Privacy policy

Version 2026-09-12. Effective September 12, 2026.

This Privacy Policy explains how Lab161 LLC (“Lab161,” “ClawPad,” “we,” “us,” or “our”) collects, uses, discloses, and retains information when you use the ClawPad website, account and billing services, desktop application, and related support features (collectively, the “Services”). It also explains information that stays on your device unless you choose a feature that transmits or exports it.

1. Information you provide

Account and contact information. When you create an account, use magic-link or Google authentication, or contact us, we process your email address, submission time, authentication and session information, and any account, profile, support, or message content you provide. Supabase provides website identity, session, and database services and processes this information on our behalf. If you choose Google sign-in, Google authenticates you and provides Supabase with the account information needed to complete that sign-in under Google’s own privacy terms.

Billing information. Stripe hosts subscription checkout and billing-management pages. Stripe collects payment-method and billing details under its own privacy terms. Our systems store or receive Stripe customer, Checkout Session, payment, subscription, price, event, and status identifiers; purchase time and subscription period; and verified webhook payloads used to project, secure, and audit access. We do not store full payment-card numbers in ClawPad’s application database.

User Content. Depending on the feature you choose, User Content can include screenshots, selected screen regions, microphone or system audio, recordings, transcripts, prompts, follow-up questions, code or text visible on screen, and AI responses. You control when capture, recording, analysis, and diagnostic-export features are started. You are responsible for obtaining legally required recording and processing permissions for every session.

2. Website and network information

The website is hosted on Vercel. When your browser requests a page or API route, Vercel and our server functions may process standard request and security information such as IP address, date and time, requested URL, referrer, browser or user-agent information, response status, and infrastructure logs. Supabase authentication uses cookies or similar browser storage to maintain and refresh your signed-in session. We use this information to deliver the website, authenticate users, prevent abuse, diagnose failures, and protect the Services.

3. Desktop capture, audio, and local processing

When you initiate screen analysis, the desktop application captures the requested screen content and prepares it for analysis. Ordinary capture paths use memory or temporary files and attempt to remove temporary screenshot files after reading them. A capture test can intentionally save a debug screenshot locally, and an exported diagnostic bundle can include that screenshot if it exists.

Live Assist processes microphone and, where supported, system audio as a bounded live stream; it does not create a customer recording library. If you deliberately use the microphone in a follow-up composer, ClawPad creates one transient local WAV for that single transcription and requests exact-file deletion when the attempt settles. A failed deletion remains visible for recovery and retry. Files created by older ClawPad versions are never silently deleted during an upgrade: the desktop shows a one-time inventory and lets you keep them, reveal their location, or explicitly delete the exact files you select.

When you stop a one-shot voice follow-up, the desktop sends that transient audio over HTTPS to ClawPad’s managed Cloudflare gateway. The gateway sends the audio needed for transcription to the current transcription subprocessor described below. The resulting transcript can then be included in a separate managed inference request for answer generation.

ClawPad stores recent conversation sessions locally as JSON files. Those files can contain transcript or follow-up text, screenshot summaries (not raw screenshot image data), AI response content and summaries, context type, language, timestamps, duration, and token estimates. The application keeps a bounded set of recent sessions and, on startup, prunes sessions that have not been updated for more than 24 hours. You can also delete sessions in the application.

4. Managed AI and transcription subprocessors

Customer releases route chat, vision, and one-shot transcription requests through a ClawPad-managed Cloudflare Worker and dedicated AI Gateway. Lab161 controls the available upstream subprocessors and models on the server. Customers may select an available managed model where the application offers that choice and do not supply a provider API key. The managed gateway authenticates the device, applies request and usage limits, and forwards only the content and technical request data needed for the requested feature. Responses return through the gateway to the desktop application for display and local conversation context.

Managed AI inference providers process the content of an answer request: prompts, conversation context, transcript text, screenshots or selected screen content, and the generated answer. More than one provider serves this category. One is the default answer model; another answers when you select it, and when an eligible failed answer is automatically retried. The screenshot Model recovery preference controls screenshot retries only; it does not disable live-answer recovery or a model you selected yourself. Speech-to-text providers receive audio you have chosen to send and return transcript text. Cloudflare processes both request types to operate the Worker, AI Gateway, routing, security, and billing layers. The providers currently serving each category are named on our subprocessors page, which we keep current and surface beside the policy links in the application. They may process data in locations and under retention schedules described in their own terms and privacy materials.

Cloudflare-side AI Gateway payload logging and response caching are disabled for ClawPad requests, and the Worker is designed not to write screenshots, audio, prompts, transcripts, or generated answers to Worker storage, analytics, traces, or logs. Those controls are separate from upstream-provider retention and are not a promise of zero data retention. The current inference and transcription routes are not covered by Cloudflare’s gateway-level zero-data-retention setting, and we do not promise gateway-enforced zero data retention for any provider. Inference and speech-to-text providers may retain request data under their applicable terms and policies. Any zero-data-retention label associated with an individual model is not a gateway-enforced commitment by ClawPad.

Live Assist uses a streaming speech-to-text provider, named on our subprocessors page. The desktop sends microphone and, where supported, system audio through the ClawPad-managed Cloudflare Worker, which connects directly to that provider over an encrypted connection. It processes the live audio and returns transcripts; those transcripts can then be included in separate managed inference requests for answers. Live Assist audio sent to that provider does not pass through the dedicated AI Gateway, and AI Gateway payload-logging, caching, and zero-data-retention settings do not apply to that direct connection. The provider handles audio, transcripts, and operational usage metadata under its applicable terms and privacy policy. We do not promise zero retention or a particular processing region for this route.

We do not control a subprocessor’s independent security, processing location, or retention beyond our available configuration and contractual controls. Do not submit content you are not authorized to disclose.

5. Device pairing, security, and entitlements

When you pair the desktop application with your account, we process an installation identifier, device name, operating system, application version, pairing code and secret, and request timestamps. Before database storage, installation identifiers, pairing codes, and polling secrets are converted to keyed digests. Stored device records include a pseudonymous installation digest, device metadata, last-seen and revocation times, and account association; they do not contain raw hardware identifiers.

Approved pairing issues an opaque device credential that the desktop stores in the operating system’s credential store. The server stores only a cryptographic token digest plus issue, expiry, last-seen, and revocation information. Device credentials are currently configured to expire after 90 days unless refreshed or revoked. Pairing requests expire after approximately 10 minutes, and the database removes pairing-request records older than 24 hours when a new pairing request triggers cleanup.

Entitlement records can include plan, status, capabilities, device limit, Checkout Session, subscription and price identifiers, purchase or current billing-period dates, access expiration, grace-period information, source, version, and the latest verified Stripe event reference. The server returns a signed, short-lived offline entitlement lease bound to the device credential so the desktop can verify limited offline access. Checkout redirects do not grant entitlement; verified billing events control paid access.

6. Local settings, credentials, logs, and diagnostics

The desktop application stores settings and operational data locally, including language and interface preferences, capture and audio settings, hotkeys, storage paths, app version, and feature state. Device credentials are placed in operating-system credential storage where supported. Local log files can include timestamps, application events, managed-request stages, file paths, readiness results, error details, and limited request or transcript previews generated during operation.

Development builds can expose direct-provider configuration and diagnostic tools that are not included in customer releases. Where a developer supplies an API key, the development build places it in operating-system credential storage where supported and does not intentionally include the secret in diagnostic exports.

Development diagnostics are generated on demand from local state. A diagnostic report or exported bundle can include platform and architecture, app version, executable and log paths, backend and model details, whether a development key is configured (not the key itself), sanitized settings, readiness and runtime state, FFmpeg path, log contents, and metadata about or a copy of the last debug screenshot. Diagnostic bundles remain local unless you choose to send them to us or another person. Review the entire bundle, especially logs and any screenshot, before sharing it.

Support reports and customer crash diagnostics. You can send a manual issue description without diagnostics, optionally attach a prepared diagnostic bundle, or separately enable standing consent for automatic reports after ClawPad detects an unexpected quit. An attached bundle contains the application and platform version, a closed reliability summary, a bounded structured reliability journal, and a bounded recent log tail. Dedicated audio and screenshot media, and transcript, prompt, and AI-answer fields, are not intentionally attached. Because the bounded log tail comes from the ordinary application log, it can contain limited request or transcript previews and unexpected context. Before upload, ClawPad attempts to scrub known credential, email-address, and local-home-path patterns. Sanitization reduces risk but cannot guarantee that every unexpected value has been removed, so the application discloses the included categories and a bounded log sample before a manual attachment is enabled.

Support reports are processed by Vercel server functions and stored in Supabase for Lab161 support and engineering access. A report from a paired desktop is associated with the account and device that authenticated it; we do not additionally store its pseudonymous network identifier in the report. For abuse prevention, an anonymous request’s IP address is converted using HMAC-SHA256 and a dedicated server-side secret before storage, admission, and rate limiting. We store the issue description, category, application and platform version, consent and bundle-integrity metadata when diagnostics are attached, the selected diagnostic fields, report status, and creation and expiry times.

7. How we use information

We use information to provide, authenticate, and maintain the Services; process communications; pair and manage devices; verify purchases, subscriptions, and entitlements; process transactions through Stripe; route requested content through the managed gateway and current AI subprocessors; troubleshoot and support users; detect fraud, abuse, and security incidents; enforce our Terms and AUP; comply with law; and protect users, Lab161, and third parties. We do not sell personal information for money or use capture or audio content for cross-context behavioral advertising.

8. Email communications

Service messages. We send messages needed to operate your account, including sign-in links, device-approval notices, billing and receipt notices, security alerts, and notices about changes to our terms. These are part of providing the Services, are sent on the basis of our contract with you, and are not marketing. They cannot be switched off while you hold an account.

Product and marketing messages. Separately, and only where you have asked for them, we send product updates, getting-started guidance, occasional offers, and invitations to research sessions. Each is a topic you choose individually. Where consent is the legal basis we rely on your consent; where applicable law permits it, we may instead rely on our legitimate interest in telling an existing customer about closely related features. We do not sell or rent your email address and we do not send marketing for third parties.

How you control them. Every marketing message contains an unsubscribe link and supports one-click unsubscribe in mail applications that offer it. You can also change any topic from your account at any time. We act on a withdrawal as soon as we receive it. Withdrawing marketing consent never affects service messages, your subscription, or your access to ClawPad.

What we record, and why. To show that a message was permitted, we keep a record of each consent decision: the topic, whether it was granted or withdrawn, the time, the page or link used, and a one-way hash of the requesting IP address and browser user-agent. We keep those hashes rather than the underlying values. We also record whether a message was delivered, bounced, or reported as spam, so that we stop contacting an address that fails or objects. A suppression record outlives the contact record itself, because its whole purpose is to prevent future contact; this is also why a deletion request anonymises a contact rather than removing every trace of it.

Providers and tracking. Resend delivers our email on our behalf and processes the recipient address, message content, and delivery result under its own terms. Our contact list, consent records, and suppression records remain in our own Supabase database rather than a marketing platform. We do not use open-tracking pixels. Where a message contains links, we may record that a link in that message was followed so we can judge whether the message was useful; we do not use this to build a profile of you across other websites.

9. How we disclose information

We disclose information to service providers only as reasonably necessary for their functions, in the categories described in this Policy: website hosting and server execution, authentication and database services, optional federated sign-in, checkout and billing, email delivery, the managed AI gateway, managed AI inference, and speech to text. The providers currently serving each category are named on our subprocessors page. We may add or replace a provider within a category described here; we update that page and note the change in the application. A provider processing for a purpose this Policy does not describe is a change to this Policy, and we give notice of it. We may also disclose information to professional advisers, auditors, insurers, or transaction counterparties subject to appropriate duties; to comply with valid legal process; or when reasonably necessary to protect rights, safety, and security.

If Lab161 is involved in a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets, information may be disclosed as part of that transaction subject to applicable law. We do not authorize service providers to use ClawPad information for their own unrelated purposes, but a provider may process information as independently permitted by its own terms and applicable law.

10. Retention

Except for the specific local-session, pairing, and device-session periods described above, we retain information only for as long as reasonably necessary for the purposes in this Policy, including to provide an account or paid entitlement, maintain security and billing audit records, resolve disputes, enforce agreements, and satisfy legal, tax, accounting, or compliance obligations. Retention varies by record type and context. Each provider on our subprocessors page applies its own retention schedule. Disabling Cloudflare-side payload logging and caching does not control retention by an inference or speech-to-text provider.

Support reports and attached customer crash diagnostics expire 30 days after submission. Daily maintenance permanently deletes expired records, so deletion can occur after the 30-day expiry during the next successful maintenance run. Deleting an account also deletes support reports associated with that account, subject to any limited record we must retain under applicable law. Anonymous reports cannot be located by email alone and may require the report reference ID to process an access or deletion request.

Live Assist does not create local recordings. A one-shot follow-up dictation creates one transient local WAV and requests exact-file deletion after its transcription attempt settles, whether the attempt succeeds or fails. If deletion is deferred or fails, that file remains on your device for an exact cleanup retry and ClawPad blocks another recorded-audio start until cleanup completes. Recordings created by older ClawPad versions remain on your device unless you explicitly delete the exact files listed by the one-time migration notice or remove the relevant application-data directory. Choosing Keep dismisses that notice without changing any file. Debug screenshots, logs, settings, diagnostic bundles, and other application data remain until deleted by you, overwritten or pruned by an implemented application process, or removed with the relevant application-data directories. Uninstalling the application may not remove every file, including files saved to a user-selected recording or export location.

11. Security

We use administrative, technical, and organizational measures designed to protect information, including hosted HTTPS, restricted server credentials, hashed pairing and device-session secrets, operating-system credential storage, signed offline entitlements, and access controls. No storage, transmission, capture-exclusion feature, or security measure is completely secure. You are responsible for device security, software updates, recording permissions, and reviewing content before capture, submission, or diagnostic sharing.

12. Your choices and requests

You can choose not to create an account, use Google sign-in, pair a device, begin checkout, start a capture or recording, send a managed AI request, attach diagnostics to a manual support report, enable automatic crash reporting, or export development diagnostics. Automatic crash reporting is off by default; you can withdraw standing consent at any time in Settings, which prevents later automatic uploads without deleting reports already submitted. You can manage browser cookies through browser controls, revoke paired devices through your account where available, sign out or revoke a desktop session, cancel an eligible subscription through the billing flow, delete local conversation sessions, and delete local files using operating-system tools.

Depending on where you live, you may have rights to request access, correction, deletion, portability, restriction, objection, or withdrawal of consent, and to appeal or complain to a regulator. These rights may be subject to exceptions and identity verification. To make a privacy request, contact us at support@interviewclaw.app. We may retain records that applicable law permits or requires us to keep.

13. Children

The Services are not directed to children under 13, and we do not knowingly collect personal information from a child under 13. If you believe a child has provided personal information, contact us so we can review and, where required, delete it. Users who are not the age of legal majority where they live must use the Services only with authorization and supervision from a parent or legal guardian.

14. International processing

Lab161 and its service providers may process information in the United States and other countries where they operate. Those countries may have privacy laws that differ from the laws where you live. Where required, we use an appropriate legal basis and transfer mechanism. By using a managed AI or transcription feature, you direct ClawPad to transmit the required request content through Cloudflare to the current inference or transcription subprocessor in the locations described by their policies.

15. Changes to this Policy

We may update this Policy to reflect changes in the Services, law, providers, or data practices. We will post the revised version and effective date and provide any additional notice required by law. If a material change requires renewed consent under our legal-consent process or applicable law, we will request it before the affected processing continues.

16. Contact

Lab161 LLC is responsible for the ClawPad data practices described in this Policy. Privacy questions and requests may be sent to support@interviewclaw.app.