user ID in either service. There is no creation-content upload feature. Advertising ID permission and collection are disabled; ad storage, advertising user data and ad personalization are not enabled. Optional analytics is not used to personalize advertising.

Google provides Analytics and Firebase processing. Their services may process data in countries where Google or its service providers operate. See Firebase privacy and security, Google Analytics data collection, and Google’s privacy policy. We do not sell personal information.

4. Transmission, sharing and third parties

Google Play Billing SDK diagnostics: the Billing library integrated in the app separately sends technical operational diagnostics to Google, including connection or query results, app/SDK/Android version information and a temporary Billing client session identifier. The identifier correlates SDK events within that client session and is regenerated when a new client is created. This processing supports Billing and SDK reliability, is separate from Firebase Analytics and Crashlytics, and is not controlled by the optional switches in section 3. Google’s applicable policies cover Billing service data; Firebase retention controls do not apply to these SDK diagnostics.

Subscriptions: to check or restore subscription status, the app contacts our verification service over HTTPS. Google Play purchase tokens, when present, are sent to that service and then to the Google Play Developer API to verify the purchase, current entitlement and renewal status, and acknowledge a verified purchase. The service processes purchase tokens transiently, does not store them in a database, and does not log tokens or request bodies. The service receives ordinary connection information such as the IP address; in-memory request limits help protect the endpoint. Optional review access sends the entered access code or a signed access token over HTTPS to our verification service. The code is checked against a private hash; the service does not log or store request bodies, codes or tokens. The app stores only the signed token in private storage until removal or expiry and does not save the entered code. This independent access does not create a Google Play purchase. We do not receive your payment card number or Google password. Google handles checkout, payment methods and cancellations under its own privacy policy. Availability, eligibility and prices are shown from Google Play before authorization.

The app does not upload creation files, images, audio samples or media metadata to AbelChanger. Optional analytics and diagnostics can transmit the data described in section 3 to Google; they are not a cloud backup of your works. Android and Google Play process platform diagnostics, store activity and payment information under their own policies. Opening this website or an email link launches a separate browser or mail app, governed by that provider’s policies.

This website is hosted on Alibaba Cloud. Requests expose ordinary connection information such as your IP address, requested URL, browser information and request time to the hosting server. Server access and error logs are used for operation, security and troubleshooting. This website does not embed advertising, analytics trackers or a contact form and does not set application cookies. See Alibaba Cloud’s privacy policy.

App and request integrity: starting with version 0.32.5 (37), GlowRally does not include Firebase App Check or Google Play Integrity token collection. Earlier internal test versions 33–35 included these security checks; version 36 disabled them. Current versions continue to verify subscriptions and review access over HTTPS. Optional Analytics and Crashlytics remain governed by the consent controls described above. Historical test versions contacted Google for app metadata, Play licensing status, device attestation and protected-request digests; those checks did not upload creations or replace subscription verification.

5. Retention and deletion

Local works, imported image copies and preferences remain until you delete the relevant item, clear app storage or uninstall the app. Removing a work does not guarantee immediate removal of shared or draft image copies; clear app storage to remove all app-private data. Original images outside app storage are unaffected. Audio samples are transient and are not saved as recordings. Nginx logs rotate daily and retain 14 rotated logs; operational backups or incident records may remain longer when needed for security or legal obligations. Support emails are retained while needed to answer and resolve requests or comply with applicable obligations; request deletion by emailing us. Do not send sensitive information unnecessarily.

Telemetry controls: return to Settings to turn either service off or choose a non-adult/undisclosed age. Revocation blocks future app-authorized uploads for the disabled service. The app requests an Analytics reset and/or deletion of unsent crash reports as applicable; SDK cleanup is asynchronous, so changing a switch is not proof that every local SDK file has already been erased. Already sent or in-flight data cannot be recalled by changing a switch. Crashlytics automatic upload remains disabled. The app manually permits only reports from eligible, continuously consented prior sessions; revocation marks pending history ineligible. On a later startup, old pending reports must be purged and the empty-queue check completed before future report sending is permitted. Re-enabling does not authorize uploading reports retained from an ineligible period. Crash-reporting changes may require the next cold launch.

Turning a service off, resetting local SDK data, clearing app storage or uninstalling does not itself delete information already sent to Google. Analytics user/event retention follows the property’s configured retention controls; those controls do not cover every aggregated report. See Analytics retention controls. Firebase states that Crashlytics keeps crash traces and associated identifiers for 90 days before beginning removal from live and backup systems; this is not a guarantee of complete deletion on day 90. See Firebase retention information. For access or deletion requests, email abelchanger@gmail.com. We will assess what records can be identified and what deletion the provider supports; we cannot promise to match every pseudonymous report to a person or instantly remove server backups. Do not email passwords, payment credentials or review codes.

6. Security, children and your choices

App-private storage is protected by Android’s app isolation. The website and telemetry services use HTTPS. No system can guarantee absolute security. GlowRally’s intended audience includes children under 13. The app does not require a name, email address or date of birth, and has no app accounts, public uploads or user-to-user messaging. Creations, selected images and audio inputs are processed on the device as described above. Subscription verification sends Google Play purchase tokens, when present, to our verification service as described in section 4; permission to use free features does not require purchasing a subscription. Optional Analytics and Crashlytics collection is unavailable to all users under 18 and to users whose adult eligibility is unknown or undisclosed. Age choices stay on the device. Parents or guardians should supervise permission choices and purchases for children. Please avoid sending a child’s personal details in support email. If you believe we have received a child’s personal information, contact us so we can review and handle the request. For questions, access or deletion requests concerning information you have sent us, contact abelchanger@gmail.com. No app-account deletion flow is needed because the current app has no account.

7. Changes

We will update this policy when data practices change, including before introducing new services, accounts or content uploads. The date above identifies the current policy. Material changes will also be disclosed where required in the app.