Security
We know you’re trusting us with your Google Business Profile and your customers’ reviews. Glow Stars is built with security in mind from the start; this page summarises how we protect your data.
Hosting
Application data is hosted on Supabase infrastructure in data centres in the European Union (Frankfurt).
Encryption
All traffic between your browser and our servers is encrypted with TLS.
The database and file storage are encrypted at rest. The credentials used to access your Google account are additionally encrypted at the application level with AES-GCM.
Access control
Each business’s data is separated from other accounts with row-level access rules in the database. Users can only see data from workspaces they belong to.
Within a workspace, permissions are split by owner, admin, editor and viewer roles.
Account security
Passwords are never stored in plain text; only secure hashes are kept. New accounts are confirmed with an email verification code.
When you sign in with Google we never see your password; access is granted through Google’s OAuth consent and can be revoked at any time.
Google data and Glow Stars AI
Data received from Google is used only to provide the service and is never sold. For reply drafts, only the relevant review texts are sent to our AI provider; your email address and password are never shared.
Reporting a vulnerability
If you discover a security issue, please email privacy@glowstars.ai. We review reports as a priority.