Data privacy and AI opt-out
GlotFox's AI draft translation sends some of your project's text to a third-party LLM provider. This page says exactly what, when, and how to turn it off. (It addresses the data-privacy risk in PLAN.md section 5.)
What is sent to the LLM provider
Only when the worker runs a translate-missing job for a project and target locale. For each key that has a source-locale value but no translation in the target locale, one request contains:
- the source string (the source-locale value of the key),
- the key name (e.g.
checkout:pay_button), - the key's description/context, if you set one,
- the source and target locale codes.
Nothing else is sent: no other locales' text, no user or org details, no API keys, no repository contents. Strings that already have a translation (any status) are never sent.
The provider is chosen by the operator with LLM_PROVIDER (currently anthropic). Requests go directly from the worker to the provider's API over HTTPS.
What GlotFox keeps
| Data | Where | Retention |
|---|---|---|
| Source strings, translations (including AI drafts), key names, context | translation_keys, translations | Until you delete the key, locale or project (deleting a project cascades). |
| AI translation cache: SHA-256 of the source string, target locale, glossary version, and the translated output | ai_translation_cache | Kept indefinitely; there is no automatic expiry yet. The source text itself is not stored in the cache, only its hash. The cache is keyed by hash, so identical strings are reused across projects. |
| AI usage: word counts per org per month | ai_usage | Kept for billing and quota; contains no text. |
The provider's own retention is governed by the provider's terms and the operator's agreement with them; GlotFox does not control it. Operators should use an API plan with no training on API data and the shortest retention available, and should state their provider's terms to their users.
Opting a project out of AI
Each project has an aiEnabled setting (default true). Owners and admins can turn it off:
PATCH /api/v1/projects/:id
{ "aiEnabled": false }When aiEnabled is false, the worker, which is the only component that talks to the provider, returns before reading any source strings, checking the cache, or calling the provider. No draft is created and no usage is recorded. The check happens in the worker itself on every job, so jobs that were already queued before you opted out are also skipped. Translations you or earlier AI runs already stored are left in place. Delete them if you need them removed.
Setting aiEnabled back to true makes the project eligible for AI drafts again; it does not re-send anything by itself.