This privacy policy explains what app.globus.studio stores, why it stores it, and how you can ask for a copy or deletion of your data. This privacy policy covers the website and the API endpoints documented on it. The same rules apply to visitors who read the pages and to developers who send requests.
Who runs this privacy policy
The privacy policy applies to every page on this site. GLOBUS.studio runs the site and the API. Questions about this privacy policy go through the contact page. Write from the address you used with the service so we can find the right record.
What the site stores in your browser
The site keeps one entry in local storage: gs-api-cookie-accepted. It records that you closed the cookie notice, so the banner does not appear on every page. The entry has no identifier and is not sent to the server.
The site does not run analytics, advertising pixels or session recording. Fonts and icons are served from this domain, not from a third-party CDN. If you log in to the WordPress admin, WordPress sets the usual authentication cookies for that session. Visitors who are not logged in do not receive them.
Server logs and security
The hosting provider keeps standard access logs: the caller address, the time, the requested path, the response code and the User-Agent header. We use these logs to keep the service online, investigate abuse and debug errors. The logs are not used to build advertising profiles and are not sold or shared for marketing.
Rate limiting needs a short-lived counter for each caller. The counter exists to stop one client from exhausting the service for everyone else, and it expires on its own. It is not joined to the pages you read or to any account, because the API has no accounts.
What the API receives
When you call an endpoint, the service receives the parameters you send: an IP address, a domain, an email address, a card number or a text string, depending on the endpoint. The endpoint uses the value to produce the response. It does not keep the value after the response and does not use it to train models or to build a profile.
A card number is masked in the response by default. Logs at the application layer do not contain request values. The API does not set tracking cookies and does not follow you across sites.
Cookies and the notice
The cookie notice is part of the theme. It stores your choice in local storage, not in a cookie, and it offers no optional categories because the site sets no optional cookies. Clearing site data in the browser resets the choice and the notice appears again. This privacy policy page has no form and no comment box, so reading it does not create a record.
Third parties
The site depends on a hosting provider for servers, storage and backups, and on a DNS provider for name resolution. Those providers process technical data on our behalf. We do not pass visitor data to advertising networks or data brokers.
This privacy policy does not cover external sites. Links to external sites, such as the RFC editor or the GDPR text, lead to services with their own rules. Read their privacy policy before you send them personal data.
How long data stays
Access logs rotate on the hosting schedule. The privacy policy does not promise a fixed number of days because the schedule depends on the server configuration, and a promise that the system does not enforce is worse than a clear description. When a log is rotated, the old file is removed.
Rate-limit counters expire automatically, usually within minutes. A generated password, a card number or a text value is not stored after the response. If you send a message through the contact page, the message and the reply address stay in the support mailbox until the request is closed and the retention period for support mail ends.
Backups follow the same schedule as the site. A deleted record can remain in a backup for a short period before the backup rotates. This privacy policy describes the normal path; a legal request or a security incident can require a longer hold, and we will say so if it applies to you.
If you subscribe to a reply thread, the address stays until you ask for removal. Unsubscribing stops new messages and starts the normal retention period for the thread. The privacy policy applies the same rule to every contact channel.
Your rights
You can ask what personal data we hold about you, ask for a correction, ask for deletion, or object to a specific use. Because the API keeps no request values and the site has no accounts, the usual answer is that there is nothing to return. Access logs may still contain your address, and we can explain what they hold and how long they stay.
A copy of this privacy policy is available on request. Send a request through the contact page. We answer from the same address and may ask a question to confirm that the request comes from you. If a request concerns a log entry, include the approximate date and the endpoint you called.
The privacy policy is written for a developer audience, so it uses the same names as the API pages. If a term is unclear, the contact page is the right place to ask. The answer may become a line in this privacy policy if more than one person asks.
Children
The site and the API are built for developers and are not directed at children under 16. We do not knowingly collect data from children. If you believe a child sent personal data, contact us and we will remove it.
Changes to this privacy policy
We update this page when the service changes: a new endpoint, a new log, a new provider. The date at the top of the page shows the current version. A change that affects how data is used will be described in the text, not only in the date.
Further reading
The full text of the regulation is available at GDPR info. For the technical side of the checks, start with the API collection.