Privacy policy

Effective 26 October 2026

Who we are

Glimmer is made by Scott Davis Labs ("we", "us"). Questions about this policy or your data go to privacy@glimmerwidgets.com.

What the Glimmer app accesses

Glimmer is a desktop app made of widgets. Each one only reads what it needs, and only once you've turned it on or connected the service it uses. Everything it keeps is stored in its own folder on your computer (%APPDATA%\Glimmer on Windows, ~/Library/Application Support/Glimmer on macOS, ~/.config/Glimmer on Linux).

Build status and PR queue (GitHub)

• Glimmer gets a GitHub access token from the GitHub CLI (gh) already signed in on your computer. The token stays in memory and is never written to disk by Glimmer.
• It asks GitHub's API, directly from your computer, for your repositories' recent workflow runs and for open pull requests that request your review or that you opened.
• It keeps only your choice of GitHub account and panel settings. Build results and pull requests are held in memory while the app runs.

Timebox and Next meeting (Google Calendar or Microsoft Outlook)

• If you connect a calendar, Glimmer asks for read-only access: for Google, the scopes calendar.events.readonly and calendar.calendarlist.readonly; for Microsoft, Calendars.Read. It cannot create, change or delete anything.
• It reads the list of your calendars (so you can choose which ones count) and the events in the next seven days: each event's title, start and end, whether it's all-day, whether it shows you as busy or free, your own response, and its video-call link. It looks in an event's location and description only to find a Google Meet, Zoom, Microsoft Teams or Webex link, and keeps just that link, never the description.
• It uses this to end focus sessions before your commitments, to count down to your next meeting, and to offer a Join button.
• The sign-in's refresh token is stored encrypted with your operating system's protected storage. The events above are cached in a file in Glimmer's folder so the timebox keeps working offline.
• Disconnect in the timebox's menu revokes the sign-in and deletes the token and the cached events. You can also remove Glimmer's access at any time from your Google Account (myaccount.google.com/permissions) or Microsoft account.
• Your focus sessions and the handoff notes you write are stored only in a database in Glimmer's folder.

Unpushed work (local git repositories)

• Glimmer runs read-only git commands in the folders you choose, to find uncommitted changes and commits not pushed. Nothing is sent anywhere; the folder list is kept in Glimmer's settings.

License keys (Lemon Squeezy)

• When you add a license key, Glimmer sends the key and your computer's name to Lemon Squeezy's license service, so the key can be limited to a few computers and you can see where it's in use. About once a week it re-checks the key, sending the key and the activation's ID. Removing a key sends the same to free the activation.
• Keys are stored encrypted with your operating system's protected storage.

What Glimmer never does

• No analytics, telemetry, crash reporting or advertising.
• No server of ours: your data isn't sent to us.
• Nothing is sold, shared with or shown to anyone else.

Google user data

Glimmer's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, Google Calendar data:

• is used only to provide the timebox and next-meeting features you see in the app;
• stays on your computer and isn't transferred to us or anyone else;
• is never used for advertising, never sold, and never used to train AI or machine-learning models;
• is never read by a person.

Buying Glimmer

Purchases are handled by Lemon Squeezy, which acts as the merchant of record: it takes your payment, handles tax and sends the receipt and license key. Lemon Squeezy collects the details needed for that, such as your name, email address, billing country and payment details, under its own privacy policy. We never see your payment card. Lemon Squeezy shares your order with us (your name, email address, what you bought and your license keys), which we use to support you, handle refunds and, if you opt in at checkout, send product news.

This website

glimmerwidgets.com has no cookies, analytics, tracking or third-party fonts. Like any web host, our host may record standard server logs, such as your IP address and the pages requested, for security and reliability. If you email us, we keep the conversation to answer you.

Keeping and deleting your data

• Data on your computer stays until you remove it: disconnect a calendar, remove a license key, or delete Glimmer's folder after uninstalling.
• To have us delete your order details or emails, write to privacy@glimmerwidgets.com. We'll do so unless we have to keep them for tax or legal reasons, and Lemon Squeezy keeps its own records as merchant of record.
• Depending on where you live, you may have rights to access, correct, delete or export your personal data, or to object to its use. Write to us and we'll help.

Children

Glimmer is not directed at children under 13, and we don't knowingly collect their data.

Changes

If this policy changes, we'll update it here with a new effective date, and tell license holders by email before any change that affects how the app handles their data.