Vendors that receive student data
Standby Ops LLC · Draft of October 3, 2026 · Gloss
These are the only companies that receive Gloss student data, what each one gets, and where to read its data terms. "Connected" means the Gloss code uses it today. "Planned" means it is not connected yet and gets nothing until it is; we update this list first.
Connected
| Vendor | What it does for Gloss | What it receives | Data terms |
|---|---|---|---|
| Anthropic (Claude) | Reads emails, schedule screenshots, syllabi, library files and study tutor questions, only for students who allowed it | Emails that pass our filters (sender name and address, subject, sent time, up to 6,000 characters of body), schedule images and PDFs, syllabus text. Never email we mark sensitive. No training on this data. | Commercial Terms |
| Groq | Turns lecture recordings into text, only for students who allowed it on a screen naming Groq | The audio file you upload. We delete our copy right after; Groq keeps no data under the zero retention setting and doesn't train on it | Groq Services Agreement · Your data |
| Sign in with Google; reading Gmail when a student connects it; new mail alerts (Pub/Sub) | Sign in and Gmail requests from Gloss; Google already holds the mailbox. Pub/Sub alerts carry only the mailbox address. | Google API Services User Data Policy · Cloud Data Processing Addendum | |
| Microsoft | Reading Outlook email when a student connects it | Mail requests from Gloss; Microsoft already holds the mailbox | Microsoft APIs Terms of Use |
| Apple | Sign in with Apple; push notifications (through Expo) | Sign in requests; reminder title and text for push | Apple Privacy Policy |
| Expo (650 Industries) | Delivers push notifications to phones | Push token, reminder title and text | Expo Privacy Policy |
| Resend | Sends Gloss emails (sign in codes, links) | Email address, the message | Resend DPA |
| Sentry (Functional Software) | Crash reports | Error details with email text, addresses, tokens and links removed | Sentry DPA |
| Cloudflare | Hosts joingloss.app and the waitlist | Website visitors' IP addresses to deliver pages; waitlist email addresses | Cloudflare Customer DPA |
Course sites and student org platforms (like Canvas or CampusGroups) receive a request from our server when Gloss fetches the calendar link a student pasted. They don't receive anything else from us.
Planned
| Vendor | What it will do | What it will receive | Data terms |
|---|---|---|---|
| Production hosting (not chosen yet) | Runs the Gloss servers and database | All stored Gloss data, encrypted where this list's privacy policy says | Added when chosen |
| Backup storage (not chosen yet) | Encrypted backups at a different provider | Encrypted database backups | Added when chosen |
| RevenueCat | One subscription system for Apple and Stripe purchases | An anonymous account id and purchase records | RevenueCat DPA |
| Stripe | Payments on the computer apps | Name, email and payment details entered on Stripe's page (we never see card numbers) | Stripe DPA |
Gloss uses no advertising, analytics or tracking services.