Overview
This policy explains what Toggle collects, why, who receives it, how long we keep it and what you can do about it. We don't sell your data and we don't use it for advertising.
Who we are
Glas Labs, LLC, a US company, makes Toggle and is the controller of the personal data described here. Contact us at support@glaslabs.io.
What we collect, and why
- Account: the identifier and, if you share it, the name and email that Sign in with Apple or Google gives us, your profile picture if you add one, and the teams you belong to. Why: to run your account (contract).
- Sessions: for each device you're signed in on, its name and type, when it was last used and the IP address it last connected from, shown to you under Privacy & Security. Why: so you can see and sign out your devices, and to keep accounts secure (legitimate interests).
- Connected accounts: for each platform you connect (X, TikTok, Instagram, Threads, Facebook, LinkedIn, YouTube, Pinterest or Bluesky), the account's id, handle, display name and avatar, and the access tokens the platform issues. Tokens are encrypted on our server and used only to publish and read metrics for you. Why: to publish for you (contract).
- Pinterest boards: the names of your Pinterest boards, read when you choose the board a Pin goes to, and the board you picked for each Pin. Toggle doesn't read other Pins on your boards.
- Your content: the drafts, captions, schedules, comments and media you add, so they sync across your devices and teammates and can be published. Media is stored in a bucket and served at a hard-to-guess link, so anyone you give a media link to can open it. Why: contract.
- Invites: the email you type into an invite, if any, as a reminder of who it's for. Toggle doesn't email it.
- Post performance: metrics such as views, likes, comments, shares and saves for posts published through Toggle. Why: contract.
- Devices: a push notification token per device, so we can tell you when posts publish, need attention or get a comment. Why: contract; you can turn notifications off.
- Crash reports, only if you turn them on: crash, freeze and error reports with your device model, OS and app version, a random install id and the screens leading up to the crash, never your account. Toggle asks before sending any, and "Share crash reports with Sentry" in Privacy & Security turns them on or off at any time. Why: your consent.
- Server logs: each request's path, result and account id, to run, secure and debug the service. Why: legitimate interests.
What we don't collect
We don't read other people's timelines, follower lists, boards or messages, we don't use analytics or advertising SDKs, and we don't track you across other apps or websites.
The assistant
When you use Toggle's assistant, what you type and the parts of your team's library it reads to answer (posts, captions, channels, metrics and review comments) are sent through our server to Anthropic, which runs the AI model. Anthropic processes them to answer you and doesn't use them to train its models. We don't store the conversations on our server.
Who we share it with
- The platforms you connect, to publish your posts and fetch their metrics. When Toggle publishes a Bluesky post with a link, it fetches that page to build the link card.
- Service providers that process data for us under contract: hosting, database and logs (Fly.io), media storage (Cloudflare), crash reporting (Sentry, only if you turn it on), subscriptions (RevenueCat and Apple), sign-in (Apple and Google), push notifications (Apple) and the AI assistant (Anthropic).
- Your team, who see the content and channels in teams you share.
- Authorities, when the law requires it.
International transfers
Toggle's servers are in the United States, and so are most of our providers. If you're in the EU, the UK or Switzerland, your data is transferred to the US under the European Commission's standard contractual clauses (and the UK and Swiss equivalents) in our providers' data processing terms, or the EU-US Data Privacy Framework where a provider is certified.
How long we keep it
- Your account, content and connected accounts: while your account is active. Content you add to a team stays with that team for its other members.
- Disconnecting a channel deletes its tokens. A team you delete takes its channels, content and media with it.
- Sessions: while you stay signed in, and 30 days after you sign out or the session expires. A session's IP address is cleared once the session goes unused for 30 days.
- Deleting a post deletes it right away, but its review comments, the first 280 characters of its caption and who wrote it stay readable to the team for about 90 days, then they're deleted too.
- Crash reports on our server: 30 days. Invites: 30 days after they're used, revoked or expire.
- Deleting your account deletes your account, sessions, devices, tokens, profile picture and the teams only you were in. In teams that continue, your channels are disconnected and the posts and comments you wrote stay without your name. Backups roll off within 30 days.
Your rights
You can see your signed-in devices, download a copy of your data (Privacy & Security, Export Your Data), correct your name and picture, disconnect channels and delete your account in Toggle's settings. Depending on where you live, you also have the right to ask us for access, correction, deletion, restriction or a portable copy of your data, to object to processing based on legitimate interests, and to withdraw consent at any time. Email support@glaslabs.io and we'll answer within a month. If you're in the EU or UK, you can also complain to your data protection authority.
If you remove Toggle from a platform's settings (for example Facebook's or TikTok's), that platform tells us and we disconnect the channel.
Children
Toggle isn't meant for children under 13 (or the higher age your country sets), and we don't knowingly collect their data.
Changes
We may update this policy. We'll change the date above, and tell you in the app if the changes are significant.
Contact
Questions about this page: support@glaslabs.io.