Legal
Security
The current posture, stated plainly.
1. The posture
Glovrex stores your data as plain files, one private folder per account, on the machine Glovrex runs on — not a shared database. Each folder is isolated from every other account, and that isolation is checked by an automated negative-auth test, not just written here. The demo has no account and nothing to attack, because it saves nothing.
2. The one network path
The only data that crosses the network is text you explicitly submit for AI extraction or generation, sent to the model provider over TLS. No background sync, no telemetry, no update pings carrying content.
3. Accounts and sessions
Signing in — Google, Discord, GitHub, or email and password — is handled by Better Auth: a session cookie (httpOnly, Secure in production), an Origin check on every mutating request, and a rate limiter on the sign-in surface. Every route that touches your data checks that session and scopes the call to your own folder before doing anything.
4. Your part
Use a strong password, or skip that risk entirely by signing in with Google, Discord, or GitHub instead. Do not share your session. If you run Glovrex yourself rather than using our instance, the machine it runs on and its disk encryption become your responsibility too.
5. Reporting an issue
Found something? Open a security advisory or issue on the public repository at github.com/mahirhir and mark it clearly as security-related. Reports get a first response within 72 hours. No bounty program exists yet; credit is given unless you prefer otherwise.