Codapt Inc., a Delaware corporation ("Codapt," "we," or "us"), operates Glasshand. This Policy covers personal information handled through glasshand.com, our app and APIs, hosted device access, and related communications.
Your device screen and input pass through Glasshand to provide remote access. Account, payment, authorization, and operational records are stored separately. Information can also remain on the hosted device, in your connected accounts, or with an agent you authorize. Device reset and deletion of these other records are different processes.
1. Scope and responsibility
Codapt determines how personal information is used to administer Glasshand accounts, authenticate access, manage billing, secure and support the Service, and operate our business. Where we process information solely on a business customer's instructions, our role and obligations depend on the applicable processing agreement and law.
If a customer uses a hosted device to process your information, that customer is responsible for its own purposes, notices, and permissions. You may need to contact it about that processing. This Policy does not replace the privacy policies of Apple, Stripe, external agents, or apps and websites you choose to use.
2. Information we handle
Account and authentication
We receive your email address, account identifier, account timestamps, sign-in requests, and session information. Sign-in codes are delivered by email; verification records use hashed codes. Authentication and security records may include IP addresses, browser information, session and token identifiers, rate-limit records, and sign-in or revocation events.
Rentals, agents, and payments
We store device selections, rental identifiers and status, setup and release records, billing periods, cancellation requests, payment and refund status, and availability-notification preferences. Agent authorization records include the agent name, client identifier, permissions, approval, last-use, and revocation information.
Stripe collects payment details through its checkout and billing pages. Billing information available to us can include your billing name and address, email, tax identifiers you provide, limited payment-method details, and subscription, invoice, payment, dispute, and refund records. We retain payment-event and transaction records to reconcile billing and fulfill rentals.
Device content and interactions
The Service processes screen images, screenshots, keyboard and pointer input, connection details, and device status to let you and authorized agents operate a device. Content you put on or access through the device may include files, messages, account information, credentials, and information about other people. The information involved depends on your use.
Support and operations
We retain messages and attachments you send us, delivery records, support history, and information needed to investigate an issue. Our systems also handle request paths, timestamps, error classifications, connection and health information, security events, and records of setup, billing, and release operations. These records help diagnose failures and prevent duplicate or unauthorized actions.
Information comes from you, your browser and agents, the hosted device and its controller, providers such as Stripe and our email service, and people who contact us.
Product analytics
We host Umami on our own infrastructure to understand how people find and use Glasshand. Analytics include page visits, referral and campaign information, browser and device metadata, and events such as sign-in, checkout, successful payment, device readiness, refunds, and rental endings. When you sign in, we can associate activity with your account identifier and email address; rental events can include the rental identifier, device type, and transaction amount.
These analytics help us improve the service and investigate conversion or setup problems. We measure page loading, responsiveness, and visual stability. We also record limited-duration browser sessions on Glasshand pages, including page structure, navigation, clicks, and scrolling, to understand usability problems. Form input values are masked; credential and authorization controls and hosted-device screens and inputs are excluded from recordings. Our integration does not send sign-in codes, authentication tokens, session cookies, or card details to Umami. Heatmap recording is not enabled.
Ordinary session recordings are scheduled for deletion after 30 days. Recordings we explicitly save to investigate an issue may be retained longer. Encrypted backup copies expire according to our backup rotation.
3. Screens, input, and credentials
The live connection captures and temporarily buffers screen frames and input in memory, then delivers them between the hosted device and an authorized browser or agent. Screen images can reveal anything visible on the device, including private messages and sign-in information. Input can include text or credentials you enter.
This live transport is distinct from persistent account, billing, support, and operational records. Files and app data you save can remain on the hosted device or in a connected cloud account. Screenshots or other content you provide in a support request become part of that request. An authorized agent can receive screen images and keep its own copies or activity history under its provider's practices.
Glasshand uses session and agent credentials to enforce access. We also maintain protected service credentials for the device connection. Credentials you use inside an app may be processed by the device, the live connection, the relevant app or service, and any agent with access. Only provide information you are entitled to use. Use limited, revocable access where practical, and revoke connected-account credentials when they are no longer needed.
4. How we use information
- Verify sign-in, maintain accounts and sessions, and enforce the permissions you grant.
- Arrange device setup and access, relay screen and input data, manage subscriptions, process refunds, and return devices when access ends.
- Send sign-in codes, receipts, payment-recovery messages, security and service notices, and requested or enabled availability notifications.
- Answer support requests, diagnose problems, improve service reliability, monitor systems, maintain recovery backups, and investigate misuse or fraud.
- Maintain accounting and tax records, satisfy legal duties, enforce agreements, resolve disputes, and protect users and the Service.
Authorized personnel, contractors, and support tools may access information when needed for these purposes. Support may use automated tools, including AI-assisted tools, to help review information or resolve a request. Access remains subject to the purposes and obligations described here.
5. Providers and other recipients
We use providers to operate Glasshand and disclose information needed for their functions:
- Solid and infrastructure providers: hosted hardware, controller and network connections, server hosting, maintenance, and device release and reset.
- Stripe: checkout, payment methods, recurring billing, tax calculation, invoices, refunds, fraud prevention, and payment-recovery communications. Its own processing is described in the Stripe Privacy Policy.
- Resend: delivery of sign-in codes and other service email, including recipients, message content, and delivery information. See the Resend Privacy Policy. Our own mail systems also retain inbound support email and attachments.
- Support, security, and operational providers: tools and personnel used to maintain, troubleshoot, protect, and recover the Service.
We also disclose information to agents or other recipients you authorize, to advisers or authorities when needed for legal duties or claims, and where necessary to investigate fraud or protect rights and safety. A merger, acquisition, or business transfer may involve disclosure to relevant advisers and a successor, subject to applicable protections.
Some providers act on our instructions; others have independent responsibilities and purposes under their own terms. Provider use does not remove our obligations under applicable law or a controlling customer agreement.
6. Your agents and connected services
When you approve an agent, we give it access within the granted permissions. That can include rental information, device screenshots and control, and rental or billing management. You can view and revoke connected agents in the app. Revocation does not remove information an agent has already received.
Apps, websites, Apple or cloud accounts, and agent providers you choose can collect information directly or receive it through your use of the device. Their retention and use of information, including any AI processing, depend on their own policies, settings, and agreements. Review those arrangements when deciding what information to make available.
8. Retention, deletion, and device reset
Retention depends on the information and why it is needed. Account and authorization records support ongoing access and security. Rental, transaction, payment-event, and operation records support billing reconciliation, refunds, prevention of duplicate actions, accounting, disputes, and legal requirements. Support and diagnostic records may remain as needed to resolve issues and protect the Service.
When a rental ends, Glasshand revokes access and releases the device to Solid for reset before reassignment. Reset deletes data on the device, including files and signed-in app state. You should save information you need and remove or revoke connected-account access before your rental ends.
Device reset does not delete account or transaction records, support messages, or copies in your agents and external cloud accounts. Nor does it mean every provider or backup copy is erased at the same instant. Contact us for deletion of personal information; we assess requests under applicable law and explain relevant exceptions.
Operational backups can contain account, billing, authorization, service-configuration, and support information. They are retained for recovery and replaced or removed through backup management. Deletion may take time to reach backups and providers, and retained copies remain subject to applicable restrictions. These backups are not a way for customers to restore a released device.
9. Security
We use measures such as encrypted connections, authentication, permission and ownership checks, restricted service access, protected credentials, and backups to help protect information. No service can guarantee complete protection against every security incident.
Protect the email account you use for sign-in, review your agents' permissions, and secure any accounts you open on a hosted device. Report suspected unauthorized access to support@glasshand.com. Your precautions do not replace our security responsibilities.
10. International processing
Codapt is based in the United States. Information may be processed there and in other countries where our infrastructure, providers, and support operations are located. Privacy laws may differ from those where you live.
For transfers that require legal safeguards, the applicable arrangement must use a recognized transfer mechanism or another lawful basis. Contact us for information about the safeguards relevant to your information and a copy where you are entitled to one.
11. Your rights and choices
Depending on the law that applies, you may be entitled to access, correct, delete, or receive a portable copy of personal information; object to or restrict processing; withdraw consent; limit certain uses of sensitive information; opt out of legally defined sale, sharing, targeted advertising, or certain profiling; and appeal a denied request.
Email support@glasshand.com with "Privacy request" in the subject and describe what you want to do. We may need to verify your identity or an authorized representative's authority, as appropriate for the request. We do not require verification for an opt-out where the law prohibits it. We respond within applicable legal deadlines and explain a denial when required.
Where an appeal is available, reply to our decision or email the same address with "Privacy appeal." You may complain to your competent privacy regulator. We do not penalize you unlawfully for exercising privacy rights. A deletion or restriction request may affect features that need the information, and some records may be retained for a lawful exception.
You can revoke agent access and leave an availability notification list in the app. You can also contact support about those choices or closing an account. Canceling a subscription, closing an account, and requesting deletion are distinct actions; let us know which you intend. Necessary billing, security, and service messages may still be sent.
12. Additional regional information
EEA and United Kingdom
Where these laws apply, we rely on contractual necessity for requested account, access, and payment functions; legal obligations for required records and compliance; and legitimate interests for security, fraud prevention, reliability, support, and claims, after considering affected individuals' rights. We rely on consent when required and provide a way to withdraw it. Withdrawal does not change the legality of earlier processing.
Sensitive information may require an additional legal condition. Accepting general Terms is not blanket consent to process other people's information. Applicable rights also include protections concerning certain solely automated decisions with significant effects and a right to complain to a supervisory authority.
United States
The information described above can fall within legal categories such as identifiers, customer records, commercial information, internet or device activity, visual information, and sensitive information such as credentials or private communications. Not all categories apply to every user. Sections 2–5 explain sources, purposes, and recipients; Section 8 explains retention considerations. You can use the request and appeal methods above for applicable state privacy rights.
13. Children
Glasshand accounts are intended for adults aged 18 or older. If you believe a child has created an account or supplied personal information inappropriately, contact us. Customers processing information about children through a device are responsible for the required authority and safeguards; this does not remove our obligations.
14. Changes to this Policy
We update this Policy as practices change and show the effective date above. Material changes receive any additional notice or consent required by law. A revision does not by itself authorize incompatible use of previously collected information or override a controlling data-processing agreement.
15. Contact
Glasshand is operated by Codapt Inc., a Delaware corporation.
Privacy inquiries and requests: support@glasshand.com.