What gloodoh.com keeps in your browser
Four entries, and this is all of them. They are local storage entries rather than cookies, and the difference matters: a cookie is attached to every request your browser makes, so our server sees it. A local storage entry is not attached to requests automatically — it travels only if a script on the page deliberately reads it and sends it. None of the four entries below is ever read and sent: they stay in your browser and our server never receives them. The one local storage value anywhere in Gloodoh that is deliberately sent to us is the console's glo-device-id, and the console section below says so.
| Key | What it holds | Written when | How long it stays |
|---|---|---|---|
glo-lang | en, fr or sw — the language you chose | You pick a language from the language menu on the home page | Until you clear this site's data |
glo-theme | light or dark | You use the theme switch in the top corner of any page | Until you clear this site's data |
glo-aud | all, consumer or supplier — which passages of a legal document you asked to see | Written the first time you open a legal page here, starting at all; it changes when you press "Show everything", "I'm buying" or "I'm selling" at the top of the page | Until you clear this site's data |
glo-leads | A copy of a message you submitted through a form here, with the time you sent it | Only on a copy of this site published without our send endpoint wired up — see below | Until you clear this site's data |
None of them has an expiry date set, so they last until you remove them. They are not shared between browsers or between devices, and a private or incognito window forgets them when you close it.
The honest detail about glo-leads
The forms on gloodoh.com post what you type to our own endpoint at gloodoh.com/api/submit. The fallback is for one case only: a copy of this site published without that endpoint wired up, where the form writes what you typed into glo-leads rather than lose it. On the live site the endpoint is configured, so the entry is never written. It is not a failure fallback — if a submission does not reach us, the form says so and asks you to try again, and writes nothing to your browser.
The copy is in your browser and only in your browser. We cannot read it, and we cannot delete it for you. Clearing this site's data removes it.
What this website does not load
Nothing on this page comes from another company. Being specific is the only way to make that claim mean anything, so: gloodoh.com contains no Google Analytics or analytics of any other brand, no Google Tag Manager, no Meta or Facebook pixel, no Hotjar, no heatmap or session replay, no A/B testing script, no chat widget, no font CDN, no embedded YouTube or Maps frame, no advertising script, and no service worker.
Beyond the ordinary request your browser must make to fetch the page — which carries your IP address, your browser's user-agent string and the page that referred you to whoever is serving the site, as it does on every website — the only information that leaves your browser on its own is what you type into a form and choose to send. Links out of the site — to Google Play, or to the data-protection regulator — are ordinary links: nothing is sent until you click one, and then it is that site, not ours, that sees your visit.
What a form submission records
When you send us a message we store your email address, your name if you gave one, the subject and the message, how you said you heard about us, which app you asked to test if you asked for tester access, whether you ticked the consent box, the language the page was in, your browser's user-agent string, the page that referred you, and a verbatim copy of everything the form posted. Instead of your IP address we store a one-way hash of it, which we use only to stop one sender flooding the form. We do not store a website visitor's raw IP address. The privacy policy sets out what happens to that message afterwards; the last section says how to get a copy of it.
Two things happen to a message you send that are worth naming, because they involve someone other than us: it is stored in our database with Supabase, and it is emailed — once to us, once back to you as a confirmation — through Resend, our email provider. Neither is a cookie and neither tracks you; they are simply where a message you chose to send has to go to reach a person. Serving the page itself involves one more unavoidable disclosure: our hosting provider, Vercel, receives your device's IP address, because that is how a page reaches you. Every website works this way. We do not use it to recognise you on a later visit.
These companies are outside Kenya
Vercel hosts the website, Supabase runs sign-in and the database, Google carries push notifications through Firebase and serves the ad SDK inside the apps, and Resend delivers a form submission to our inbox — all on servers abroad, which means personal data leaves Kenya. Kenyan law permits that where appropriate safeguards are in place or the transfer is necessary to perform the contract with you (Data Protection Act, No. 24 of 2019 (Cap. 411C), s.48; Data Protection (General) Regulations 2021 (Legal Notice 263 of 2021), regs 40 and 41), and we rely on the data-protection terms in our written agreement with each of them. The Data Commissioner has published no adequacy list, so safeguards and necessity — not adequacy — are what we stand on. Which country each one sits in, and what each receives, is set out in the privacy policy (see the last section).
Clearing it, and what happens if you do
Clearing this site's data removes all four entries at once. Every browser keeps this in roughly the same place — the "cookies and site data" part of its settings — though the exact wording moves between versions.
- Chrome or Edge — click the icon at the left of the address bar, then Cookies and site data, then Manage on-device site data, and delete what is listed for gloodoh.com.
- Safari on a Mac — Safari, then Settings, then Privacy, then Manage Website Data. Search for gloodoh and remove it.
- Safari on iPhone or iPad — Settings, then Safari, then Advanced, then Website Data. Find gloodoh.com and delete it.
- Firefox — Settings, then Privacy & Security, then Cookies and Site Data, then Manage Data.
- The blunt way, in any browser — clear browsing data for cookies and other site data. That clears every site, not only this one.
Nothing breaks. On your next visit the home page opens in its default dark theme, and in your browser's own language if it is one of the three we have — English, French or Swahili; the legal pages, including this one, are English only. A legal page goes back to showing every passage instead of the audience you had filtered to. Each of those is one click to set again.
You can also block site data for gloodoh.com entirely. The site still works. The consoles are the exception, and that is covered next.
The supplier console and the staff console do use cookies
Signing in is the one thing that genuinely needs a cookie, so the two consoles set them. This is the only part of Gloodoh that does.
supplier.gloodoh.com is the web console for your business. Everything in this section applies to you from the moment you sign in there.
None of this touches you if you shop through the Gloodoh Consumer app on your phone. The consoles are for suppliers and for our own staff, and no cookie of ours is set anywhere unless you open one of them and begin signing in.
| Name | Type | What it does | How long it lasts |
|---|---|---|---|
Names beginning sb- | Cookie | Keeps you signed in. Set by Supabase, the authentication service behind Gloodoh. One of them is written the moment you begin signing in, before any session exists, because it is what ties the sign-in you started to the one that comes back. | Refreshed while you stay signed in; dropped when you sign out |
glo-admin-session | Cookie, httpOnly | Staff sign-in at manage.gloodoh.com, our internal console. httpOnly means no script in the page can read it. | 12 hours at most, and 30 minutes of inactivity ends it |
glo-active-biz | Cookie | Which of your businesses is selected in the switcher at the top of the console | Up to a year, or until you clear site data |
glo-theme | Cookie and local storage | Light or dark, written in both places when you use the theme switch — the cookie so the server can render the right theme before the page paints | Up to a year, or until you clear site data |
glo-lang | Cookie | en, fr or sw — the console's language, written when you pick one; the server reads it to render the page in that language | Up to a year, or until you clear site data |
glo-device-id | Local storage | A random identifier for this browser, sent to us so the console can show you the devices signed into your account, let you sign them out, and apply the device limit on your plan | Until you clear site data — clearing it makes this browser appear as a new device |
glo-cart-v2 | Local storage | What you have put in the cart and not yet checked out | Until you check out or clear it |
In the terms the ODPC's guidance uses: the sb- cookies and glo-admin-session are session cookies, lasting no longer than the sign-in they support; glo-active-biz, glo-theme and glo-lang are persistent cookies, up to a year. All of them are first-party — set by the console you are signed into, on that console's own domain. Gloodoh sets no third-party cookie anywhere.
Each of these exists to do the thing you signed in to do. The sign-in cookies, the business switcher, the device id and the cart are necessary to perform the contract you signed in under (Data Protection Act, No. 24 of 2019 (Cap. 411C), s.30(1)(b)(i)); the theme and the language remember choices you made yourself. There is no analytics cookie and no advertising cookie on either console. Because none of these rests on your consent, there is no consent here for you to withdraw — but nothing else is taken away by that: you can still ask what the console holds about you, have it corrected or deleted, restrict it, or object to it, as set out at the end of this page. Signing out ends the session cookies; clearing site data removes the rest.
If you block cookies for supplier.gloodoh.com or manage.gloodoh.com, you cannot sign in at all. A sign-in that is not remembered from one page to the next is not a sign-in. This is the only place in Gloodoh where refusing cookies stops the product working.
The console also registers your browser as a device, labelled from your browser and operating system — "Chrome · macOS", for example — so you can spot and end a session you do not recognise. What that record contains is set out in the privacy policy; the last section says how to get a copy.
What the Gloodoh apps keep on your device
Gloodoh Supplier, Gloodoh Consumer and Gloodoh Uploader are not web pages and do not use cookies. They do keep things on the device, and you should know what.
- A local database. Each app keeps a small file on the device that caches what you have already loaded — catalogue, orders, drafts — so the app still works when the network does not.
- Your sign-in session, held in the app's own private storage by the authentication library, so you are not asked to sign in every time you open it.
- A device identifier and a device name, sent to us when you sign in so your list of signed-in devices works and the device limit on a plan can be applied. On Android the identifier is the Android ID your phone gives to apps and the name is its make and model; on iPhone and iPad it is Apple's identifier for vendor, which resets when you delete the app, and the name is whatever you called the device in iOS settings — often your own name; on desktop it is a random id in a file at
~/.gloodoh/device_id. - A push token from Firebase Cloud Messaging in Gloodoh Supplier and Gloodoh Consumer, so a notification about an order, a payment or a booking can reach that device. Gloodoh Uploader ships without Firebase and receives no notifications, so it holds no push token.
- Google's advertising SDK. The Google Mobile Ads SDK is compiled into all three Android apps, because they share one code library, and into Gloodoh Supplier on iPhone and iPad. It is started at launch in Gloodoh Consumer on Android and in Gloodoh Supplier on iOS; in the other apps it is present but not started unless a screen carrying an ad slot opens. When it runs it keeps its own storage on your device, contacts Google, and may use your device's advertising identifier. We cannot see what it stores; that part is Google's, under Google's privacy policy.
Every ad slot in Gloodoh today uses Google's own public test ad units. They carry a "Test Ad" label, they are not chosen for you, and they earn nothing. The SDK is still real and still talks to Google, which is exactly why it is on this page rather than left out of it. If real advertising is ever switched on, we will update this page and the privacy policy before it happens.
You can limit it. On Android, Settings, then Google, then Ads lets you reset or delete the advertising identifier. On iPhone and iPad we do not show the App Tracking Transparency prompt at all, so the SDK has no permission to use Apple's advertising identifier to track you.
Signing out clears the app's cached data from that device, and uninstalling removes it. That is not the same as deleting your account — the records we hold on our side are a separate request, explained at delete your account and data. And signing in with Google or with Apple opens their own sign-in page in a browser: whatever that page stores is theirs, not ours.
Whether we need your consent
For this website, no. There is no cookie on gloodoh.com to accept or refuse, so a banner would have nothing to ask you and we are not going to manufacture one. Inside the apps there is one thing consent does govern, and it is the last item below.
One thing to be straight about: the Office of the Data Protection Commissioner's guidance on cookies says a website should display a cookie banner or pop-up. That guidance is addressed to sites that set cookies. This one sets none, and a banner asking your permission for nothing is a dark pattern of its own kind — it teaches people to click through a question that was never real. The day we set a cookie here, the banner comes with it.
Kenyan law has no cookie-specific section. What the Data Protection Act, No. 24 of 2019 (Cap. 411C) requires, at section 29, is that before we collect personal data we tell you — so far as is practicable — that it is being collected, the purpose, the third parties it will be transferred to and the safeguards adopted, our contacts, the security measures we take, whether providing it is voluntary or mandatory, what follows if you do not provide it, and the rights you hold under section 26. This page, and the privacy policy it points you to, are that telling. Where consent is the basis for something, the Act sets a high bar: it must be express, unequivocal, free, specific and informed. A pre-ticked box, silence, or a banner whose only button says "Accept" is not consent.
Measured against that, here is the position on each thing on this page.
glo-lang,glo-theme— you set these yourself by clicking something. Remembering the answer is the whole point of the click.glo-aud— written by the legal pages themselves, atall, before you press anything, so that a filter you set on one page still holds on the next. It records nothing about you but which passages you asked to read, it never leaves your browser, and clearing it costs you nothing.- The console's sign-in cookies, business switcher, device id and cart — necessary to do the thing you asked for. Without them you cannot stay signed in or keep a cart from one page to the next.
glo-leads— written only so a message you had already chosen to send us is not lost, and only inside your own browser.- Analytics and advertising on this website — there are none. There is nothing to consent to.
- Google's ad SDK inside the apps — the only thing in Gloodoh capable of identifying you for advertising, and the one item on this page where consent, not necessity, is the question. Section 37(1) of the Data Protection Act, No. 24 of 2019 (Cap. 411C) requires express consent before personal data is used for commercial purposes, and regulation 14(2)(b) of the Data Protection (General) Regulations 2021 counts an advertisement shown to a signed-in user using their personal data as direct marketing. Today every slot runs Google's public test units: no ad is chosen using anything about you, and we ask Google to profile nobody. Before a single real or targeted ad is switched on we will ask you inside the app, in plain words, and a "no" will leave the app fully working. The push token is Google's too — Firebase issues it and needs it to deliver a notification — but it is used to reach your device, never to profile it.
If we ever add an analytics or advertising cookie to this website, you will get a real choice: a plain question, a "no" that is honoured, and a site that keeps working either way.
Do Not Track and Global Privacy Control
There is nothing on this website for those signals to switch off.
Do Not Track and Global Privacy Control are signals your browser can send asking a website not to track you across the web, or not to sell or share your data. Gloodoh does not track you across the web. There is no analytics, no advertising cookie, no pixel, no cross-site identifier and no data broker in this website, and we never sell personal data to anyone, anywhere in Gloodoh. There is one place where data does reach an advertising company, and it is named in full above rather than hidden here: the Google Mobile Ads SDK inside the apps, which contacts Google and may read your device's advertising identifier. A browser signal cannot reach that SDK. Android's advertising-ID controls, and on iPhone the fact that we ask for no tracking permission at all, are what limit it — both are explained in the section on the apps.
So the signal makes no difference on gloodoh.com — not because we ignore it, but because the behaviour it asks us to stop does not happen here. If we ever begin doing something on this website that a browser signal would be right to object to, we will honour the signal and say so on this page.
Questions, and how to complain
Ask. A question about this page is a question about your data, and it goes to the same place.
- privacy@gloodoh.com — anything about data, including this page. It is a monitored mailbox; if it ever bounces, support@gloodoh.com reaches the same people.
- support@gloodoh.com — help with an order, an account or an app.
- legal@gloodoh.com — formal or legal notices.
The fuller picture — every category of data we hold, who else processes it, and how long we keep it — is in the privacy policy, which is published at gloodoh.com/privacy. Until that page is live, write to privacy@gloodoh.com and we will send you a copy. Deleting your account and the data attached to it is a separate route, set out at delete your account and data.
You also have rights over the data behind everything on this page. Under the Data Protection Act, No. 24 of 2019 (Cap. 411C) you may be told what we hold and why, get a copy of it, have it corrected, have it deleted, restrict what we do with it, object to processing, and ask for it in a portable form (ss.26, 34, 36, 38 and 40). The Data Protection (General) Regulations 2021 set the clocks, and we keep to them: an access request answered within seven days and free of charge, a rectification, erasure, restriction or objection request within fourteen days, and a portability request within thirty. An objection to direct marketing is absolute — we stop, with nothing weighed against it. Write to privacy@gloodoh.com.
If you think we have handled your personal data wrongly, tell us first at privacy@gloodoh.com. If you are not satisfied with what we say, you can complain to the Office of the Data Protection Commissioner. It is free. It can be lodged online at cie.odpc.go.ke, by email to info@odpc.go.ke, orally, through someone acting for you, or anonymously. The ODPC acknowledges a complaint within seven days and must investigate and conclude it within ninety days (Data Protection Act, No. 24 of 2019 (Cap. 411C), s.56; Data Protection (Complaints Handling Procedure and Enforcement) Regulations 2021 (Legal Notice 264 of 2021), reg 4).
Gloodoh is operated by iTsitso Space LTD, a company incorporated in the Republic of Kenya. iTsitso Space LTD is the data controller for everything described on this page, and this page is governed by Kenyan law. Where the law of another country you live in gives you rights that cannot be signed away, those rights are unaffected.
When this page changes, the date at the top changes with it.