Privacy Policy

Last updated: October 3, 2026

This Privacy Policy explains how Glassmkr ("we", "us", "our") collects, uses, and protects personal data when you use app.glassmkr.com (Dashboard), the Crucible monitoring agent, and related services, including the connectors that let an AI assistant call Glassmkr (section 4). This policy is written in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Czech Act No. 110/2019 Sb. on Personal Data Processing.

1. Who We Are (Controller)

The data controller responsible for your personal data is:

• Name: Simon Rybisar (IČO 03700585)
• Address: Korunni 1963/119, Praha, 130 00, Czech Republic
• Email: [email protected]

We are not required to appoint a Data Protection Officer under Article 37 of the GDPR. Our core activity is infrastructure monitoring, which does not constitute large-scale monitoring of individuals, nor do we process special categories of personal data on a large scale.

2. What Data We Collect

Account data. When you create a Dashboard account, we collect your email address, a hashed password (bcrypt), and, if you use OAuth login, an OAuth provider identifier. We never store your password in plain text.

Server monitoring data. When you install Crucible and connect it to Dashboard, the agent sends periodic health snapshots. This data includes:

• CPU metrics: aggregate utilization, per-core utilization, load averages
• Memory metrics: RAM usage, swap usage, allocation breakdowns
• Disk metrics: space usage per mount point, inode usage, mount options, I/O rates, latency
• Storage health: SMART attributes, NVMe wear indicators
• IPMI/BMC data: sensor readings (temperatures, fan speeds, voltages), System Event Log entries, ECC error counts, PSU status
• Network metrics: interface traffic, error counts, link speed, connection states
• RAID status: array health, component drives, rebuild progress
• Security posture: firewall status, open ports, failed login attempts, unattended upgrades status
• System information: hostname, OS, kernel version, uptime

This data describes your server hardware and operating system. It does not include file contents, application data, database contents, user data stored on your servers, network traffic payloads, or any data processed by applications running on your servers.

Billing data. Glassmkr no longer offers paid plans (retired August 2026). For accounts that previously had one, payment was processed by Stripe. We store only your Stripe customer ID and subscription status. We do not store credit card numbers, CVVs, or full card details. Stripe's own privacy policy governs their handling of your payment information: stripe.com/privacy.

Notification channel data. If you configure alert channels, we store the configuration you provide: Telegram chat IDs, email addresses, or Slack webhook URLs. These are used solely to deliver alerts you have configured.

Technical logs. We log API requests (endpoint, timestamp, response status, IP address) for security monitoring and incident response. We do not log request bodies beyond what is necessary for the service to function.

AI assistant connectors. If you use one of the MCP connectors that let an AI assistant call Glassmkr, we receive and keep the data described in section 4.

3. How We Use Your Data

AI processing. Health snapshots may be analyzed by a self-hosted Gemma 4 model running on our own infrastructure in Amsterdam. This processing happens entirely on our servers. Glassmkr's analysis does not send your data to third-party AI providers (OpenAI, Google, Anthropic, or others). If you connect an AI assistant to Glassmkr yourself, section 4 describes what it receives.

Machine learning processing for trend warnings. Glassmkr uses machine learning models to generate trend warnings from your server's historical monitoring metrics. These models run on Glassmkr-owned infrastructure in the European Union. These features do not transmit your monitoring data to external AI providers (such as OpenAI, Anthropic, or Google Cloud AI services). The models used are: (a) a tree-based classifier trained on Backblaze's publicly released drive failure dataset, which evaluates per-drive SMART attributes to estimate failure risk, and (b) a large language model (Gemma 4) that generates plain-English descriptions of warnings already identified by our deterministic detection rules. Neither model is trained on your private data; the tree classifier is retrained quarterly on Backblaze's updated public dataset only. Drive model identifiers (for example "ST12000NM0007") are used to match against this public failure-rate lookup table; those identifiers are manufacturer-public information, not customer-identifying data.

Trend warning feedback. If you mark a trend warning as "valuable" or "false positive", we store that feedback against the warning record and use it in aggregate to calibrate future warnings for your account.

We do not sell your data. We do not use your data for advertising. We do not share your server data with other customers.

4. AI Assistants and MCP Connectors

Glassmkr offers two Model Context Protocol (MCP) connectors that let an AI assistant you use, such as ChatGPT (OpenAI) or Claude (Anthropic), call Glassmkr. Neither is used unless you connect it. The assistant provider is not our subprocessor: it is a separate service you chose, and what you type, paste, or receive in that conversation is handled by the provider under its own privacy policy and terms. Glassmkr's own analysis features described in section 3 do not send your data to any third-party AI provider.

Paste-triage connector (no account). At https://app.glassmkr.com/api/triage/mcp, anyone can have Glassmkr's alert rules read server command output (for example from smartctl, zpool, mdadm, dmesg, ipmitool or nvidia-smi) that they paste into an assistant. It needs no account and no sign-in. See Use Glassmkr in ChatGPT and Claude.

• What we receive: the command output the assistant sends with each call, an optional hint naming your Linux distribution, and, when the assistant attaches one, an anonymous requester identifier (ChatGPT sends one). Command output can contain hostnames, device serial numbers and similar details of your systems; you can replace them before pasting, giving each one a different placeholder so separate devices stay apart. Other metadata an assistant attaches, such as a locale or a coarse location hint, is not used or recorded.
• How it is processed: the output reaches us over HTTPS through Cloudflare, like all traffic to our services. It is parsed and evaluated in memory, the result is returned to the assistant, and the output is then discarded. We do not store the pasted text, write it to a log, or use it for any other purpose.
• What we log: one line per call with the tool called, the output formats detected, the input size, the rule identifiers of any findings, the processing time, whether the call succeeded or was rate limited, and a hashed form of the requester identifier when one was sent. The request itself is also recorded as described under Technical logs in section 2. When you use ChatGPT or claude.ai, the call comes from the provider's servers, so the IP address we see is theirs; a client running on your own machine, such as Claude Code, connects from your address.
• Rate limiting: short-lived counters keyed by the source IP address (for an IPv6 address, also by its /64 and /48 network prefixes) and by the hashed requester identifier. They expire on their own within one day.
• Retention: the log lines above are kept as security logs (section 7). Nothing links a call to a Glassmkr account.

Authenticated MCP connector (Dashboard accounts). At https://app.glassmkr.com/mcp, a signed-in Dashboard user can authorize an AI client to read their fleet data and, with the scopes they grant, act on it. See MCP server.

• A transfer you start: by approving a client on the consent screen, you instruct us to send that client what its tool calls request within the scopes you granted, such as server names, health snapshots, alerts, and resource-usage history from your account. Once sent, that data is part of your conversation with the assistant and is handled by its provider under its own policy.
• What we store: the client's registered name and redirect addresses; the connection itself (your account, the scopes granted, when it was approved and last used, and whether it was revoked); and its access and refresh tokens, stored only as hashes. Each tool call is written to your account's audit log, as API calls are.
• How long access lasts: an access token is valid for 15 minutes and is renewed with a refresh token. A refresh token lapses after 30 days without use, and a connection ends at the latest 90 days after you approved it; after either, the client has to be authorized again. Connection records are deleted with your account.
• Revoking access: revoke any connection under Settings, MCP connections in the Dashboard. Revoking it, or resetting your password, stops further transfers immediately. It cannot recall data already sent to the assistant.

5. Subprocessors and Third Parties

Telegram and Slack only receive data when you actively configure them as notification channels, and an AI assistant only when you connect it. We do not sell data to any third party. We do not use any analytics, tracking, or advertising services.

6. International Data Transfers

All primary data (account data, monitoring snapshots, AI analysis results) is stored on dedicated servers in Amsterdam, Netherlands, within the European Union.

Data you send to an AI assistant through an MCP connector (section 4) is transferred at your instruction to the provider you chose, which may process it outside the European Union under its own terms.

Certain subprocessors are based in the United States. These transfers are covered by the European Commission's adequacy decision for the EU-US Data Privacy Framework (DPF), adopted on 10 July 2023. As an additional safeguard, we maintain Standard Contractual Clauses (SCCs) with each US-based subprocessor.

7. Data Retention

Retention periods are enforced automatically. When you delete a server from Dashboard, all associated snapshots, alerts, and analyses are permanently deleted. When you delete your account, all your data is permanently deleted after the 30-day grace period, except billing records retained under legal obligation.

8. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15): obtain confirmation of whether we process your data and request a copy.
• Right to rectification (Art. 16): correct inaccurate personal data we hold about you.
• Right to erasure (Art. 17): request deletion of your personal data when it is no longer necessary for its original purpose.
• Right to restriction of processing (Art. 18): request that we limit how we use your data in certain circumstances.
• Right to data portability (Art. 20): receive your data in a structured, commonly used, machine-readable format.
• Right to object (Art. 21): object to processing based on legitimate interests. For security logs processed under Art. 6(1)(f), you may object at any time.
• Right to withdraw consent (Art. 7(3)): where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, email [email protected]. We will respond within 30 days. You may also export your data at any time via the Dashboard API or dashboard.

Supervisory authority. You have the right to lodge a complaint with the Czech Data Protection Authority:

• Name: Urad pro ochranu osobnich udaju (UOOU)
• Address: Pplk. Sochora 27, 170 00 Praha 7, Czech Republic
• Email: [email protected]
• Website: uoou.cz

9. Cookies

This cookie is HttpOnly, Secure, and SameSite=Lax. It is scoped to the domain .glassmkr.com. We do not use analytics cookies, tracking cookies, or advertising cookies. We do not use Google Analytics or similar tracking services.

Under the ePrivacy Directive (2002/58/EC, Art. 5(3)), strictly necessary cookies do not require user consent. Because our only cookie is essential for authentication, no cookie consent banner is required.

10. Children

Glassmkr is a server monitoring service intended for system administrators and IT professionals. Our services are not directed at individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe a child under 16 has provided us with personal data, please contact us at [email protected] and we will delete that data promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The "Last updated" date at the top of this page indicates when the policy was last revised.

For material changes that affect how we process your data or reduce your rights, we will notify you by email at the address associated with your Dashboard account at least 14 days before the changes take effect.

12. Contact and Complaints

For any privacy-related questions, requests, or complaints, contact us at:

• Controller: Simon Rybisar, IČO 03700585
• Address: Korunni 1963/119, Praha, 130 00, Czech Republic
• Email: [email protected]

If you are not satisfied with our response, you have the right to lodge a complaint with the Czech supervisory authority, the Urad pro ochranu osobnich udaju (UOOU), at Pplk. Sochora 27, 170 00 Praha 7, Czech Republic; email: [email protected]; website: uoou.cz.