Glow is a period, ovulation, pregnancy, and (via a Smart Basal Thermometer and Smart Breast Pump) fertility-hardware tracking app run by Upward Labs Holdings, Inc. (doing business as Glow), a private company headquartered in San Francisco that was launched in May 2013 within HVF, a venture led by Max Levchin. In September 2020 the California Attorney General announced a $250,000 settlement with Glow, Inc. over allegations it failed to adequately safeguard health information and had a password-change flaw that could have let third parties reset accounts and access users' medical data without consent. Glow's current Privacy Policy states it does not sell personal data for money but discloses sharing names, emails, and device identifiers with advertising companies for interest-based advertising, and its Apple App Store privacy label discloses that Purchases, Location, Contact Info, Identifiers, and Usage Data may be used to track users across other companies' apps and websites, with a distinct 'Third-Party Advertising' purpose named for the data it collects. No independent registry filing or remediation artifact (audit, certification, transparency report) was found for Glow beyond its own self-reported corporate name and address.
TRACK RECORD
1 ENFORCEMENT ACTION
[2020-09-17]
The California Attorney General's September 17, 2020 press release states the Attorney General's complaint alleged Glow failed to adequately safeguard health information, allowed access to users' information without consent, and had a password-change flaw that could have let third parties reset accounts and access users' information without consent; the settlement (subject to court approval) included a $250,000 civil penalty and injunctive terms requiring Glow to obtain affirmative consent before sharing sensitive information.
Glow's Privacy Policy states that within the app's Community Forum feature, users are free to make sensitive information -- such as political opinions and religious beliefs -- public, and that this information is visible to other users, meaning the app's own design surfaces sensitive-category disclosures beyond core cycle/fertility tracking.
Glow's Apple App Store privacy label lists data 'Linked to You' that may be collected and used for a purpose explicitly named 'Third-Party Advertising,' covering Purchases, Location (coarse), Identifiers (Device ID), and Usage Data, alongside separate purposes for the developer's own Advertising or Marketing, Analytics, and Product Personalization.
Glow's Privacy Policy names Upward Labs Holdings, Inc. as the company operating as 'Glow,' with a registered address at 580 California St Suite 1200, San Francisco, CA 94104 -- the operating legal entity behind the app, as self-reported on Glow's own site.
Glow's About page states the app launched in May 2013 and was founded within HVF, a venture led by Max Levchin (founder of PayPal, Slide, and Affirm) -- disclosing the company's founding history, though not a current parent, investor, or beneficial-ownership chain.
Glow's Privacy Policy states it does not sell personal information for money, but discloses that for interest-based advertising it may share names, email addresses, and device identifiers of its users with advertising companies to facilitate ad targeting on other online platforms.
The California Attorney General's September 17, 2020 press release states the Attorney General's complaint alleged Glow failed to adequately safeguard health information, allowed access to users' information without consent, and had a password-change flaw that could have let third parties reset accounts and access users' information without consent; the settlement (subject to court approval) included a $250,000 civil penalty and injunctive terms requiring Glow to obtain affirmative consent before sharing sensitive information.
Glow's Apple App Store privacy label states that Purchases, Location, Contact Info, Identifiers, and Usage Data collected by the app may be used to track users across apps and websites owned by other companies -- a broader cross-app tracking data set than the equivalent disclosure on Flo's label, which omits Contact Info.
Glow's Privacy Policy states that among the 'Device data' it collects are unique identifiers including identifiers used for advertising purposes, plus IP address, device carrier, and general (city/state) location information -- data categories that support cross-app ad-identifier-based tracking.