Privacy Policy
Last updated 11 October 2026
Clippa is operated by N10K Quests (OPC) Private Limited. This page describes what we collect, where it is kept and how long it stays. It is written to match what the product actually does.
Recording does not send us anything
When you record, the capture happens in your browser and the video is built on your own machine. If you download it, the file never touches our servers at all - there is nothing for us to see, keep or lose. We receive a recording only when you choose to upload it for a share link.
What we collect
| What | Why |
|---|---|
| First and last name | To address you in the product. |
| Email address | It identifies your account and is how we contact you. |
| Password | Stored only as a BCrypt hash. We never hold the password itself and cannot recover it. |
| Recordings you upload | To store them and serve them to whoever opens the share link. |
| Recording title, length, size, date | To list your recordings and apply your plan's limits. |
| Payment records | If you buy Pro: Dodo Payments' customer and subscription IDs for you, your plan's renewal date and whether it renews automatically. We never see or store your card details. |
| Session cookie | To keep you signed in. See below. |
| Server logs | Ordinary request logs, kept briefly, used to keep the service running and to investigate faults. |
| Errors and page performance | When something fails, or a page is slow, in our servers or in your browser, a report goes to New Relic so we can fix it. See "Who else is involved" below. |
What we do not do
- We do not sell your personal information.
- We do not show advertising, and there are no advertising trackers on the site. The only monitoring script is New Relic's, used to find errors and slow pages - not to build a profile of you or follow you across other sites.
- We do not use your recordings to train models.
- We do not watch your recordings, except where you ask us to for support or where the law requires it.
Cookies
We use two, both strictly for running the service:
- JSESSIONID - keeps you signed in. It is marked HttpOnly, so page scripts cannot read it, SameSite=Lax, and Secure over HTTPS. It expires after fourteen days, and signing out ends it on our side immediately.
- XSRF-TOKEN - protects against cross-site request forgery. It identifies nobody and is useless on its own.
We set no other cookies, and none for advertising. New Relic's monitoring script keeps a random session identifier in your browser's local storage (not a cookie), so the reports from one visit can be grouped together. It identifies nobody, and starts over after thirty minutes of inactivity. The sign-up check and the Pro checkout are served by Cloudflare and Dodo Payments from their own domains, under their own cookie policies.
Who else is involved
- Cloudflare R2 stores uploaded recordings. Your browser uploads to it directly using a short-lived signed link.
- Cloudflare Turnstile checks that a person, not a script, is filling in the sign-up form. To do that, Cloudflare receives your IP address and information about your browser while you are on that page.
- Dodo Payments takes payment for Pro, as the merchant of record: it is the seller on your receipt and handles the sales tax for your country. We send it your name and email address; you enter your card details on Dodo's own checkout page, and they never reach us.
- Our email delivery provider sends the emails Clippa sends you - email verification, password resets and plan reminders - so it receives your email address and the contents of those emails.
- Google Fonts serves two typefaces to the pages, which means Google receives the IP address of visitors. We can remove this by self-hosting the fonts if you would rather we did.
- New Relic receives error reports and performance data, from our servers and from the pages you load: which page, what went wrong, how long things took, which buttons and links were clicked (not anything you type), your browser and device type, and your IP address. A server error report can include your email address where it appears in the logged error. New Relic never receives your recordings or your password.
How long we keep things
- Free plan recordings: deleted automatically seven days after they are made. The link stops working immediately at that point, and the file is removed from storage shortly afterwards.
- Pro recordings: kept until you delete them or close your account.
- Account details: kept while your account exists. Deleting your account removes every recording you have stored, in the same request - nothing is left behind for a later sweep.
Security
Traffic between your browser and Clippa is encrypted with TLS. Passwords are stored only as BCrypt hashes. Sign-in uses a server-side session rather than a token kept in the browser, so there is no credential sitting in your browser's storage for a script to read. No system is perfectly secure, and we will tell affected users promptly if we ever discover a breach involving their data.
Your choices
You can see and change your name and email in the product, delete any recording at any time, and close your account. If you want a copy of your data or want it erased, write to us and we will do it. If you are in a place with data-protection law such as the GDPR or India's DPDP Act, your rights of access, correction, erasure and objection apply, and this is how to use them.
Children
Clippa is not intended for children under 13, and we do not knowingly collect their information. Write to us if you believe a child has created an account and we will remove it.
Changes
We may update this policy. The date at the top shows when it last changed, and material changes will be announced in the product or by email.
Contact
N10K Quests (OPC) Private Limited - hello@tryclippa.com