Privacy Policy
Last updated: 19 April 2026
1. Introduction
This Privacy Policy explains how Klipptik ("we", "us", "our") collects, uses, stores, shares, and protects your personal data when you use our website at klipptik.com, our web application, and our desktop application (collectively, the "Service").
Klipptik is a video clipping and organisation tool that allows users to save, organise, and revisit specific moments from online and local video content. Klipptik uses YouTube API Services to retrieve video metadata and to embed YouTube video playback within the Service.
We are committed to protecting your privacy and processing your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), and the Data (Use and Access) Act 2025.
By using the Service, you acknowledge that you have read and understood this Privacy Policy.
2. Data Controller
The data controller responsible for your personal data is Klipptik. If you have any questions or concerns about how we process your personal data, you may contact us at [email protected].
3. YouTube API Services
Klipptik uses YouTube API Services, including the YouTube Data API v3 and the YouTube IFrame Player API. By using the Service, you are also bound by the YouTube Terms of Service and the Google Privacy Policy.
3.1 Data We Access via YouTube API Services
We use YouTube API Services to retrieve the following video metadata:
- Video title, description, and thumbnail URLs
- Channel name and channel identifier
- Video duration, definition, and content details
- Publication date
- Video availability and playback status
- Video statistics (view count, like count) where publicly available
- Playlist titles and video lists (where applicable)
We do not download, store, or cache any YouTube audiovisual content (video or audio files). All YouTube video playback occurs through the official YouTube embedded player, which is provided and controlled by YouTube.
3.2 How YouTube Collects Data Through the Embedded Player
When the YouTube embedded player loads within the Service, YouTube may collect and process certain data from your device, including but not limited to:
- Basic device and browser information
- IP address
- Cookies and similar tracking technologies
Additional data may be collected by YouTube upon video playback, including data used for advertising, analytics, and fraud prevention purposes. This data collection is governed by the Google Privacy Policy and is outside of Klipptik's control.
We use YouTube's privacy-enhanced mode (youtube-nocookie.com) where technically feasible to minimise third-party cookie exposure prior to playback.
3.3 YouTube API Data Retention
Video metadata retrieved via the YouTube Data API is cached locally to reduce repeated API calls and to provide a faster user experience. Cached metadata is automatically refreshed from the YouTube API within 30 calendar days of the most recent retrieval, or when you manually trigger a refresh (for example, by syncing a playlist or re-importing a video), whichever occurs first. If a video is removed or made unavailable by YouTube, we update or remove the corresponding cached metadata upon the next refresh.
3.4 Google Account Access
When you sign in to Klipptik using your Google account (via our authentication provider, Clerk), we receive only basic authentication information (email address, display name, and profile picture). This sign-in process does not grant Klipptik access to your YouTube data.
Separately, the Service may offer optional YouTube account authorisation (where available), which allows Klipptik to access your YouTube playlists and subscriptions on your behalf using YouTube API Services. This authorisation requires your explicit consent and uses limited, read-only API scopes.
If you have authorised Klipptik to access your YouTube data, you may revoke this access at any time by visiting the Google security settings page at https://security.google.com/settings/security/permissions. Upon revocation, we will delete any stored data associated with your YouTube API authorisation as soon as reasonably practicable and in any event within 7 calendar days.
4. Personal Data We Collect
4.1 Data You Provide Directly
- Account information: When you create an account, we collect your email address, display name, and profile picture (provided via Clerk, our authentication provider).
- User-created content: Clip metadata (names, start/end timestamps, tags, notes), folder structures, video library organisation, and Klipptik collections that you create within the Service.
- Payment information: If you subscribe to a paid plan, payment is processed by Stripe via Clerk Billing. We do not directly collect or store your payment card details. We receive confirmation of your subscription status, plan type, and billing period.
- Support communications: If you contact us for support or submit feedback, we collect the content of your communications.
4.2 Data Collected Automatically
- Guest identifier: If you use the Service without creating an account, we generate a unique pseudonymous identifier (guest ID) stored in your browser's localStorage. This identifier is used to associate your data with your session and is not linked to any personally identifiable information unless you subsequently create an account.
- Device fingerprint hash: We generate a salted cryptographic hash based on basic browser and device characteristics for the purposes of abuse detection and prevention of misuse. This hash is pseudonymised and cannot be used to identify you personally.
- Usage data: We collect information about how you interact with the Service, including pages visited, features used, actions taken, session duration, and error logs. This data is collected via PostHog (see Section 6) and is subject to your consent (see Section 8).
- Technical data: Browser type and version, operating system, screen resolution, and general geographic region (derived from IP address, not precise location).
4.3 Data We Do NOT Collect
- We do not collect, download, or store any video or audio content.
- We do not collect your browsing history outside of the Service.
- We do not collect precise geolocation data.
- We do not collect contacts, address books, or phone numbers.
- We do not sell your personal data to any third party.
5. How We Use Your Personal Data
We use your personal data for the following purposes and on the following lawful bases:
| Purpose | Lawful Basis (UK GDPR Art. 6) |
|---|---|
| Providing and operating the Service (storing your clips, folders, video metadata, and organisational data) | Performance of a contract (Art. 6(1)(b)) |
| Authenticating your identity and managing your account | Performance of a contract (Art. 6(1)(b)) |
| Processing payments and managing subscriptions | Performance of a contract (Art. 6(1)(b)) |
| Synchronising guest data with our server to enable cross-device access and data persistence | Legitimate interest (Art. 6(1)(f)) — enabling core application functionality |
| Detecting and preventing abuse, fraud, and misuse of the Service (including via device fingerprint hashing) | Legitimate interest (Art. 6(1)(f)) — security and integrity of the Service |
| Analysing usage patterns to improve the Service (via PostHog analytics) | Consent (Art. 6(1)(a)) |
| Responding to support requests and communications | Legitimate interest (Art. 6(1)(f)) — customer service |
| Complying with legal obligations, including responding to lawful requests from authorities | Legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interest as a lawful basis, we have conducted a balancing assessment to ensure that our interests do not override your rights and freedoms. You may contact us at [email protected] to request further information about these assessments.
6. Third-Party Service Providers
We share your personal data with the following third-party service providers ("processors") who process data on our behalf and in accordance with our instructions:
| Provider | Purpose | Data Processed | Location | Safeguards |
|---|---|---|---|---|
| Clerk (clerk.com) | Authentication, user management, billing | Email, name, profile picture, subscription status | United States | Standard Contractual Clauses (SCCs) |
| Stripe (stripe.com) | Payment processing | Payment details, billing address, subscription events | United States | Standard Contractual Clauses (SCCs); PCI DSS compliant |
| Neon (neon.tech) | Database hosting | All user-created content, account data, guest data | United States | Standard Contractual Clauses (SCCs) |
| Cloudflare (cloudflare.com) | Hosting, CDN, DDoS protection, edge functions | IP address, request metadata, static assets | Global (edge network) | Standard Contractual Clauses (SCCs); UK Addendum |
| PostHog (posthog.com) | Analytics and product usage tracking | Usage events, session data, device metadata | European Union (EU Cloud) | EU hosting; no US data transfer |
| Featurebase (featurebase.app) | Feedback board, help centre | User ID, email (via SSO), feedback content | European Union | Standard Contractual Clauses (SCCs) |
| YouTube / Google (google.com) | Video metadata retrieval, embedded video playback | See Section 3 | United States | Google's Data Processing Terms; SCCs |
We do not sell, rent, or trade your personal data to any third party for their own marketing or commercial purposes.
7. International Data Transfers
Some of our third-party service providers are located outside the United Kingdom. Where personal data is transferred outside the UK, we ensure that appropriate safeguards are in place in accordance with Chapter V of the UK GDPR, including:
- UK adequacy decisions: Where the UK Government has determined that a country provides an adequate level of data protection.
- Standard Contractual Clauses (SCCs): Contractual clauses approved by the UK Information Commissioner's Office, with the UK International Data Transfer Addendum where applicable.
- Supplementary measures: Additional technical and organisational measures where required by the circumstances of the transfer.
You may contact us at [email protected] to obtain further information about the safeguards in place or to request a copy of the relevant transfer mechanisms.
8. Cookies and Similar Technologies
We use cookies and similar storage technologies (including localStorage and sessionStorage) on the Service. For full details of the cookies and storage items we use, their purposes, and your choices, please refer to our Cookie Policy.
8.1 Essential Storage
Certain storage items are strictly necessary for the operation of the Service and do not require your consent. These include your guest identifier, authentication session tokens, and user interface preferences.
8.2 Analytics
We use PostHog for analytics and product improvement. PostHog analytics tracking is activated only with your explicit consent, which is obtained via our consent banner when you first access the Service. You may withdraw your consent at any time via the cookie preferences option available in the Service.
8.3 Third-Party Cookies
The YouTube embedded player and Stripe payment processing may set their own cookies on your device. These cookies are governed by the respective privacy policies of Google and Stripe. Please refer to the Google Privacy Policy and the Stripe Privacy Policy for further information.
9. Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law.
| Data Category | Retention Period |
|---|---|
| Guest data (guest ID, clips, folders, metadata) | Deleted after 30 days of inactivity |
| Signed-in user data (account, clips, folders, metadata) | Retained until you delete your account |
| YouTube API metadata (video titles, descriptions, statistics) | Cached locally; automatically refreshed within 30 calendar days or on user-triggered refresh |
| Device fingerprint hash | Retained indefinitely for abuse detection (pseudonymised, salted hash only) |
| PostHog analytics data | Subject to PostHog's retention settings; currently 1 year |
| Payment and billing records | Retained as required by applicable tax and financial reporting laws (typically 6 years) |
| Support communications | Retained for up to 2 years after resolution, unless required longer by law |
Upon account deletion, we will delete or anonymise your personal data as soon as reasonably practicable and in any event within 30 calendar days, except where retention is required by law or for the establishment, exercise, or defence of legal claims.
10. Your Rights
Under the UK GDPR, you have the following rights in relation to your personal data:
- Right of access — You have the right to request a copy of the personal data we hold about you.
- Right to rectification — You have the right to request that we correct any inaccurate or incomplete personal data.
- Right to erasure — You have the right to request that we delete your personal data, subject to certain exceptions.
- Right to restriction of processing — You have the right to request that we restrict the processing of your personal data in certain circumstances.
- Right to data portability — You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.
- Right to object — You have the right to object to the processing of your personal data where we rely on legitimate interest as a lawful basis. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
- Right to withdraw consent — Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.
To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month in accordance with applicable law.
11. Automated Decision-Making
We do not use your personal data for automated decision-making or profiling that produces legal effects or similarly significant effects concerning you.
12. Children's Privacy
The Service is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If we become aware that we have collected personal data from a child under 13, we will take steps to delete that data as soon as reasonably practicable.
13. Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include, but are not limited to:
- Encryption of data in transit (TLS/HTTPS)
- Encryption of data at rest
- Access controls and authentication requirements
- Regular security reviews
No method of transmission over the internet or method of electronic storage is completely secure. While we strive to protect your personal data, we cannot guarantee its absolute security.
14. Complaints
If you are dissatisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
You can find out more about how to make a complaint at ico.org.uk.
We would appreciate the opportunity to address your concerns before you contact the ICO, so please contact us at [email protected] in the first instance.
15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. Where changes are material, we will notify you by posting a notice on the Service or by email (where we have your email address) prior to the changes taking effect.
The "Last updated" date at the top of this Privacy Policy indicates when it was last revised. Your continued use of the Service after any changes constitutes your acceptance of the updated Privacy Policy.
16. Contact Us
If you have any questions about this Privacy Policy or our data practices, please contact us at:
Email: [email protected]