Privacy
glu.tv is two things that want very different amounts of data. The directory of films collects very little. glu studio, where you sign in and make things with AI, has to keep more, so it gets most of this page. There are no ads and we don't sell your data.
Who this covers
"We" means ykeo Pty Ltd, the Australian company that runs glu.tv and glu studio. Privacy questions, requests about your information and complaints go through the contact form: choose "Privacy or my data".
First, the directory, which anyone can browse without an account.
Traffic: Google Analytics 4
We run GA4 to see whether anyone's watching, and what they watch. That's the only reason it's here. It runs on glu.tv itself and nowhere else: preview and test copies of the site don't load it at all. When it loads, your browser connects to Google, so Google receives your IP address. GA4 uses it to work out your rough location and, by Google's account, doesn't store it.
| What | Detail |
|---|---|
| Collected | Pages viewed, rough location (country/city), referrer, and your device, browser, operating system, screen size and language |
| Films | Which film you open and where you opened it from, when it starts, pauses, resumes, finishes or hits an error, how far through it you got, and how many seconds you actually watched |
| Search | What you type into the site's search box, once you've finished typing (on Enter, when you click elsewhere on the page or on a result, or when you leave the page with text still in the box). Switching to another tab or app and coming back doesn't count as finished. Anything under three characters is skipped, and so is anything that looks like an email address or a phone number |
| Getting around | The categories, tool filters and sort order you pick, menu and button taps, how far down a page you scroll, and links you follow off the site, such as through to a film on YouTube |
| Contact form | That the form was started and sent, and the reason you picked from the list. Never your name, email or message |
| Cookies set | _ga, _ga_* |
| Kept for | 14 months, GA4's retention setting for this data |
| Who sees it | Us, in Google's dashboard. Google processes it under its own privacy policy |
| Our own visits | Excluded, so they don't skew the numbers |
GA4 is the only analytics on the directory, and glu studio doesn't load it at all. No ad pixels, nothing that follows you around other websites, and Google signals (the setting that links analytics to Google accounts for advertising) is off. None of it gets sold.
Opting out. Open any page with ?ga_optout=1 on the end of the address, like glu.tv/?ga_optout=1. That browser stops loading Google Analytics on that address from then on. The setting lives in your browser's storage for the address you used, so it covers one browser at a time, and glu.tv and www.glu.tv count as two separate addresses: if you use both, opt out on both. Clearing site data, or closing a private window, undoes it. Visiting with ?ga_optout=0 undoes it on purpose.
Watching a film
Films play in YouTube's own player, embedded from its nocookie domain (youtube-nocookie.com), which cuts down the tracking YouTube would otherwise do. It doesn't switch tracking off altogether. On the home page, category pages and the full catalogue, YouTube's player loads only when you open a film. On a film's own page (the ones at glu.tv/f/), the player and YouTube's player script load with the page, so YouTube gets your IP address and browser details, and can set its own cookies, as soon as the page opens, before you press play.
Once a video starts playing, or if you're signed into a Google account, Google's own privacy policy takes over for that part. We don't see what YouTube collects and we don't store it. What we do see is the GA4 record of the play described above.
Thumbnails and hosting
Film thumbnails load straight from YouTube's image server (i.ytimg.com). Your browser fetches them directly, so Google receives your IP address and browser details with each request, as it does on any site that shows YouTube thumbnails. We get nothing back from it. The directory's typefaces are served from glu.tv itself. glu studio pages work differently, as covered below.
The site and glu studio are hosted on Cloudflare. Like any web host, Cloudflare handles your IP address and request details to serve the pages and keep out abuse, under Cloudflare's own privacy policy.
The contact form
Use the form and we get what you typed into it: your name, your email, the reason you picked, your message, and the YouTube link and tools if you're submitting a film. It goes straight to our inbox and isn't written to a database, so there's nowhere for it to sit and pile up. We use it to reply to you, not to add you to a list.
Our inbox is Google Workspace (Gmail), so Google holds your message there. If you submit a film, we also copy its YouTube link and the tools you list into our curation records.
Two services sit in between. Cloudflare Turnstile checks you're not a bot: it runs in your browser on the contact page and sends Cloudflare details about your browser and visit, under Cloudflare's privacy policy. Resend, an email delivery service, then carries your message to our inbox, so it passes through Resend's systems on the way.
glu studio: what we hold
glu studio is invite-only while it's in beta. You sign in with Google, Discord or an emailed link, and from then on the studio keeps a record of you and of what you make. Most of it is visible under My account, where you can also download it.
| What | Detail |
|---|---|
| Account | Your email address. Your name and profile picture if you sign in with Google or Discord and use them. How and when you signed in, and a short device label for each active session, such as "Chrome on Mac". The date you confirmed you're 18 and which version of the terms you agreed to |
| Profile and choices | Display name, avatar, language and region if you set them. Your email choices, plus a dated log of each change: what, when and where you made it |
| What you make | Prompts, scripts and settings, and the photos, video, audio and documents you upload, including voice recordings. What the studio generates from them. For ads: product names, selling points, links and logos. The settings behind each creation are kept with it, so you can reopen it as you left it |
| Credits | A record of credits added, used, refunded and expired, with dates and reasons |
| Sharing | The title, caption and file on any share page you create, and any report someone files about one |
| Messages | Your waitlist sign-up (email and name), credit requests and anything you send through the contact form |
| Technical | Your IP address and country, used for rate limits and abuse prevention and written into the audit record when something is deleted or purged. Error logs. Anonymous logs of which share buttons get used, with no account id, link or free text |
We use this to run your account, make and store what you create, keep credits straight, keep the studio secure and within its limits, answer you, and improve the studio, including by looking at how it is used (prompts and settings). We don't sell it.
AI generation and our AI provider
The images, video and voice in glu studio are made by AI models that our AI provider runs in Singapore. When you start a job, we send our AI provider what the job needs: your prompt and settings, and any photos, video, audio or documents you attached. For a product ad we also send the text the script is written from: your product name, selling points and call to action. Results come back as links that expire within a day, and we copy them into our own storage straight away.
So your content leaves Australia. Our AI provider handles it under its own terms and privacy policy, and its automated content checks can refuse a request. We use only its Singapore service, and you can ask us through the contact form how long it keeps inputs and outputs. Music generation is switched off because our provider does not offer it in Singapore, so you add your own music by upload. Under the Australian Privacy Principles (APP 8) we have to take reasonable steps to make sure an overseas recipient handles your information properly, and in most cases we stay accountable if it doesn't. If you'd rather not send something to our AI provider, don't put it in a job.
Voice cloning
To use your own voice for a voiceover, you record or upload a short sample and tick a box saying it's your voice, or that the speaker has agreed. We store the recording in your files and send it to our AI provider to create a voice that only speaks lines you type. We keep a record of your consent: your account, the time, the version of the wording and a fingerprint (a hash) of the recording. A voice can be a biometric identifier, which the Privacy Act treats as sensitive information, so we only do this with your consent. You can keep three voices. Deleting one removes it from our AI provider first and then from our records. The original recording stays in your files until you delete that too. If you delete your account, your voices are deleted at our AI provider when the 30 days end.
Where your files live
Everything you upload, and everything glu studio makes for you, is stored in Cloudflare's R2 storage and served from media.glu.tv. Account records sit in Cloudflare's key-value storage, and finished ads are put together in a Cloudflare container. Each file has a long random address. Nobody can guess it, but anyone who has the address can open the file, because the address is the key, not a password. Share links (glu.tv/s/ and a long random code) work the same way, so share them only with people you're happy to have the file. Cloudflare runs a global network, so your data may be handled in many countries.
glu studio doesn't connect to your YouTube, TikTok or Meta accounts, so we hold no tokens for them.
Who else receives data
| Who | What they get, and why |
|---|---|
| Our AI provider (Singapore) | Job content, as above. Also, the sample clips and pictures on the studio's Explore and Skills pages load from a content delivery network run by the same provider, so your browser connects to it and it sees your IP address |
| Cloudflare | Hosting, storage and processing for the site and the studio, so it handles your requests, IP address and files. Cloudflare Turnstile on the contact page |
| Resend | Your email address and the email itself, to deliver sign-in links, waitlist confirmations and other studio emails. It sends through Amazon SES |
| If you sign in with Google: your email, name and picture come to us, and Google learns you signed in to glu.tv. Studio pages load typefaces from Google Fonts. Our inbox is Gmail. GA4 on the directory, as above | |
| Discord | If you sign in with Discord: your Discord id, email, name and picture come to us. If you join the glu community server, Discord handles that under its own terms |
Each of them handles data under its own privacy policy. Beyond this we share nothing, except where the law requires us to hand something over.
Cookies and browser storage in glu studio
| Name | What it does | How long |
|---|---|---|
| __Host-glu_session | Keeps you signed in | 30 days, restarting each time you use it |
| __Host-glu_pending | Holds a verified sign-in until you confirm your age and the terms | 15 minutes |
| __Host-glu_sso | Protects the Google and Discord sign-in step | 10 minutes |
| __Host-uid | A random identifier for your browser, so work started before you sign in follows you into your account | 1 year |
| Browser storage | A cached copy of your recent creations and menu state, so pages load quickly | Until you clear site data |
These are what the studio needs to work. None is used for advertising or to follow you across other sites.
Emails
We email you what is needed to run your account: sign-in links, invites, waitlist confirmations, credit top-ups, replies, and notifications about your own account (for example, a film is ready, or credits are about to expire). You can switch the notifications off under My account, Notifications. We send marketing email (news, tips, new skills) only if you tick the box when you sign up or switch it on under My account, Notifications; the box is not ticked for you. Every marketing message will carry an unsubscribe link.
Credits and payments
During the beta we add credits to accounts ourselves, and nothing is sold, so we hold no payment details. Before credit packs open we'll update this page to name the payment provider and say what it receives. We'll keep the credit records, and for purchases the records that tax law requires us to keep.
How long we keep things
| What | How long |
|---|---|
| Your account and what you make | Until you delete them. Your creations, and the settings behind them, stay until you delete them |
| Things you delete | A creation, film, library item or share link you delete is kept for 30 days, in case of accident or a legal request, then purged. A share page you delete stops working at once |
| Your whole account | Deleting it hides your profile, creations, films, saved items and library straight away, and you can restore everything for 30 days. When the 30 days end we permanently erase your account: your sign-in record (email, name and sign-in method), your files, any voice you cloned (also at our AI provider), your choices and your saved items. We keep your credit history for our accounts, with your identity removed so it can no longer be linked to you. Erasure covers our systems; what our AI provider keeps of generation inputs and outputs is described under AI generation |
| Sign-in sessions | 30 days from last use |
| Audit entries | Records that something was deleted or purged (ids and times, never your prompts or titles) are kept without an end date. The IP address and country on those records are removed after 12 months |
| Credits | Beta credits expire 12 months after they're added. The record of credits granted and used stays, without your name, after you delete your account |
| Results from our AI provider | Its links expire within a day. We keep our own copy until you delete it |
| Directory analytics | 14 months, as above |
If the law requires it, or there's a legal dispute, we can pause a deletion. A legal hold also pauses the erasure of an account. Links you've already shared keep working until you remove them.
Age
glu studio is for people 18 or older, and you confirm that when you first sign in. We don't check ID. If we find an account belongs to someone under 18, we'll close it. The directory isn't aimed at children either, and YouTube's own age rules apply to what plays.
What we don't do
There are no ads and no advertising cookies, and we don't sell or rent your data. Nothing gets shared with anyone beyond what's described on this page.
Security
Sign-in cookies are marked secure and can't be read by scripts, session tokens are stored only as hashes, and uploads are checked for file type and dangerous contents before they're stored. No system is perfectly secure, though. If a breach is likely to cause serious harm, we'll tell you and the Office of the Australian Information Commissioner, in line with the Notifiable Data Breaches scheme.
Your rights
We handle personal information in line with the Australian Privacy Principles, whether or not the Privacy Act strictly applies to a business our size. You can ask what we hold about you, ask us to correct it, and ask us to delete it. In glu studio, My account, Privacy and data lets you download a file of your data and delete your account yourself. Otherwise use the contact form and we aim to reply within 30 days. If you're unhappy with how we've handled your information, tell us first. If we haven't sorted it out, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
If you're visiting from the EU or UK, we haven't built a separate consent flow, and GA4's cookies are set on arrival rather than gated behind a banner. If that matters to you, the opt-out above or your browser's own tracking controls are the most reliable levers you've got here. The GDPR and UK GDPR also give you the right to access, correct, erase, restrict and move your data, to object to how we use it, to withdraw consent, and to complain to your local data protection authority (in the UK, the Information Commissioner's Office).
| Why we use your data | Basis (GDPR and UK GDPR) |
|---|---|
| Running your account, making and storing what you create, credits | Contract: it's the service you asked for |
| Voice cloning, and optional emails | Consent, which you can withdraw at any time by deleting the voice or switching the email off |
| Security, preventing abuse, fixing faults, improving the studio | Legitimate interests |
| Directory analytics | Consent is the legal basis in the EU and UK. We have no consent banner yet, so please use the opt-out above |
| Tax and accounting records, and legal requests | Legal obligation |
Your data goes to Singapore (our AI provider) and to the United States and other countries where Cloudflare, Google, Resend and Discord operate. We are reviewing the safeguards for these transfers.
Changes to this page
When this page changes in a way that matters, we'll update the date at the top and ask glu studio members to agree again at their next sign-in.
Getting in touch
Questions about any of this go through the contact form, same as everything else.