Privacy policy

1. Controller and scope

The controller is the Screengaze operator whose details appear in the legal notice and the contact block on this page. This policy covers the website, Google sign-in, purchases, licence management, Mac authorisation and the waitlist.

Send privacy questions or rights requests to screengazestudio@gmail.com, or by post to Av. Diagonal 676 bis, 1.º 2.ª, 08034 Barcelona, España.

2. Data we process

• Account: the Google identifier, name, email, verification status and profile image URL provided at sign-in; account identifiers and creation or update dates.
• Authentication: sessions, technical access and refresh tokens when Google provides them, permissions and expiry dates; IP address, browser and dates associated with the session; temporary codes for Mac authorisation.
• Purchases and invoices: user, order, Stripe checkout session, payment, customer and invoice identifiers; configured price, subtotal, tax, total amount, currency, language, payment, tax calculation and invoice statuses, and transaction dates. Full card details, billing addresses and tax identifiers are entered into Stripe and are not stored in our database.
• Licences and Macs: the licence and its status, device name, public key and its fingerprint, activation slot, activation, last validation and disconnection dates, and technical checks for activation or renewal.
• Waitlist: normalised email, selected platform —Windows or Linux—, language and registration and consent dates. An email address may join for both platforms.
• Support and security: name, email, subject and message when you use the contact form, information you include when contacting us, technical request data and records needed to run the service and limit abuse. Form limits use identifiers derived by hashing the email address or IP address.
• Transactional email: recipient, subject and content of account, purchase, waitlist and licence-status messages, plus queue status, attempts, dates and provider identifier to manage sending and incidents.
• Cookie preferences: your optional analytics choice, notice version and save date, stored in a first-party cookie for 180 days. No account is required.

3. Local recordings

Screen, camera and microphone capture, editing and projects are processed locally on the Mac. The website has no feature for receiving your recordings or projects. Authorisation and licence validation exchange account and device data, not video content.

If you choose to send material to support, we will receive the content you share. Send only what is necessary and remove other people's data or confidential information first.

4. Purposes and legal grounds

Account and licence data are necessary for the features that require them. The waitlist is optional. Without mandatory data, the relevant function cannot be completed, but you are not required to join the waitlist or purchase.

• Managing your account, signing you in, processing your purchase and providing the licence and its activations: performing the contract or steps you request before entering a contract.
• Saving and confirming the waitlist request and, once campaigns are enabled, sending news about your chosen platform: your specific consent, which you may withdraw. News campaigns have not yet been implemented.
• Preventing unauthorised access, fraud and abusive requests, and resolving incidents: the legitimate interest in protecting the service and its users, with data limited to that purpose.
• Remembering and respecting your optional analytics choice: technical storage necessary to manage your preferences. If the planned analytics tools are introduced, their use will depend on your specific consent under the notice updated before activation.
• Meeting tax, accounting and authority requirements: compliance with legal obligations. Handling or defending claims: the grounds applicable to the contractual relationship and defence of rights.

5. Providers and recipients

The website uses Google for sign-in, Stripe for hosted payments, Vercel for hosting and running the service, and Neon for PostgreSQL. Resend handles transactional emails and contact-form delivery to support once the sender is enabled. It receives the recipient and content needed to send each message. These providers receive or host the data needed for their functions. Google and Stripe may also operate under their own terms for services they provide to you directly.

We may disclose information where a legal obligation or valid authority request requires it. PostHog and DataFast are planned additions, described in the next section; they currently receive no analytics events from this website. Behavioural advertising is neither integrated nor planned in the current preferences. Consult the providers' official policies for their own processing.

6. Planned analytics: PostHog and DataFast

We plan to add PostHog to understand website and product usage, and DataFast to measure traffic, visitor sources and conversion attribution. Their SDKs and scripts have not been integrated and this website does not send them events. Session recordings and user identification features with these providers are not enabled either.

Analytics is optional and its preference is initially off. You can accept, reject or save a selection in the banner, and change or withdraw it through ‘Cookie preferences’ in the footer without creating an account. Saving an acceptance now remembers your preference; it does not enable tools that have not been installed. Rejecting or making no choice keeps analytics off and does not prevent you from using the website's features.

Before enabling these tools, we will specify the features, data and events sent, cookies or other technologies, retention periods, contracted providers, processing locations and applicable safeguards. We will publish that information and renew the notice version to request a fresh choice; an earlier preference will not automatically authorise activation.

PostHog documents several persistence options. DataFast offers a script with cookies and another without visitor-identification cookies, which may use session storage and pseudonymous data. We have not yet selected a mode or hosting region here. The links below describe provider options, not an already applied configuration or contracts already concluded by Screengaze.

7. International processing

Providers may process data outside the European Economic Area. Locations and terms depend on the contracted service. Any relevant transfers must have a legal basis and the safeguards required by law, such as an adequacy decision or contractual safeguards where applicable.

To learn about the recipients, countries and safeguards applicable to your data, or request information about them, write to screengazestudio@gmail.com.

8. Retention

Retention is determined by the purpose of each record: maintaining the account and licence, managing activations, handling requests and meeting legal obligations or claims. Purchase records may be kept for the tax, accounting or liability periods required by law.

Waitlist registration is kept to manage the request and consent while relevant or until you request its withdrawal, subject to retaining evidence needed for obligations or claims. You can ask to leave by email.

Sessions and authorisation codes expire for use. Expiry does not guarantee immediate deletion of every associated database or backup record. You can ask about retained records and request deletion where applicable.

9. Security and account control

Authentication checks, device authorisation, payment verification and request limits are applied. Licensing uses the Mac's public key to verify activations. No measure eliminates every risk; protect your Google account and check codes before authorising a device.

You can sign out and disconnect Macs in your account. Disconnecting a Mac does not delete your account or all purchase or licence records. Send those requests to the privacy contact.

10. Your rights

You may request access, correction, erasure, restriction, portability or objection where applicable. You may also withdraw consent without affecting earlier processing. Write to the privacy contact; we may request information needed to verify your identity.

We will respond within one month. If complexity or the number of requests justifies it, this may be extended by up to two further months, with notice within the first month. Exercising rights is free, subject to legal exceptions for manifestly unfounded or excessive requests.

You may complain to the Spanish Data Protection Agency or your relevant supervisory authority without first having to exhaust an enquiry with us.

11. Cookies, children and updates

The cookie policy describes technical storage for sign-in and remembering your optional analytics preferences. The banner lets you accept, reject or customise that preference. Analytics tools are not currently installed, and saving a choice does not add them.

The service is not directed at children. If you believe a child's data has been provided without the necessary authorisation, contact us so we can review it.

Policy updates will be published with their date, and changes requiring notice will be communicated. Changing the wording does not replace consent when it is required for a new purpose.