Privacy Policy
RecFlow Studio is built local-first. Your recordings and edits are stored on your Mac. We process information needed for accounts, licensing and payments. The website uses a necessary sign-in cookie when you sign in; it does not load advertising scripts.
Who is responsible
RecFlow Studio ("RecFlow", "we") is based in Canada and is the controller of the personal data described here. We handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy law. You can reach us at info@recflow.studio for any privacy question or request.
What stays on your Mac
- Recordings, webcam takes and exports — stored in ~/Movies/RecFlow. They stay on your Mac unless you explicitly upload an export using optional sharing.
- Edit data — zooms, cursor paths, captions and settings live in sidecar files next to your recordings.
- App settings — stored locally by macOS.
- Live stream keys — if you use live streaming, your stream key is stored in the macOS Keychain on your Mac and sent only to the streaming provider you chose.
What we process
| Data | Why | Kept |
|---|---|---|
| E-mail address, name and profile picture (only if you sign in) | To create your account, identify your licence, and recognise a Founding 100 spot | Until you delete your account |
| Export count and licence status | To sync entitlements across your own machines | Until you delete your account |
| Website session record: hashed session identifier, account ID, name, e-mail and expiry | To remember which account is signed in to your browser | Valid for 7 days; signing out deletes that session record. Expired records no longer grant access and may remain until account-data cleanup or deletion. |
| Server logs (IP address, user agent, page requested) | Security and delivering the website; generated automatically by our host | Short-term, per our host's retention |
| E-mail correspondence | To answer you and keep a record of support requests | Until no longer needed |
We use account information to provide the account and licensing features you request, and server logs to deliver and protect the service. See Your rights below for access and deletion requests.
Website sign-in and cookies
After Google sign-in, auth.recflow.studio sets a necessary cookie named __Host-rf_session. It remembers your website account for up to 7 days. It is Secure, HttpOnly and SameSite=Lax, so it is sent over HTTPS and cannot be read by website JavaScript. Your Google or Firebase token is not stored in this cookie or in local storage.
- Choose Account → Sign out to invalidate this browser's website session and remove its cookie. This does not sign you out of Google or the RecFlow Mac app.
- You can browse the site without cookies. Blocking or clearing the sign-in cookie prevents the website from remembering your account.
- During sign-in, browser tab storage holds temporary flow information, security nonces and any invitation you opened. Google and Stripe may use their own cookies when you use their sign-in or checkout pages.
We have removed Google AdSense from the website. This account feature does not add advertising or analytics cookies.
Who else handles your data
- Vercel — hosts the website and the sign-in service, and produces the server logs above.
- Google (Firebase Authentication) — runs sign-in when you choose "Continue with Google" or an e-mail link.
- Google (Firestore) — stores account, licence and website session records.
- GitHub — stores video files you explicitly upload using optional sharing. Vercel serves those videos to people with your share link.
- Webzir and Stripe — Webzir manages billing and payments; Stripe processes payments through its hosted checkout. See our billing details.
- Your streaming provider — if you stream, your video goes directly from your Mac to the provider you configured (for example YouTube) and is governed by their terms and privacy policy. It does not pass through us.
These providers may process data outside your country, including in the United States, under the safeguards their own terms provide.
What we don't do
- We don't upload your recordings automatically. Optional sharing uploads only the exported video you choose.
- We don't sell your personal data, and we don't share your account details with advertisers.
- We don't run analytics or ad trackers inside the app.
Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, withdraw your consent, or receive it in a portable form. Write to info@recflow.studio from your account address and we'll respond within 30 days, as PIPEDA requires. If you are not satisfied with our response you may complain to the Office of the Privacy Commissioner of Canada; if you are in the UK or EEA you may instead complain to your local data protection authority.
Optional video sharing
Comments on shared videos: Google sign-in is required to post. Your Google display name, comment, optional video timestamp and posting time are visible to anyone with the share link; your email and account identifier are not displayed. Comments and author identifiers are stored in Firestore. You can delete your own comments, and the video owner can remove comments or disable new ones. Deletion removes the comment text and display name, leaving a placeholder and minimal identifiers to preserve replies and prevent duplicate requests. Removing the shared video deletes its comment thread when storage cleanup completes. Usage counters help enforce posting limits.
When you choose Upload on the sharing page, RecFlow stores your exported video in a private GitHub repository and serves it through Vercel. Firestore stores the owner account, video title, size, upload status, storage references and usage counters. Anyone with the share link can watch, save or forward the video without signing in. Links are not password-protected; do not share sensitive content this way.
You can remove a share from your sharing page. This blocks new playback through the link and requests deletion of its stored video parts. If deletion fails, the page lets you retry. Removal cannot erase copies already downloaded by viewers. Minimal revoked-link and usage records remain to prevent replay and enforce beta limits. GitHub and Vercel may retain service logs or backups under their own retention policies.
Deleting your data
Delete local data by deleting ~/Movies/RecFlow and the app. To delete your account and everything synced with it, e-mail info@recflow.studio from the account address.
Children
RecFlow is not directed to children under 13, and we do not knowingly collect their personal data. If you believe a child has given us data, contact us and we will delete it.
macOS permissions
RecFlow asks macOS for Screen Recording (to capture), Microphone and Camera (only if you enable them), and optionally Accessibility (to follow your typing cursor while recording). These grants are enforced by macOS, used only while you record, and revocable any time in System Settings.
Changes & contact
Updates to this policy appear on this page with a new effective date; if a change materially affects you we will say so on the website. Questions: info@recflow.studio.