Gloss privacy

Gloss is a Chrome extension the Celados team uses to pin Annotations on a live web page, so coding agents can read and answer them. This policy covers the extension and the Gloss server it talks to. For celados.com itself, see Privacy.

What Gloss sends

Page addresses. When Gloss is open on a page, it asks the Gloss server for that page’s Annotations by sending the page’s address, and keeps a connection open to receive new ones. On the sites listed in Options, that happens on every page you visit there, as soon as it loads. On any other site, it happens only after you open Gloss. Gloss does not send the addresses of pages where it is not running.

What you post. When you post an Annotation or a Comment, it also sends the server:

• your comment text;
• the element you pinned it to (its CSS selector, source location and position on the page), and any marks you drew;
• a screenshot of the region you framed (the “Snapshot”). It is captured only when you post, and cropped to that region before it leaves the page;
• your author ID, name and email, if you set them.

The Annotation, its Comments and their Snapshots are stored on the server, and anyone admitted to Gloss, people and coding agents, can read them. Gloss collects no sign-in credentials, activity tracking, location, communications, health or financial data.

Your name

In the extension’s Options you can type a name and an email; both are optional. Until you do, you post as “Guest” and four characters of a random ID. Your author ID, name and email are kept in your browser’s synced storage and sent as the author of what you post. They are not checked.

What stays in your browser

Your settings, which server to use and on which sites Gloss opens by itself, never leave your browser. Gloss has no analytics, no telemetry and no ads, and nothing is sold or shared.

When it runs

Gloss runs on any page, but only when you open it from the toolbar button or Alt+Shift+G, and on its own only on the sites listed in Options. That is why it asks for access to all sites: taking a Snapshot of the tab you are on needs it. It does not read pages it is not open on.

Who can read it

The server is gloss.celados.com (and test.gloss.celados.com for testing), a Cloudflare Worker with Durable Objects and R2 storage, behind Cloudflare Access. Only the people and agents Celados admits can read or write. The extension never sees your Access credentials: Access has its own sign-in page, which Cloudflare processes.

Who processes it

• Cloudflare: hosting, storage and Access sign-in.

Removing it

Resolving an Annotation deletes it, with its Comments and Snapshots. Only a page counter stays, so numbers are not reused. To have something removed, or to learn what we hold about you, write to hello@celados.com. Uninstalling the extension clears the settings in your browser.

Changes

When this policy changes, we update the date at the top of the page.