Privacy Policy

ClipVault is operated by ClipVault LLC, 30 Sadler Lane, Williston, Vermont, 05495, United States ("we", "us"). We are the controller of the personal data described in this policy. You can reach us at clipvault162@gmail.com.

Account information (via Clerk)

We use Clerk to handle sign-up and sign-in. When you create an account, Clerk processes your email address and, depending on how you sign in, your name, profile image and the identifier of any social login provider you choose. Clerk shares your Clerk user ID, email address, name and profile image URL with us, and we store them in our database. Your password, if you use one, is handled by Clerk; we never receive or store it.

Content you save

• The URLs you submit, and any start/end times you set for video clips.
• Metadata we retrieve about those URLs: titles, descriptions, author names, site names, thumbnail image addresses, short excerpts, publication dates, video durations and official embed code.
• Notes, tags, favorites and collections you create.

Subscription and billing information

Payments are processed by Stripe. We store your Stripe customer ID, subscription ID, the plan (price) you are on, subscription status, billing-period dates and whether your subscription is set to cancel. We do not receive or store your full card number, CVC or bank details.

Usage and technical information

• A count of the clips you have created in the current month, used to apply plan limits.
• Server and error logs generated by our hosting and infrastructure providers, which may include your IP address, browser user agent, the pages and API endpoints you request, and timestamps.

We do not use third-party analytics or advertising trackers.

• To provide the service: save, process, display, search and export your clips (performance of our contract with you).
• To manage your subscription: apply plan limits, unlock Pro features and keep billing status in sync with Stripe (contract).
• To keep the service secure and reliable: rate limiting, abuse prevention, debugging and protecting our infrastructure (legitimate interests).
• To communicate with you: service and billing messages, such as receipts and payment-failure notices sent by Stripe (contract).
• To meet legal obligations: tax, accounting and responding to lawful requests (legal obligation).

We do not sell your personal information or share it for cross-context behavioral advertising.

We only use cookies that are strictly necessary for the service to work:

• Authentication cookies set by Clerk keep you signed in and protect your session. Without them you cannot use your account.
• Stripe sets its own cookies on Stripe-hosted Checkout and Billing Portal pages to process payments and prevent fraud. Those pages are governed by Stripe's privacy policy.

We do not set analytics, advertising or cross-site tracking cookies.

When you submit a URL, our servers fetch publicly available information about it from the source site, from the YouTube Data API (operated by Google) and from X's public oEmbed endpoint. These requests come from our servers, not your browser.

When you view your clips, some content loads directly from third parties into your browser:

• Thumbnails load from the image host that published them. That host can see your IP address and browser details (we suppress the referrer).
• YouTube videos load only when you press "Play clip", using YouTube's privacy-enhanced mode (youtube-nocookie.com). Once the player loads, YouTube may store data on your device and process your data under Google's privacy policy.
• X posts are rendered by X's widget script, which loads only when you choose "View post". We request X's do-not-track mode, but X processes data under its own privacy policy.

We share personal data only with providers that help us run the service, and only as needed for their role:

• Clerk: authentication and account management.
• Stripe: payment processing, subscriptions, invoicing and fraud prevention.
• Vercel: application hosting and request logs.
• Our managed PostgreSQL database provider: storage of account, clip and subscription data.
• Inngest: background job processing (jobs reference clip and user IDs).
• Google (YouTube Data API) and X (oEmbed): retrieving public metadata about URLs you submit.

We may also disclose information if required by law, to protect the rights and safety of our users or the public, or as part of a merger, acquisition or sale of assets, in which case this policy will continue to apply to your data.

All payments are handled by Stripe, Inc. and its affiliates. When you subscribe, you enter your payment details directly on Stripe's hosted pages. Stripe processes them under its own privacy policy and acts as an independent controller for certain fraud-prevention and regulatory purposes. Stripe sends us confirmation of payments, renewals, failures and cancellations so we can keep your plan up to date.

• Account and content data is kept while your account is active. When you delete your account, we delete your profile, clips, notes, tags and collections from our database and immediately cancel any active subscription.
• Billing records (your Stripe customer record and invoices) are retained by Stripe, and by us where required, for as long as tax and accounting laws require.
• Logs and backups are kept for a limited period set by our providers and then deleted or overwritten in the normal course.

We use encryption in transit (HTTPS), access controls scoped to each account, verified webhook signatures and reputable infrastructure providers. Server-side fetching of submitted URLs is restricted to public internet addresses. No system is perfectly secure; if we learn of a breach affecting your data, we will notify you as required by law.

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a copy in a portable format;
• correct inaccurate data;
• delete your data, which you can do yourself by deleting your account;
• object to or restrict certain processing;
• withdraw consent where processing is based on consent;
• lodge a complaint with your local data protection authority.

You can update your profile details in your account settings. To make any other request, email clipvault162@gmail.com. We will respond within the time required by applicable law and may need to verify your identity first. A copy of your data is available on request regardless of your plan; the in-app export tool is a separate Pro feature.

Our providers may process data in the United States and other countries. Where data is transferred out of the EEA, UK or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an applicable adequacy framework.

ClipVault is not directed to children, and you must be at least 16 years old to create an account. If you believe a child has given us personal data, contact clipvault162@gmail.com and we will delete it.

We may update this policy as the service changes. We will update the "Last updated" date above and, for material changes, notify you by email or in the app before they take effect.

Questions about privacy? Email clipvault162@gmail.com or write to ClipVault LLC, 30 Sadler Lane, Williston, Vermont, 05495, United States. See also our Terms of Service.