Privacy
What we know about you (very little), who handles data for us, and your rights.
Last updated 21 October 2026.
In short
- No accounts, no cookies, no tracking, no analytics and no ads.
- When you make an offering, we store what you bought and when, with a random one-time gift code. Not your name, your e-mail address or your card.
- Stripe takes the payment on its own page. Cloudflare delivers the site. Anthropic’s AI writes the island’s dreams from facts about the island and, on some nights while our Twitch channel is connected, from an anonymous sample of its chat. Nothing about buyers ever reaches it.
- Our server logs can contain IP addresses and are deleted after 14 days.
- Our Twitch channel is twitch.tv/theglimsoflyso. While it is connected to the island, our server may read the channel’s public chat without keeping any names (details).
1. Who is responsible
The controller of your personal data is Glims of Lysø, a Danish sole proprietorship (enkeltmandsvirksomhed) with CVR number 38044737, registered at Gl Strandvej 130, 5500 Middelfart, Denmark. Write to hello@theglims.com about anything on this page.
2. Watching the island
Watching needs no sign-up and sends nothing about you. Every viewer’s browser downloads the same updates of the island, from the same addresses, at the same moment. Your browser connects to Cloudflare, which delivers the site for us and passes some requests on to our own server. Like any website, they see your IP address and technical details such as your browser type, because they need them to deliver the pages and to protect the site from attacks. We do not use them to find out who you are or to follow you around.
Legal basis: our legitimate interest in delivering a working, secure site (Art. 6(1)(f) GDPR).
3. When you make an offering
| What we store | Why |
|---|---|
| The offering: its size, the amount and currency, its state (paid, waiting in the sky, falling, landed, refunded, disputed) and when each step happened | To deliver it, to show you what became of it, and for our bookkeeping |
| A random one-time gift code, and a short one-way fingerprint (hash) of it | So that your page can find your offering and mark it as “yours” |
| Stripe’s reference numbers for the checkout, the payment and the messages Stripe sent us about it | To match the payment, and any refund or dispute, to the offering |
| What the offering became on the island | It is part of the island’s public history, without anything that identifies you |
We do not store your name, your e-mail address, your card details or your IP address with your offering, and we never see your full card number.
Legal basis: delivering what you bought (Art. 6(1)(b) GDPR) and our bookkeeping duties (Art. 6(1)(c) GDPR). We keep offering records for as long as the bookkeeping rules require (five years in Denmark), and the gift codes only until the experiment ends.
The gift code
When Stripe sends you back to the island, the address ends in #gift= and the code. The part after # is not sent to any server when the page loads. The page removes it from the address bar and keeps it only in that open tab, so that a reload of the tab within 15 minutes still finds your offering. It sends the code to our server (through Cloudflare) only to ask how your offering is doing. Your browser’s own history may still hold the address with the code. Everything public about your offering, in the island’s live updates and in its book, carries only the short fingerprint, so other viewers cannot tell which offering is yours. Our logs never contain the code: neither our server’s nor those of the proxy in front of it.
4. Payments: Stripe
You pay on Stripe’s checkout page, not on ours. We give Stripe the size of your offering and its gift code, so that the payment can be matched to your offering. Stripe collects what it needs to take the payment, send your receipt and charge the right VAT, such as your name, your billing address, your e-mail address and your payment details. Stripe then tells our server that the payment went through. Of what it sends, we keep only the state of the payment, the amount and currency, and reference numbers. Stripe’s own record of your payment, which can include your name, e-mail address and billing address, is visible to us in our Stripe account; we look at it only to answer a question about a payment or to make a refund.
When the checkout carries the Link brand, Stripe is the merchant of record for your purchase and handles this data as an independent controller, under its own privacy policy: stripe.com/privacy. Link may offer to save your details in a Link account; that is between you and Link.
5. Server logs
Our server writes a short log line for requests and errors: what was asked for (without any query), the answer and how long it took. The proxy in front of it logs only requests that fail there, for example while the server restarts. Neither logs gift codes or payment details. Some lines, for example about failed or refused requests, contain an IP address. We use the logs only to keep the site working and secure, and they are deleted after 14 days.
To stop abuse, the server also counts recent requests from each IP address in its memory, for example at most ten offerings a minute from one address. These counts stay only in its memory and are forgotten soon after.
Legal basis: our legitimate interest in a working, secure site (Art. 6(1)(f) GDPR).
6. Cookies and your browser
We set no cookies. There is no tracking, no analytics, no advertising, no fingerprinting, no social-media buttons and no scripts from other companies, and the fonts come from our own server.
The island page remembers a few view settings in your browser’s local storage: whether the glims’ names are shown, whether the island’s sound is on and how loud, which page of the island’s book you had open, and which dream you saw last, so that the book can mark a new one. They stay on your device, and we never receive them. Clearing the site’s data in your browser removes them.
Cloudflare may set a strictly necessary security cookie if it ever has to check that a request comes from a person and not a bot. It is not used for tracking.
7. The island’s dreams: Anthropic
The island’s dreams are written with Claude, an AI model made by Anthropic, PBC, in the USA. When a dream is due, our server sends Anthropic a description of the island: its glims, their traits and friendships, its buildings, its customs and what happened there lately. These are facts about an imaginary island. They contain no personal data: no buyers, no payment details, no IP addresses, and not even how much anyone paid. Before anyone sees a text the AI wrote, Claude also checks it for anything unsuitable.
Anthropic processes this under its commercial terms and its data processing addendum: it keeps what we send only for a limited time, and does not use it to train its models.
8. Twitch chat
Our Twitch channel is twitch.tv/theglimsoflyso. While it is connected to the island, our server may read the channel’s public chat, whether or not a stream is live at that moment. It reads without logging in and can never write in the chat. We do not store chat messages, usernames or Twitch IDs. Messages are held in the server’s memory for about an hour at most, filtered, and then discarded. Messages that the channel’s moderators remove are dropped, and a restart empties the memory. Usernames are used for a moment only, to skip known bots. User IDs are used only through a code that changes every few hours and is never written down: to count how many different people are talking, to stop any one person from filling the sample, and to honour timeouts and bans.
On some nights, and when we test the summary from the keeper’s pages, a sample of these messages, without any names, is sent to Anthropic, the company that provides the AI we use. The AI summarises in a few anonymous lines what the chat felt and wished for. That summary can inspire the island’s dream and may be shown in the island’s book. We keep the summary for 30 days; the few anonymous lines that the book shows stay there as part of the island’s history. We also keep hourly counts (how many messages, how many different voices) until 30 days after the experiment ends. We cannot link a summary back to anyone.
Legal basis: our legitimate interest in letting the channel’s audience inspire the island (Art. 6(1)(f) GDPR). You can object at any time: write to hello@theglims.com. Twitch itself handles your messages under its own privacy notice.
9. E-mail
If you write to hello@theglims.com or support@theglims.com, Cloudflare’s e-mail routing forwards your message to our Gmail inbox (Google), where we read and answer it. We keep e-mails as long as we need them to help you, and delete them within 12 months, unless the bookkeeping rules make us keep them longer (for example about a refund). If you call or text our phone number, we see your number, and keep it only as long as we need it to help you.
10. Who handles data for us
| Who | What for | Where |
|---|---|---|
| Cloudflare, Inc. | Delivers the site, runs its domain names, protects it from attacks and forwards e-mail | USA and worldwide |
| Hetzner Online GmbH | Hosts our server and its database | Germany |
| Cloudflare, Inc., R2 storage | Keeps encrypted backup copies of the database | European Union |
| Anthropic, PBC | The AI that writes and checks the island’s dreams and summarises the Twitch chat | USA |
| The Gmail inbox that hello@theglims.com and support@theglims.com are forwarded to | USA and worldwide |
Cloudflare, Hetzner and Anthropic work for us under data processing agreements and only on our instructions. Our inbox is a Gmail account that Google provides under its own terms. Stripe is not on this list because it handles payment data for its own purposes as well (see section 4).
Cloudflare, Anthropic and Google are based in the USA. Where personal data goes there, the transfer is covered by the EU–US Data Privacy Framework or by the European Commission’s standard contractual clauses.
11. Children
What the island shows is written to be suitable for all ages, but Glims is not made for children and is not marketed to them. We ask nobody’s age or name and have no accounts, so we do not knowingly collect data about children. If you are a parent and think your child made an offering, write to us.
12. No decisions about you
Nothing about you is decided automatically. The island’s dice decide what an offering becomes, and that concerns the island, not you.
13. Your rights
You can ask what data we have about you, and ask us to correct it, delete it, limit its use or give it to you in a portable form. You can object to anything we do on the basis of our legitimate interest. Because we do not know who you are, we can usually find your data only if you give us your gift link, the date and amount of your offering, or your receipt. Write to hello@theglims.com; we answer within a month.
You can also complain to the Danish data protection authority: Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, datatilsynet.dk.
14. Security
The site is served over encrypted connections only. Our data lives in one database on our server. Encrypted backup copies of the database are kept in Cloudflare’s R2 storage in the European Union, and any backup images that our hosting provider makes of the whole server stay in the European Union too. Backups are replaced within about a week; until then, they can still hold what we have deleted. Only we can reach the keeper’s pages.
15. Changes
We update this page when something changes, for example if we ever add a cookieless statistics tool, connect a Twitch channel other than ours or stop reading Twitch chat for good. The date at the top shows the latest version.