Privacy Policy

Effective November 15, 2026

This policy explains what information GTLX ("we", "us") handles when you use this website and portal (the "Service"), why, and the choices you have. GTLX is an independent, unofficial project. It is not operated by, affiliated with, or endorsed by ViaPath Technologies, Inc. ("ViaPath"), GTL, or any correctional facility. ViaPath's own privacy policy governs your ViaPath account and the messages ViaPath processes.

1. Information we handle

• Your ViaPath sign-in. When you sign in, your email and password are sent to ViaPath's sign-in service to obtain a session. Your password is kept only in the server's memory while you're signed in. It is never written to disk, logs, or backups, and it is erased when you sign out or the server restarts.
• Staying signed in. So you don't have to sign in again after maintenance or an update, the Service saves your ViaPath session (a temporary access token and ViaPath's session cookies, not your password) in its database, along with the cookie that identifies your browser. These let the Service resume your session until ViaPath's session expires, after 14 days without use, or when you sign out, whichever comes first. Signing out of your last device deletes them.
• Account and message data from ViaPath. To show your conversations, the Service retrieves your profile details, contacts, messages, message status, balance and related information from ViaPath on your behalf. A copy of messages you view is kept in a database for your account so your history loads quickly and survives restarts.
• Things you add. Nicknames, relationships, birthdays, notes, profile photos, scheduled messages, and your settings.
• Contact form. Your name, email, topic, message and IP address when you write to us.
• Technical data. Server logs record events such as sign-ins, errors, and the time, recipient and outcome of sends, along with IP addresses. Logs are designed to exclude passwords, access tokens, and message contents.
• Cookies. We use one essential cookie to keep you signed in, and your browser's local storage to remember preferences like theme and drafts. We do not use advertising or analytics cookies.

2. How we use it

• To provide the Service: show conversations, send and schedule messages you ask us to send, and display your balance and message status.
• To keep the Service secure: prevent abuse, rate-limit sign-in attempts, and investigate problems.
• To respond to messages you send us.

We do not sell your information, share it for advertising, or use it to build profiles about you.

3. Who we share it with

• ViaPath, because every action you take (signing in, reading, sending) is carried out through your ViaPath account. Messages remain subject to facility monitoring and review as described by ViaPath and the facility.
• Our hosting provider (Fly.io), which stores the Service's servers and databases.
• Authorities, if required by law or to protect someone's safety.

4. Retention

Your portal data (message archive, profiles, photos, notes, schedules) is kept until you ask us to delete it. Backups are rotated automatically and kept for about two weeks. Contact-form messages are kept as long as needed to handle your request. Logs are rotated automatically.

5. Security

The Service runs over HTTPS, keeps each person's data in a separate database, protects sessions with secure cookies, and stores data on encrypted disks. No system is perfectly secure. Please use a strong, unique password for your ViaPath account.

6. Your choices

• Sign out at any time. Signing out of your last device erases your password from memory, deletes your saved ViaPath session, and stops background activity for your account.
• Delete your nicknames, photos and notes in the app, or ask us to delete all of your portal data using the contact form (choose "Privacy or data request").
• Depending on where you live, you may have rights to access, correct, or delete your information. Contact us and we will help.

7. Children

The Service is intended for adults (18+) who hold their own ViaPath account. We do not knowingly collect information from children.

8. Changes

We may update this policy. If the changes are significant, we'll note them on this page and update the effective date.

9. Contact

Questions or requests: use the contact form.