← Gloss · TinyKite

Privacy Policy

Gloss by TinyKite · Last updated: 10 November 2026

1. Who we are

Gloss is published by Tiny Kite LTD (“TinyKite”, “we”). Contact: support@tinykite.co.

2. What Gloss does

Gloss is a reading companion. You type a word, and the app shows a simple meaning with pictures or short motion from an on-device lexicon.

3. Data we process on your device

• Words you type — looked up first on the device, in the moment. If the word is not in the pack already on your device, the app asks TinyKite's own lookup service for it — section 5 says exactly what that sends and why — and keeps the answer on the device afterwards. A word kept that way is asked about again from time to time, so a picture published after you looked it up actually reaches you; section 5 says when, and what that repeat ask carries (the same word and dictionary, nothing more). Reading needs no account and nothing you type is stored in a TinyKite cloud account tied to you. A grown-up can optionally sign in and link a reader to a household — section 5a says exactly what syncs then, and for whom.
• Words you have looked up — kept on the device for the “words you’ve met” list and the quiz, in the order you met them. That list never leaves the device — unless a grown-up links this reader to a TinyKite household, which is a separate, explicit choice described in section 5a — and uninstalling the app removes it. Separately, the app keeps a plain count of how many times each dictionary word was opened — a word and a number, with no times and no order — which can only be sent if you said yes (see section 5).
• A reading log — each time a reader opens a word, the app notes which word, its dictionary, when, and whether it was searched, followed from another word, or re-opened from the list — a timestamped record of that reader's own reading, kept for them on the device. It is never sent to TinyKite and never synced, even for a reader linked to a household. It keeps at most the latest 5,000 reads, and it is erased when that reader is removed, by Grown-ups → Delete your Gloss data, or by uninstalling the app.
• Reader profiles — a name you choose for each reader and, if you answer the optional first-run question, the year that reader was born. The year is used only to pick a starting reading level, and the question can be skipped. Both stay on the device and are removed by uninstalling the app. The birth year is never sent to TinyKite; the name is sent only if a grown-up links that reader to a household (section 5a), together with the reader's colour and reading level.
• Device backups — everything in this section lives in the app's own storage on the device, so a backup you have turned on for the whole device (for example Google or iCloud backup) can include it, the same as any other app's data. TinyKite never receives those backups.

4. What we do not collect

• No account and no email is required to use the app — every reading feature works without signing in
• No advertising identifiers, no third-party analytics SDKs, no crash-reporting SDKs — every network call section 5 describes goes to TinyKite’s own service, carries no identifier of any kind, and is never used to build a picture of a person
• No microphone access — Gloss does not ask for the microphone and does not record or process audio
• No sale of personal data
• No tracking across other companies’ apps or websites

5. Network access: the dictionary's word list, looking up a word we have not shipped yet, and the three optional signals Gloss sends us

Every word in the dictionary pack already on your device works with no internet at all — those meanings are preloaded, and looking them up never touches the network. Gloss's word pack also grows between app updates, on TinyKite's own service, so a word missing from the copy on your device today may already exist there. When you search a word that is not (yet) on your device — or tap one of the words a meaning links to, such as an “also called” or “opposite” word or a translation — the app asks that service for it; if it has an answer, the app downloads the meaning and its picture or sound and keeps them on the device from then on, so it opens instantly and works offline. That request carries only the word itself and which dictionary it belongs to (for example en-GB) — or, when you search a form of a word such as “troubling”, the dictionary word it comes from (“trouble”) — nothing else: no account, no name, no device or advertising identifier, no location, no timestamp — the same promise-shape as the three signals below. This lookup is functional, not optional — it is how Gloss answers the question you asked, so it is not switched off by “Help grow the word pack” below — but because Gloss has to ask somewhere, a word you looked up that we had not already shipped necessarily reaches our service, which is why this paragraph says so plainly rather than folding it into “everything stays on the device”. If the lookup fails or you are offline, the app tells you it could not show the word; it does not keep retrying on its own, and searching again, or tapping Try again, is what tries the lookup again.

Asking again about a word you already have. We publish a word's text first and add its picture or short motion to the same entry days later, so a word downloaded during that window would otherwise sit on the device without its picture forever. Gloss therefore re-asks the SAME lookup service about a word it has already downloaded: in the background when you open it while a picture is still to come (at most once an hour for any one word), about once a week once that word is complete, and — for every downloaded word at once — when a grown-up taps “Check for updates” in Settings → Words Gloss downloaded. A repeat ask carries exactly what the first one did, the word and its dictionary and nothing else; it never carries a list of what you have read, a reader profile, an identifier, a location or a time. It happens in the background, changes nothing on screen unless the answer really has moved on, and if it fails, nothing changes at all. Like the first lookup it is functional, not optional: it is how the app finishes answering a question you already asked, so it is not governed by “Help grow the word pack” either. Words you have downloaded can be cleared at any time from Grown-ups → Delete your Gloss data, which stops those asks with them.

Downloading the dictionary's word list. So that Gloss can suggest every word in the dictionary as you type — not only the ones packed inside the app — it downloads the list of words TinyKite's service can look up for the dictionary you read in, and keeps it on the device so suggestions work offline too. It asks for that list at most once a day for each dictionary (and straight away the first time Gloss is opened), usually getting back only “nothing has changed”. The request sends only which dictionary the list is for (for example en-GB), plus a short code identifying the copy the device already holds, which is the same for every device holding that copy — no word, nothing you typed, no list of what you have read, no reader profile, no account, no device or advertising identifier, no location and no time. The list is the same for everyone who reads in that dictionary and says nothing about you, which is why “Delete your Gloss data” leaves it in place, the same way it leaves the dictionary packed inside the app. Like the word lookup, it is functional, not optional, and is not governed by “Help grow the word pack”. If it fails or you are offline, nothing changes: Gloss keeps suggesting from the words it already has.

Beyond that lookup, Gloss uses the network for exactly three further, genuinely optional anonymous signals, all sent to TinyKite’s own service and to no one else:

• A word we could not answer, even after looking. If you search for a word and Gloss has no entry for it — on the device or from the lookup above — the app sends the word and which dictionary it was typed into (for example en-GB), so our editors can write it. Nothing else is sent: no account, no name, no device or advertising identifier, no location, no timestamps. Only single words or short phrases are ever sent — typed sentences never leave the device — and none of this happens unless you said yes to “Help grow the word pack” — asked on first run, changeable in Settings, and off until answered.
• A problem you report. If you tap “report a problem” on an entry, the app sends which entry and which of five fixed categories you picked — nothing else. There is no free-text field: a report cannot carry anything you type, and this includes reports that were written by an older version and sent after updating. (App versions before 0.2.4 had an optional note box; a report sent from one of those older installs may still carry its note until that device updates.)
• Counts of which dictionary words were looked up. So that the words readers actually use are the ones we improve first, the app counts how many times each dictionary word was opened on the device and sends that list in a single batch, at most once a day. Each line is a word, the dictionary it came from, and a number — nothing else.
  What is not sent, and cannot be: no account, no name, no device, install or advertising identifier, no location, no reader profile, no times of day and no order. The list says how many, never when or in what sequence, and there is nothing in it that could tie two words to the same reader or the same sitting. Only words that are already in Gloss’s dictionary can appear, because what is counted is an entry the app showed — nothing you typed that Gloss did not recognise can be in this list (a word we could not answer is the separate signal above, with its own rules).
  Counts are grouped by week when they reach us, using our clock rather than your device’s, and delete themselves 180 days later. None of this happens unless you said yes to “Help grow the word pack” — the same single answer that covers the missing words above, asked on first run with “Not now” preselected, and changeable at any time in Settings. Turning it off stops the sending immediately; anything already counted stays on the device and is only ever sent if you turn it back on. You can also ask us to delete counts we already hold (section 7).

The word-lookup above exists to answer you; the three signals exist only to improve the dictionary. We keep the three signals only as an editorial work list, we do not use any of this for advertising or profiling and never build a profile of a reader from it, and if the device is offline the three signals wait on the device and are sent later — the word lookup does not queue itself the same way, because a stale answer to a question you asked five minutes ago is not useful the way a delayed editorial note still is. Everything else in Gloss stays on the device.

5a. A TinyKite account, and linking a reader (optional, for grown-ups)

Gloss works fully without any account, and always will. Some TinyKite apps offer an optional sign-in with a TinyKite account — one account shared across TinyKite apps. If a version of Gloss offers this, it is for parents and caregivers, it is always skippable, and signing in by itself adds exactly one thing to what TinyKite holds: the account itself (your email address and sign-in credentials, kept by our identity service). Signing in does not, on its own, upload anything a reader has looked up.

Creating or joining a household. A signed-in grown-up can create a household (choosing a name for it, such as a family name) or join one another adult created, using a short code that adult shares with them directly — TinyKite never chooses or suggests who joins a household. The household roster includes stable account references, display names, membership roles and status. Display names help parents choose the correct child across Gloss and Nesta; contact details are not shown in the roster. A grown-up can leave a household at any time (an owner must first hand ownership to someone else or delete the household, since a household cannot be left without anyone responsible for it).

Linking a reader. Once signed in and a household exists, a grown-up can additionally choose to link one reader on this device to that TinyKite household. Linking is a second, separate, explicit choice — it is never automatic just from signing in or from creating a household, and a child is never shown the option or asked to make it. Before anything is sent, the app shows plainly what linking means; once you confirm, and only for that one reader:

• The reader's card. The name you gave this reader on this device, their colour, and their reading level (an age band such as 7–9 — never the birth year), so the household can tell its readers apart.
• Words met. Each word they have met — the word itself, which dictionary it came from, and its part of speech (noun, verb, and so on) — together with the day it was met. Never a time of day, and never in what order.
• Mastery. How well they know each word — met, still practising, or known — exactly as the on-device flashcard game already tracks it.
• Lookup counts. How many times each of the reader’s words has been looked up.
• Word meaning, where the app already has one to show. The simplest wording of that word's meaning, and its translation into a language the reader is learning — the same wording and the same translation already shown on the back of that word's flashcard, never a second copy written separately. If the app has nothing to show for a word yet, nothing is sent for it; nothing is invented to fill the gap.
• A device id, kept alongside a linked reader’s synced words so a second sync from the same phone updates the same rows instead of creating duplicates. It identifies the installation for that purpose only — it carries no other meaning and is not used to track you, and it is stored only for readers who are linked.

What still never leaves the device, even for a linked reader: anything they typed that Gloss could not answer, any picture or sound, and any time of day. Every reader who is not linked — the default, for every reader, forever — is untouched by any of this; their words stay exactly where section 3 says, on the device only.

You can unlink a reader at any time from Grown-ups → Linked readers. Unlinking stops sync immediately, and the words and the reader card (name, colour, reading level) TinyKite held for that reader are erased.

The account is managed at accounts.tinykite.co/account: download the data the account holds, change your password, or delete the account. Deleting the account from inside Gloss (Grown-ups → Delete your TinyKite Account) first erases the synced words held for every reader you had linked; the account page on the web deletes the account only, so unlink your readers in Gloss first, or email us and we will erase their words for you. Either way, deleting the account — like linking and unlinking — removes your sign-in from every TinyKite app that uses it. Every way to delete, and what each one erases, is set out at tinykite.co/gloss/delete. A 30-day grace period applies to the deletion; sign in again within it to cancel and keep the account. Children are never asked to create an account in Gloss, and are never shown the linking screen — both are actions only a signed-in grown-up can take.

Shared household, parent verification and child-account consent

Gloss and Nesta use one TinyKite household and the same child account ID. A signed-in parent can reuse an existing managed child, or create one after reviewing the child-account notice and explicitly confirming parental authority. New managed accounts require a server-verified account security factor and a fresh password confirmation. Phone or passkey verification is an account security check; it does not alone establish adult age or legal guardianship.

For a new managed child account the parent supplies a display name (a nickname is enough), birth date and country. TinyKite identity stores these with a hidden technical username to apply jurisdiction-sensitive age protections. We do not ask the child for an email address, phone number or password. Birth date and country are not copied into the messaging, Calendar or Gloss reader profiles.

Identity retains the consenting account and child references, notice version, verified-factor evidence, fresh-authentication result, grant and withdrawal timestamps, and security metadata such as IP address and user-agent. We retain consent and security audit evidence where required to demonstrate how consent was obtained or withdrawn, including after account deletion.

Creating a child account does not enable every app's data sharing. Each app requests its own permissions for that child's data. A child connects a device with a short-lived setup code and a parent's approval; device credentials are scoped to that child and product. The parent never shares their own session.

From Children and consent, a parent can withdraw account-level consent across TinyKite. Connected child access stops; withdrawal itself does not erase stored app data. App-specific sharing can be disabled separately. For access, correction, deletion or help restoring consent, contact support@tinykite.co. Existing child accounts keep their IDs; we do not represent legacy account creation as a newly verified consent record.

6. Children

Gloss is designed to be usable by young readers with a parent or caregiver nearby. Reader profiles (a chosen name, an optional birth year for the starting reading level) live on the device — the local reading-level birth year is not uploaded; managed child-account birth dates are handled separately as described above. Gloss receives a reader's name, colour and reading level only if a grown-up links that reader (section 5a) We do not use this information for marketing or targeted advertising. The app asks for no device permissions beyond network access. The three optional signals in section 5 carry no identifiers, and none of them carries a time, so nothing we receive from those can be arranged into what one child did on one day. Reader-typed text can leave the device two ways, both bounded the same way: the functional word lookup (section 5), which happens for any word not yet on the device — and again, later, for a word already downloaded whose picture is still to come — whether or not “Help grow the word pack” is on; and a searched word Gloss had no entry for anywhere, sent only if that switch was on. Neither ever sends what was typed unless it is shaped like a word — a typed sentence never leaves the device, by the same structural rule, in either case. The lookup counts carry words from Gloss’s own dictionary — the entry that was opened, not the letters a child typed to reach it — and no free text of any kind. Problem reports carry no typed text at all, and neither does the daily word-list download, which sends only a dictionary code. Child-account setup and linked-reader sharing (section 5a) require a signed-in parent and the relevant server checks. A child can connect with a parent-approved setup code without providing parent credentials.

7. Your choices

• Uninstall the app — removes local app data from the device.
• Turn off “Help grow the word pack” in Settings — the three optional signals in section 5 stop immediately. Looking up a word that is not on your device yet — and the later re-asks for a downloaded word, and the daily word-list download, described in section 5 — still happen, because that is how Gloss answers you rather than a signal you can opt out of; section 5 explains exactly what those requests send.
• Settings → Words Gloss downloaded shows how many words this device has fetched and lets a grown-up check them all for updates on the spot; Grown-ups → Delete your Gloss data erases them, and with them anything to re-ask about.
• Ask us to delete a signal — email support@tinykite.co quoting the word, the report, or the counted word and week, and we will remove it. Rows also delete themselves automatically 180 days after we last received them.
• Delete your account or your data — tinykite.co/gloss/delete gives the steps for each kind of deletion (this phone, a linked reader, a grown-up's TinyKite account, the anonymous signals) and says what is deleted, what is kept, and for how long.

8. Third parties

Gloss does not embed advertising, analytics or crash-reporting SDKs, and sends no data to third parties. Everything section 5 describes — the word list, the word lookup and the three optional signals alike — goes to TinyKite’s own service only.

9. International users

Gloss is published from the United Kingdom. A word already on your device is looked up entirely on-device; a word outside that pack is looked up on TinyKite's own service, as section 5 describes. The data TinyKite receives from every install is that lookup traffic — including the repeat asks for already-downloaded words described in section 5 — and the daily word-list request, which carries only a dictionary code, plus the three anonymous signals in section 5, plus — for a grown-up who chooses to sign in, and only for a reader they explicitly link — the account and linked-reader data described in section 5a. This data is stored with our infrastructure provider, Cloudflare, on its global network, and reviewed by TinyKite from the United Kingdom. Standard connection data (such as an IP address) is processed transiently by Cloudflare to deliver the request; TinyKite's queue stores only the fields listed in section 5, plus a short-lived abuse counter keyed to a one-way hash — never the address itself — that deletes itself within minutes.

10. Changes

This update corrects section 5a: deleting your TinyKite account erases linked readers' synced words only when you do it from inside Gloss; the web account page deletes the account alone. It also names the Grown-ups button by its real label, “Delete your Gloss data”, and links the new deletion page. The previous update: This update adds the dictionary's word list to section 5: at most once a day, Gloss downloads the list of words it can look up for your dictionary, so it can suggest every word as you type, offline too. The request sends only which dictionary the list is for — no word, nothing typed, nothing about you or your device. The summary and sections 6, 7, 8 and 9 say so wherever they list what leaves the device. Section 5 also notes that searching a form of a word (“troubling”) may look up the dictionary word it comes from (“trouble”) instead — still one word and its dictionary, nothing more. Published before the build that does this reaches any store track.

The previous update clarified section 5: tapping a linked word on a meaning (an “also called” or “opposite” word) that is not yet on your device uses the same word lookup a search does. No new kind of data leaves the device — the request carries the same word and dictionary, and the linked word comes from Gloss's own dictionary rather than anything typed. Section 3 also now describes the reading log the app keeps on the device, which is never sent to TinyKite, and says plainly that a device backup you turn on can include the app's on-device data. Sections 3, 5a and 6 now also say what linking a reader has always sent with their words: the name given to that reader on this device, their colour and their reading level — never the birth year. Published before the build that does this reaches any store track.

Before that, an update described one addition to the word lookup: because a word's text is published before its picture is drawn, Gloss now asks the lookup service about a word it has already downloaded again — on opening it while its picture is pending, about weekly once it is complete, and on demand from Settings → Words Gloss downloaded. No new kind of data leaves the device: a repeat ask carries the same word and dictionary the first one did. Sections 3, 5, 6, 7 and 9 say so at every place that previously read as “asked for once and never again”. Published before the build that does this reaches any store track.

An earlier update described the word lookup in section 5: from this version, a word not yet in the dictionary pack on your device is looked up from TinyKite's own service instead of only ever reading “not in our word pack yet,” and section 3, section 4, section 7 and section 9 are corrected so nothing elsewhere on this page still claims every lookup stays on-device. Published before the build that does this reaches any store track. The previous update added the optional account and the linked-reader story in section 5a; if we add further cloud features or analytics, we will keep updating this page and the date above before those features ship, and the store listings' data declarations with it. The commitments that do not change: a reader's words stay on the device unless a grown-up explicitly links that reader (section 5a), a looked-up word carries nothing about you or your device, nothing is sold, nothing tracks you across other companies' apps, and anything optional stays optional.

11. Contact

Questions: support@tinykite.co
Support page: tinykite.co/gloss/support
Company: tinykite.co