A reference for what GlanceOS actually does today — which panels are live, which are sample data, how your data is stored, and how to set up the panels that need something running on your own computer.
Four sources are genuinely live: weather (Open-Meteo, 14 cities), RSS (nine curated tech and security feeds), service status (13 public status pages such as GitHub, Cloudflare, OpenAI and Stripe, up to eight per panel), and crypto prices (BTC, ETH and SOL from Coinbase's public ticker). All are fetched server-side from a fixed allowlist and cached (one minute for crypto, five for the rest). Each weather and RSS panel can pick its own city or feed under Customize, so two weather panels can show two cities.
Watchlist, Calendar, AI Briefing and Commerce (Shopify + Stripe) are illustrative sample data, not live integrations. Market Watch (U.S. Treasury yields and ECB currency rates), News Feed (BBC, NPR, The Guardian, Al Jazeera, DW), Alerts (National Weather Service and USGS earthquakes) and Company Snapshot (SEC EDGAR filings and annual figures) use free official or public sources. Stock prices still need a provider key and remain sample data. Every sample panel is labeled Sample data in its header — that label is never removed while the underlying source is unconnected.
Shows an illustrative Shopify sales summary and Stripe volume summary side by side. Connecting real Shopify/Stripe accounts requires server-side OAuth or API-key storage — GlanceOS never puts account keys in the browser bundle — and is tracked as a planned integration, not yet built.
Reads live CPU, memory, disk and network usage from your own computer. Because browsers cannot read host hardware directly, this requires running a small local collector script yourself:
npm run hardware-collector
The collector listens on 127.0.0.1 only and the browser reads it directly — the reading never touches the GlanceOS server or AWS. Linux only for now; adding macOS or Windows is meaningfully more work since neither has a /proc filesystem to read. Full details, including the CORS/Private Network Access handling, are in docs/HARDWARE-PANEL.md.
Every panel has an i button that shows its provenance: the provider, the exact endpoint, when it was fetched, until when it counts as fresh, its freshness (fresh, aging or stale), the upstream HTTP status and the last error. Press I or use Sources in the top bar to reveal it on every panel at once. Sample panels say plainly that no provider is contacted.
Add the Since Last Look panel to see what changed in your live panels while you were away: new headlines, crypto moves of half a percent or more, temperature changes and GitHub status flips. “Away” means the tab was hidden for two minutes or more, closed, or idle for ten. It is a plain comparison of data GlanceOS fetched, so it cannot invent anything; the AI Briefing panel remains a labeled sample.
The top bar's Fullscreen button enlarges the active layout. Rotation (/app/rotation) cycles through chosen layouts on a timer, with a per-layout dwell override, hover-to-pause and keyboard controls. For always-on screens, Customize offers a 10-foot mode (larger type for reading across a room) and burn-in protection, which shifts the layout a few pixels every two minutes to protect OLED panels. All clocks share one timer that re-syncs after sleep.
Layouts, panel notes, and preferences are saved in this browser's localStorage, versioned and schema-validated on load. They are never uploaded to a server. Clearing browser storage removes them — export a JSON backup from Settings first. Cross-device sync is planned, not built.
The checked-in deployment path is a stateless Node container behind AWS App Runner. Nothing has been deployed by this repository's automation; see docs/AWS.md for the manual release procedure.
Public provider requests go through a single hardened endpoint with a fixed allowlist, redirect rejection, response size limits, and timeouts. API keys and AWS credentials are never placed in the browser bundle or VITE_* variables. The hardware collector binds to loopback only and restricts CORS to localhost and *.glanceos.com origins.