Privacy policy

Your public identity is a pen-name

Your email address and Google or password credential are handled by Firebase Authentication, are not stored in Glass Bead application records, and are not shown to other players. The identity Glass Bead publishes is the permanent pen-name and avatar you choose. Do not use your legal name if you do not want it to become part of your public identity.

Information the service handles

• Account data: Firebase handles a user identifier, verified email address, and sign-in provider. Glass Bead application records keep the Firebase user identifier, account status, permanent pen-name, and selected avatar, but not the email address or provider credential.
• Dialogue data: titles, openings, moves, relations, citations, source metadata, admitted media, conclusions, visibility, and AI provenance. Public dialogue data is discoverable; private and unlisted data remains subject to its read boundary. A dialogue's pending proposals to conclude, publish, or delete it, an AI turn held for safety review, the training consent recorded when it was created, and a one-way digest of its title and opening are shown only to its two players, even when the dialogue is public or unlisted. Each move's training consent and the one-way digests of its text and of the request that created it are kept in a backend-only record that no reader of the dialogue can see, its two players included.
• Private account data: bookmarks, private drafts, invitations, and the played-or-visited history shown only to the signed-in account. Glass Bead also stores your correspondence-email cadence and pending, private notification items. Functional preferences, draft recovery data, and a marker that this browser holds a sign-in session (it records no identity) may also be kept locally in your browser. When a host keeps a room's second seat for you, the server-only invitation record names you, its generation, and whether you took the seat, let it pass, or the offer was withdrawn or lapsed; only that host and you can read it, never other readers of the room. Letting a seat pass does not revoke the reading access an unlisted room's link already grants: anyone who holds the link, including you, can still read it.
• Safety and operations data: App Check and reCAPTCHA abuse signals, rate-limit keys, request and error metadata, and content-free product-health events. Browser request diagnostics use only a fixed feature, closed error name, route class, failure stage, failure class, retry attempt and outcome, plus a short one-way grouping digest. Raw error messages, stacks, URLs, account identifiers, dialogue identifiers, and content do not leave the browser through that diagnostic channel. Glass Bead does not persist raw IP addresses in its application database.
• Optional traffic analytics: only after you select Allow analytics, Glass Bead sends Google a manually controlled broad page type, the site origin, and the referring site's origin. Google Analytics also creates standard events such as first visit, session start, and user engagement, and uses pseudonymous client and session identifiers plus ordinary device and coarse location information. Dynamic resource identifiers, query strings, fragments, titles derived from content, account identifiers, dialogue text, prompts, quotations, and other user content are excluded.
• Private feedback: when you choose Send feedback, Glass Bead stores the name, email address, and plain-text comment you provide, plus an optional account link derived by the server when you are signed in. The feedback remains in private storage for the maintainer to read and respond to. Once each day, pending submissions may be copied into one private maintainer-mailbox digest delivered through Resend. Glass Bead does not use a feedback address for marketing.
• Correspondence email: for an account with a verified email address, Glass Bead may send a daily or weekly digest when a dialogue concludes or it becomes your turn. The email address is read from Firebase Authentication only when a digest is first prepared. To make a provider retry duplicate-safe, the exact recipient and rendered letter are retained temporarily in that digest's private delivery record. The bounded retry schedule completes within the provider's 24-hour idempotency window; successful completion, terminal handling, a cadence change, or account deletion removes the record. These fields are never logged. Resend receives the recipient, subject, dialogue title, event summary and age, lifecycle and move/watch counts, player display names, a bounded opening excerpt, and the direct app URL needed to deliver the letter. It does not include authored bead bodies or relation text. Each card links directly to the relevant dialogue or bead. A letter may load the app's fixed public bead icon and decorative card art from playglassbead.com; those asset URLs contain no account, dialogue, delivery, or tracking identifier. You can select Daily, Weekly, or Never on your Updates page.
• AI-assisted content: when you deliberately play with an AI voice, ask Why this bead?, ask for a draft title and opening for a new game, or use model-backed Librarian or composer help, Glass Bead sends the bounded request and only the context needed for that feature to Google's Gemini service. Librarian answers may also be checked, or written, by Anthropic's Claude Haiku model, which Glass Bead runs on Google Cloud's Vertex AI. Deterministic local and structured-resolver Librarian paths do not call Gemini. Human-created content is not used by Glass Bead for model training without explicit consent.
• Player tags: once a player has at least two public dialogues that each hold three or more of their own moves, Glass Bead sends what they published there to Google's Gemini service. That covers the text, notes and relations of their beads, the images they placed, and the titles and openings of the dialogues they began, with the other seat's title and opening as context. The model names three things the player keeps returning to, shown as tags on the player's page and on Observed cards. Private, unlisted and practice dialogues are never read. The tags are refreshed as the player publishes, and removed when one of their dialogues stops being public or the account is deleted.
• Feed ranking: to order the public feed, Glass Bead sends public dialogues that have at least two moves to Google's Gemini service. That covers each dialogue's title and opening, every bead with its relation and any note, any closing coda, the credits of archive works placed in it, and its images and audio. Each bead is sent with the name of the player or AI voice that placed it. Gemini returns quality scores and a short written assessment. Glass Bead keeps the scores, not the assessment, and uses them only to order the feed. Private, unlisted and practice dialogues are never read. A dialogue is scored again after it changes or when Glass Bead updates the ranking, and leaves the ranking when it stops being public or a player's account is deleted.
• Safety moderation: bounded user prompts, authored text, and model-generated text covered by the service's safety gates are sent to Google Model Armor. Its inline findings are used to allow or block the operation; Glass Bead does not include an account identifier in the content sent for moderation.
• Openverse archive lookup: when you search for archive media, Glass Bead sends the bounded search terms to Openverse from its backend. Selecting a result sends its opaque Openverse identifier so the backend can retrieve source, rights, attribution, and media evidence. Provider requests do not include your Glass Bead account identifier. Verified provenance and an admitted media copy may be retained in the archive catalog and in a dialogue that uses the work. When you press Play on an audio result, your browser plays that recording straight from where it is hosted (Wikimedia Commons, Jamendo or Freesound), which receives your IP address and browser details; nothing loads from there until you press Play.
• Chemistry lookup data: when the Librarian cannot resolve a molecule from reviewed local or previously verified results, the bounded molecule name you entered is sent to the public NIH PubChem service. Glass Bead sends no account identifier and does not retain the PubChem request or raw response text. Successfully verified molecule structures and their source identifiers may be retained for reuse across players.
• Reusable Librarian results: successful model-generated artifacts for recognized, generic requests may also be reused across players. This shared cache contains the artifact and its origin/version metadata, not your account identifier, dialogue context, or original request text. Personal and unrecognized requests are not shared through this cache. Compatible results may be retained across model and prompt upgrades, subject to current validation and safety checks.

Optional traffic analytics

Google Analytics is off until you affirmatively allow it. Declining does not load the Analytics client or contact its endpoints. If allowed, the application explicitly emits only manually classified page views such as a reading-room page, a dialogue page, or a player page; real game, move, bead, and player identifiers are replaced with fixed placeholders. A referring URL is reduced to its origin, without its path, query, or fragment. Glass Bead does not send a Google Analytics user ID or custom gameplay events. Google Analytics may additionally create its standard automatic events, including first_visit,session_start, and user_engagement, using pseudonymous client and session identifiers. The client starts with the same sanitized default page fields, so those events do not inherit a raw resource path, query, fragment, or content title.

Google may set first-party cookies named _ga or beginning with_ga_. This implementation limits those cookies to 60 days without extending them on activity. The GA4 property retains event and user data for two months. Google Signals, advertising personalization, Enhanced Measurement, Google Ads links, optional account data sharing, and BigQuery export are disabled. Coarse geography and device reporting remain enabled for aggregate traffic understanding.

Your choice is stored only in this browser. Turning analytics off stops future collection and removes readable first-party Google Analytics cookies for this site where the browser permits it. Clearing browser storage may cause the choice to be requested again.

The witness installation token

Accountless reading uses one strictly functional installation token after a dialogue has remained readable in a visible tab for ten continuous seconds and the witness request succeeds. Opening and immediately leaving, or leaving the tab in the background before that interval finishes, does not create the token or count a witness. The token keeps later qualifying reads of the same dialogue from inflating its witness count.

Local storage is readable by scripts running on this site, so the token is not an authentication credential and grants no access. The API validates its signature and derives a different stored witness value for every dialogue, preventing that stored value from correlating an accountless reader across dialogues. Registered-account responses do not erase a previously stored guest token. If browser storage is blocked, the token is retained only for the current page lifetime. Deleting browser storage causes a future qualifying visit to establish a new installation value.

Service providers used

Glass Bead uses these processors to operate the service:

• Firebase Authentication for account credentials and email verification;
• Cloud Firestore for dialogue and application records;
• Firebase Hosting, Cloud Run, and Cloud Storage for delivery and admitted media;
• reCAPTCHA Enterprise and Firebase App Check for abuse prevention;
• Firebase Analytics and Google Analytics for consented, privacy-minimized traffic measurement;
• Gemini for AI-player turns, player tags, feed ranking, requested bead explanations, new-game drafts, and model-backed Librarian or composer help;
• Anthropic's Claude Haiku, run on Google Cloud's Vertex AI, to check model-backed Librarian answers and to write a second one when the first fails;
• Model Armor for safety screening of covered user and model text;
• Openverse for backend-mediated archive media search and import;
• NIH PubChem for structured molecule-name and identity lookup;
• Resend for delivering private feedback digests to the maintainer and correspondence email when your cadence permits it; and
• Cloud Logging, Monitoring, Pub/Sub, and BigQuery for sanitized operations and content-free event measurements.

These providers handle information under their own applicable service terms and privacy policies.

Retention

Your choices

You may browse public dialogues without an account; manage your email or password; export or permanently delete your account from account settings; choose Daily, Weekly, or Never correspondence on your Updates page; and delete a dialogue from its participant controls. A two-human dialogue requires both current participants to consent to whole-dialogue deletion. Account deletion instead removes the departing player's identity and authored content while preserving a private, non-republishable copy for the other participant. Recovery copies, logs, external processors, legal holds, and material copied by others can outlive active-record deletion for the bounded reasons described above. A permanent pen-name cannot otherwise be casually renamed without breaking attribution; see the Terms.

Children and changes

Glass Bead is not directed to children under 13, or under 16 where European law requires that age for independent consent. Material changes to this policy will be reflected on this page with a new effective date.