Privacy Policy

ClypLabs, Australia, operates ClypDat and is responsible for the personal data described in this policy. Contact us at hi@clypdat.xyz for privacy questions or requests.

ClypLabs is established in Australia and has no EU or UK establishment. This policy does not name an EU or UK lead supervisory authority.

This policy covers the ClypDat website, the desktop app's clip counter, optional ClypDat accounts, and account-connected features.

Recordings, thumbnails, audio tracks, and the local library stay on your device. ClypDat does not upload them to us or to the account service. You can record without an account.

Account and sign-in data. We process your display name, email address, account identifier, avatar URL supplied by a provider, sign-in method, password hash where you use a password, provider identifier, provider scopes, and account timestamps. This runs the account and the sign-in method you chose. Where GDPR applies, our legal basis is performance of a contract under Article 6(1)(b).

Sessions and security. We process session identifiers, expiry times, IP address, browser user agent, and timestamps to keep your account signed in and prevent misuse. Where GDPR applies, this is contract under Article 6(1)(b) and our legitimate interest in account security under Article 6(1)(f).

Xbox connection. If you connect Xbox, we process your gamertag, XUID, console name, an encrypted refresh token, and current presence returned by Microsoft. Presence is used to supply Xbox activity and is not stored except for console name. So that each activity check does not need a database read, a short-lived Xbox session token, encrypted with the same protection as the refresh token, is cached on Vercel for up to 12 hours, along with whether your account and linked providers exist, also for up to 12 hours. Where GDPR applies, the legal basis is your consent under Article 6(1)(a). Disconnecting Xbox removes its stored connection and clears those cached copies.

Desktop link. Linking a desktop app creates a signed token that identifies your account for 30 days. The app stores it on your device using Windows DPAPI; we do not retain a copy. Where GDPR applies, the legal basis is contract under Article 6(1)(b).

Clip counter. Each time the desktop app saves a clip, an auto-clip, or a full-session recording, it sends a request to clypdat.xyz that adds one to a running total, and adds the save's length in seconds to a total of gameplay saved. We may show these totals on the website and at api.clypdat.xyz. The request contains only the number of saves, their kind, and their length. It contains no video, audio, file name, game, account, or device identifier, and it is sent whether or not you have an account. Saves made while offline are kept on your device as a count and sent later. Like any web request, it reaches us from your IP address; the counter holds that address in memory for up to ten minutes to limit abuse and never stores it with the total. Where GDPR applies, the legal basis is our legitimate interest in measuring how much ClypDat is used under Article 6(1)(f).

Website metrics and logs. Vercel receives page-view and performance measurements, along with hosting logs such as request and error details. We use them to operate, secure, and improve the website. Where GDPR applies, the legal basis is our legitimate interest under Article 6(1)(f). See our Cookie Notice.

We do not sell personal data, use targeted advertising, or make automated decisions with legal or similarly significant effects.

We use Vercel for hosting, Web Analytics, and Speed Insights; Neon for the account database and the clip counter totals; and Cloudflare R2 for release-download storage. These providers process data needed to provide their services.

Google, Discord, and Microsoft operate independently when you choose to link their services. GitHub, Steam, and Cloudflare can receive your IP address when the desktop app checks updates, retrieves game art, or serves a release download. We do not receive that request data.

Our providers can process data outside Australia, including in the United States and Europe. If GDPR or UK GDPR applies, transfers use the safeguards offered by the relevant provider, such as Standard Contractual Clauses or an adequacy mechanism where available. Ask us at hi@clypdat.xyz about a specific transfer.

Account and connected-provider records remain while your account exists. Deleting the account removes the user, sessions, provider accounts, and Xbox connection from the live database. The desktop token stops working immediately: deleting the account also clears the cached copies described above, in every region, so the next use of the token finds no user.

Sessions expire after seven days of inactivity. Xbox connection data is deleted when you disconnect Xbox or delete your account, and the cached Xbox session token expires within 12 hours even if never cleared. Vercel analytics and hosting logs, database backups, and provider copies follow the retention period for the service plan and backup system in use; they are separate from live account deletion.

Clip counter totals are kept for as long as ClypDat runs the counter. They are running sums with nothing linking any part of them to a person or device.

From Account, you can download a JSON copy of account data, correct your display name, disconnect Xbox, and delete your account. The export omits passwords and access or refresh tokens because those credentials could be used to access your account or linked providers.

Where GDPR applies, you can ask for access, correction, deletion, restriction, objection, or a portable copy of your data. You can withdraw consent for Xbox by disconnecting it. Email hi@clypdat.xyz for requests not available in Account. We may need to verify account control before acting. You can complain to the privacy regulator where you live or where you believe a breach occurred.

The clip counter has no setting to turn it off. It sends no identifier, so we cannot tell your saves apart from anyone else's, and access or deletion requests cannot be applied to it.

ClypDat accounts are for people aged 16 or older. If we learn that an account belongs to someone under 16, we delete it. A parent or guardian can contact us at hi@clypdat.xyz.

When this policy changes, we update the date at the top of the page. For a material account-data change, we will email account holders when practical.