Privacy Policy

1. What stays on your device

Screen recordings, webcam video, microphone audio, screenshots, annotations, cursor data and every project setting are processed on your device, inside the Flicka extension for Chrome, and stored in the extension's own local storage (IndexedDB and localStorage). None of it is sent to our servers on any plan. We cannot access it.

The extension can run on the pages you visit so that it can show its recording bar there, let you draw, blur and spotlight on the page you are recording, and note where you click so the editor can zoom to it. It does this only while a recording you started is running, the result is saved with that recording on your device, and the extension does not read, collect or transmit your browsing history or the content of pages.

Exports you download go to your device. We do not receive a copy. If you choose to save an export to Google Drive, the file goes from your device straight to your own Drive using a permission limited to files Flicka creates; we never receive it.

Your microphone and camera are used only while a recording you started is running, or while you check your framing before one, and what they capture is saved only into that recording on your device. Chrome asks for your permission first, and you can withdraw it in Chrome's settings at any time.

Captions are made on your device too. The speech-recognition model runs inside the extension; the sound of your recording is never sent anywhere to be transcribed. The first time you use captions, the extension downloads the model's files (data, not program code) from Hugging Face, Inc. and your browser keeps them for next time. That download tells Hugging Face's servers your IP address and that a model file was requested, as any download does, and nothing about you or your recording.

The extension contains all of the code it runs. It does not load Google Analytics' script or any other third-party script. Anonymous usage statistics are off unless you turn them on; section 5 says exactly what they contain. The extension's use of information received from Google APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

2. Data we collect when you sign in

Signing in is optional and only needed to buy or use a Pro plan. When you sign in with Google through Firebase Authentication we receive from Google your name, email address, profile picture and a Google account identifier. Firebase (Google LLC) stores your account record on our behalf.

We use this to identify your account, show your name in the app, tie your plan to your account and contact you about your purchase or the Service.

3. Data we collect when you buy Pro

Purchases are made through Paddle, our merchant of record. Paddle collects your payment details, billing address and tax information directly. We never see your card number. Paddle's privacy policy (https://www.paddle.com/legal/privacy) governs that data.

Paddle sends us a record of the purchase: which plan you bought, its status, renewal date, a customer identifier, a subscription or transaction identifier, and the email used at checkout. We store this against your account in Google Firestore so the app knows which plan to unlock. We keep it while your account has a plan and for as long as we need it for accounting and tax obligations.

4. Data stored in your browser by us

• Your Firebase sign-in session, so you stay signed in on the website, and a copy of it handed to the extension when you sign in, so the extension knows your plan. The extension verifies it against Google's public keys and keeps it in its own storage; signing out on the website removes it from both.
• A copy of your last verified sign-in token, so your plan still works for up to seven days without a connection.
• Preferences such as recording defaults, the recording bar's position and first-run progress.

This is technical storage needed to run the Service. We do not use advertising cookies or ad scripts.

5. Analytics (Google Analytics)

We use Google Analytics 4 (Google LLC) to count visits and understand which parts of the website and app are used, so we can improve them. Google's script is only loaded after you choose “Allow” in the consent notice shown on your first visit. Until then, and if you choose “No thanks”, nothing is sent to Google at all. Google Analytics 4 does not log or store full IP addresses.

Events we record are limited to product usage: page views, sign-in, opening the upgrade sheet, starting a checkout, a completed purchase (plan and amount, never card details), and a completed export (format and size). We never send recording content, file names or project names to Google.

You can change your choice at any time via the “Cookie settings” link in the footer. Clearing site data also resets it. Google's privacy policy: https://policies.google.com/privacy.

The extension asks separately, once, on its welcome page: “Share anonymous usage stats?”. It stays off unless you say yes, and “Stats” in the extension's popup turns it on or off at any time. When it is on, the extension sends Google Analytics a count of what was used: that the extension was installed or updated, that a recording was started, saved, recovered or failed (with the kind of source, whether the microphone and camera were on, the quality setting and the length in seconds), that a screenshot was taken, that captions were generated (model and language), that an export finished (format and size), that the upgrade sheet was opened, together with the extension's version, your browser's language and a random identifier created on your device for this purpose. As with the website, Google also sees the browser and operating system making the request and derives an approximate country from the IP address, which it does not store. It never sends the address or title of any page, anything you record, type or draw, file or project names, or your account details, and the identifier is not linked to your account. Turning stats off deletes the identifier.

6. Server logs

Our hosting provider (Vercel Inc.) records standard request logs, including IP address, browser type, the page requested and the time, for security and to keep the Service running. Logs are kept for a short period and then deleted.

7. Who we share data with

• Google LLC (Firebase Authentication and Firestore): account and plan records.
• Paddle: payment processing, invoicing, tax and refunds, as merchant of record.
• Vercel Inc.: hosting the website and its API.
• Google LLC (Google Analytics): usage analytics, on the website and in the extension, each subject to your own choice.
• Hugging Face, Inc.: hosts the speech model files the extension downloads the first time you use captions. It receives no personal data from us.

These providers process data under their own terms and security programmes. We do not sell personal data and we do not share it with advertisers.

8. Legal basis

Where the GDPR or UK GDPR applies: we process account and purchase data to perform our contract with you; server logs and fraud prevention on the basis of our legitimate interest in running a secure service; analytics cookies on the basis of your consent; and tax records to meet legal obligations.

9. International transfers

We are based in India. Google, Paddle and Vercel may process data in the United States and other countries. They rely on standard contractual clauses or equivalent safeguards for transfers out of the EEA and UK.

10. Your rights

You can ask us to access, correct, export or delete the personal data we hold about you, or object to or restrict its processing, by emailing robin025.singh@gmail.com. We answer within 30 days. If you delete your account we remove your account record and plan record, keeping only what tax law requires us to keep about the purchase itself. Data on your device is under your control: removing the extension or clearing its data removes your recordings and projects, and clearing the website's data removes the sign-in session.

If you are in the EEA or UK you can also complain to your local data protection authority.

11. Children

The Service is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.

12. Changes

We may update this policy. The date at the top shows the current version, and we will announce material changes in the app or by email.

13. Contact

Privacy questions and requests: robin025.singh@gmail.com.