Privacy Policy

Section 1Who we are

Clockitlive is a service of Kooemma Digital Holdings LLC, a limited liability company based in Arizona, United States. In this policy, "we", "us" and "our" mean Kooemma Digital Holdings LLC, which is the company responsible for the information described here. In the language of European and UK law, we are the controller of the information this page describes, except where section 8 and section 9 say that somebody recording is.

For anything on this page, write to support@clockitlive.com.

The service is operated from the United States, and its servers are there. If you use it from elsewhere, you are sending your information to the United States, where privacy law differs from the law where you live.

Section 2Four kinds of people use this

Organizers hold an account. They make recordings, pay for a plan if they want one, set events up, run the desk during them and keep what comes of all of it.

People who lend a phone as a camera hold no account. They scan a code on the organizer's screen, and their phone's camera becomes one of the organizer's cameras. Section 9 says what that involves.

People in a watch party hold no account either. Somebody recording sends them a link, they give a name and ask to come in, and if they are let in their camera and microphone go into that person's recording. Section 8 is about them.

People who use a remote control hold no account either. They scan a code on the organizer's screen, give a name and ask to control the cameras; if they are let in, their phone shows a small live picture of each camera and can choose which one is in the frame. Section 8 covers them too.

Guests at an event do not hold an account and are never asked for one. A guest opens the event's link, gives a name to be known by, and posts. That name is the only thing we ask a guest for. We do not ask a guest for an email address or a phone number, and we have no way to contact a guest outside the event.

Section 3Information we collect

From an organizer, on creating an account:

• Name and email address, and a profile picture if they upload one.
• A password, which is never stored. What is stored is a scrypt hash, from which the password cannot be recovered.
• If they use Continue with Google instead: the email address, name, account identifier and profile picture address in the token Google issues. We never receive their Google password. We use what Google gives us only to sign them in and to fill in their name, and our use of it follows Google's API Services User Data Policy, including its limited use requirements.
• If they add a passkey: its public key, its identifier, the name given to it and when it was last used. The fingerprint or face check that unlocks a passkey happens on their own device, and nothing from it reaches us.
• The date these terms were accepted, and the date the email address was proven.
• A record of each attempt to sign in: the address, what kind of attempt it was and whether it worked, without the IP address. It is there to spot somebody trying to get into an account, and it includes attempts against addresses that have no account.
• Their recorder settings, and a draft of an event they have started setting up, so both are there on their next visit.

From an organizer, recording:

• Each recording: the video and its sound, which includes whatever was on the screen they recorded and whatever the screen's own sound was, a still from it, how long it is and what shape, any sounds they add in the editor, their cuts and captions, and a timing record of which camera was in the picture when and where in the frame, which is what lets each phone's shots be drawn from that phone's own recording. An edit they render is saved as a recording of its own.
• The separate recording each of their other cameras made alongside, and the one each phone lent to them made (section 9).
• A video reaches us as it is recorded, not when it is kept. From the moment recording starts, the computer and each lent phone send it to our storage in parts, so that a crash or a lost connection cannot lose it. Keeping the video joins the parts into a recording; discarding it throws them away, and parts that are never finished are swept from storage within a few days.
• A video saved only to the computer never reaches us. The recorder can be set to save kept videos to a folder on the organizer's computer, or to their downloads, instead of to their account. Then nothing of the video is uploaded, and phones lent as cameras do not record or send a copy of their own. What we keep is that a video was made, when, and how long it ran, to count it toward the plan. Set to save to both, the video goes to the account as above and is saved to the computer as well.
• Phones they have chosen to be able to call: a name for each, and the address the phone's browser gave for notifications.

From an organizer, paying for a plan: section 10 says what Stripe handles and what we keep, which is never the card.

From an organizer, running an event: its title, venue, dates, time zone and settings, and any cover image uploaded.

From a guest, on joining:

• The display name they choose.
• The photographs and videos they post, with any caption they write, the dimensions and the time posted. Photographs are re-encoded, which removes the details a camera writes into the file, including the place it was taken. A photograph in a format we cannot re-encode, such as some iPhone photographs, and every video, is kept as it arrived, with whatever the phone wrote into it.
• Which moments they liked and which they have seen, and whether they liked or viewed the event itself, so counts can be shown and so their own likes come back to them next visit.

Location. Where a moment was taken is shown beside it only if the organizer of that event turns it on, and it is off unless they do. When it is on, the guest's phone asks where it is, and the guest's browser sends those coordinates to Google to find the name of a place nearby. We keep only that name, never the coordinates. A guest's whereabouts is theirs to give: the phone asks them first.

When you write to us, we keep the email and our reply for as long as we need them to deal with it.

Automatically. Ordinary server logs, including IP address, browser and device type, and the pages requested. We use them to keep the service up and to work out why something broke. We also count requests by IP address for a short window, to slow down anyone hammering the service, and that count goes when the window does.

In the categories California law uses, that is: identifiers, internet activity, approximate location, audio and visual information, and, for organizers, commercial information. We do not collect Social Security numbers, financial account numbers, health information, or information about race, religion, sexual orientation or union membership. We do not ask for any of it, and there is nowhere in the product to enter it. What people choose to record or post may of course contain anything, and that is theirs and the organizer's, as section 7 explains.

Section 4How we use it

• To run the service. Recording, putting the right camera in the picture, storing and playing back what was kept, editing and exporting it; opening an event, showing the feed and the wall, and compiling the album afterwards.
• To bill for a plan, to count recordings against it, and to tell you when a payment did not go through. See section 10.
• To write captions, when an organizer asks. See section 11.
• To keep accounts secure. Proving an email address, hashing passwords, spotting abuse and slowing it down.
• To publish an event where an organizer has asked us to. See section 7.
• To answer you when you write to us, and to send you the notices an account needs: a sign-in code, a new passkey, a held event, a change to these terms. We do not send marketing email.
• To meet legal obligations, to keep accounting records, and to enforce our Terms of Use.

Where European or UK law applies, our grounds are the contract we have with an organizer for everything that runs the service and bills for it; our legitimate interests in keeping the service secure, in answering people and in counting visits; your consent for analytics, for a guest's location and for a phone's notifications; and our legal obligations for the records we have to keep.

Section 5We do not sell or share your information

We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined by California law. We have not done so in the preceding twelve months, including for anyone under sixteen.

We do not use what you record or post to advertise, we do not build advertising profiles, and we do not train machine learning models on recordings, photographs or videos.

Section 6Faces: found in the picture, never identified

We do not recognise anyone. Nothing here works out who a person is, and nothing compares one face with another. We do not create, keep or receive faceprints, face templates or any other record that could identify a person by their face, and recordings, moments and albums are not analysed to find out who is in them.

What does run, and where. Two features look at the picture, and both run entirely inside the browser on the device doing the recording, using a face model and a person-outline model that the page downloads from our own site:

• Following whoever is talking. A phone lent as a camera does this for as long as it is lent, and the recorder's own cameras do it while the recorder follows the talker, which it does unless the organizer turns it off. Each finds the faces in its picture several times a second and tracks points on each face, such as the outline of the lips, to judge whether that person is speaking. Those points are drawn on the screen of the device looking, used for that moment and thrown away; they are never drawn into the recording. The one thing that leaves a phone is a single number saying how much the face in front of it is talking, which passes through our servers to the recorder and is not stored. No picture of a face, and no point from one, is ever sent to us or kept.
• Background blur, when somebody switches it on, separates a person from what is behind them, on their own device, so the background can be softened.

Neither feature stores anything about a face, and neither is used to tell one person from another. What a recording keeps is which camera was in the picture when, not why. Moments are attributed to the guest who posted them, by the name that guest chose, and by nothing else.

Section 7Who can see what

Recordings are on the shelf of the account that made them, and nobody else's. Each file is kept at an address with a long random part so that it cannot be guessed, but anyone who has a file's address can open it, so treat one the way you would treat a private link. A recording an organizer posts to one of their events becomes a copy in that event, a moment, and from then on is seen the way moments are and goes when the event does.

Moments posted at an event are visible to the people in that event: on guests' phones, on the venue screen, and at the organizer's desk. The organizer can take anything down from that desk, which removes it from every screen, and can freeze every screen at once. A moment taken down is kept, hidden, until the event is deleted, which is when its file goes.

The invite link is a credential. Anyone holding an event's link can join the event and see what has been posted to it. The link carries a random tail so it cannot be guessed, but it cannot tell one holder from another, and an old link keeps working after the organizer changes it. Treat it the way you would treat a key. The short code printed beside it is a label for saying the event's name out loud; it does not open the event on its own.

An album's reach is the organizer's to set: either the guests who joined, or anyone holding its link.

Events listed publicly. An event is private unless its organizer lists it, and listing is off by default. A listed event's page is public: it shows the title, venue, date, cover image, the name of the organizer who opened it, and how many people have viewed and liked it; it may appear in search results, and it carries the join link, so anyone who finds it can join and see the feed. Turning the setting off makes the page private again, though a search engine may take time to notice.

Us. A small number of our staff can see account and event records in order to run the service, answer you, and act on a report: they can see who holds an account, read its sign-in record, hold or unlist an event and suspend an account. Every such action is recorded, and an organizer whose event is held is told by email. Staff do not browse recordings or moments, and open one only when a report or a fault requires it.

Section 8Watch parties

Somebody with an account can open a watch party and send the link round. Whoever opens the link asks to come in, and if they are let in their camera and microphone go into the recording being made, alongside anything being shared on screen, by the host or by any guest who chooses to share theirs. Up to six faces fit in the picture.

What we collect from somebody who joins one: the name they type, and for as long as they are in the room, the fact that they are. We do not ask for an email address or a phone number, and we have no way to reach them afterwards.

Where the picture and the sound go while it runs. Straight from one browser to the other. What our servers carry is the handful of messages two browsers use to find each other, which we pass on without reading. If a direct path cannot be made, the connection falls back to a relay we operate, which forwards the encrypted stream without storing it.

What is kept afterwards. The recording itself is made on the host's own computer and uploads to their account as it is made, with everybody in the party in it, and if they keep it, it stays there until they delete it. The room, and the names in it, are not kept: a name goes when its owner leaves, a party link is good for six hours, and the room behind it goes when the six hours run out.

Who is responsible for what. The person recording decides that there is a party, who is let in, who is taken out and what happens to the recording afterwards. For what goes into their recording, they are the one in charge of it and we are acting on their behalf. For the account they hold with us, and for the site itself, we are. If you were in somebody's recording and you want something done about it, they are the first person to ask, and section 13 says what we will do if you ask us.

What we cannot undo. Leaving a party stops anything further being recorded of you, and the host can take you out of the picture at any point. Neither reaches into a recording that has already been made, and a copy the host has downloaded or posted somewhere else has left this service. We will act on anything still held here and pass on a request we cannot act on ourselves.

Remote control. Somebody recording can show a code that lets a phone choose between their cameras. Whoever scans it gives a name and asks to come in, and the person recording lets in one at a time. Once in, the phone is sent a small, low-quality live picture of every camera, and of the screen being shared while there is one, straight from the recorder's browser in the way a watch party's picture is. It sends back only which camera to show, whether the shared screen should fill the frame, and whether to follow whoever is talking. Nothing from the phone's own camera or microphone is asked for or sent, and nothing it is shown is recorded or kept on it by us. We keep the name for as long as they are in the room, and the code is good for six hours.

Section 9Phones lent as cameras

An organizer can put a code on their screen for phones to scan, and up to five phones can scan it. Each becomes one of the recorder's cameras. Nobody signs in to do it.

• Scanning is the step that lends the phone. When the page the code opens loads, it asks the phone for its camera and, once allowed, the picture goes to the recorder at once. There is no further press. A phone that is called back later, rather than scanned again, shows a button and joins only when it is pressed.
• What the phone sends. Its camera picture, and never its microphone: the sound comes from the recorder. The picture goes straight from the phone's browser to the recorder's, or through our relay where a direct path cannot be made, which forwards it without storing it.
• What the phone is shown. While the organizer shares a screen, a small, low-quality copy of it comes back to each phone the same way, so whoever is framing the phone can see what the recording is about. It is shown and not kept: nothing of it is recorded on the phone or stored by us.
• What the phone records. While the organizer records, each phone records its own camera too, and sends that recording to the organizer's account in parts as it goes, named after the phone. If the organizer keeps the video, it is kept there with the video until the organizer deletes it; if they discard it, the parts are thrown away. If the recorder drops away during a recording, the phone waits two minutes and then sends what it holds to the organizer's shelf without anybody pressing keep.
• What we hold about the phone. A seat in the pairing and the name the recorder calls it, such as Phone 2. These are held in a short-lived store rather than in our database, and go when the phone leaves, when the organizer takes it off, or when the pairing ends two hours after it opened.
• Being called. An organizer can choose to have a phone called rather than scanned again. Only after a press on that phone and the phone's own permission prompt, we keep a name for the phone and the address its browser gives for notifications, until the organizer forgets the phone or the browser says the address no longer works. A call is delivered through the push service of the phone's browser: Apple's, Google's or Mozilla's.

The picture from a phone is the organizer's recording, for the same reasons section 8 gives about a watch party: they decide what is kept and what becomes of it.

Section 10Paying for a plan

Payment is taken by Stripe, on a page Stripe serves. Your card number, its expiry and its security code go to Stripe and never come through Clockitlive; we never see them and could not store them. Stripe also runs the page where you change plan, change your card and cancel.

What we keep: Stripe's identifiers for you as a customer and for your subscription, which plan you are on, whether it is active, when the current period started and ends, and whether you have asked for it to end. Stripe is told your email address so it can send receipts and find you again. A Stripe customer record is created the first time you press a plan's button, even if you do not go through with it.

Stripe is a business of its own and handles your payment details under its own privacy policy, including to prevent fraud and to meet its own legal duties. Stripe's privacy policy is at stripe.com/privacy.

Section 11Who else handles it

We disclose information to service providers who work on our instructions:

• Heroku (Salesforce), which runs the service, its database and a short-lived store that holds watch party rooms, camera pairings and request counts, and keeps its logs.
• Amazon Web Services, which stores recordings, photographs and videos, and the smaller copies of each recording we make so it plays smoothly on a slower connection, deleted with the recording; and hosts the relay we operate that carries a camera's picture when two browsers cannot reach each other directly.
• Stripe, which takes payment for plans (section 10).
• Google, for several separate things:
  • Continue with Google, for an organizer who chooses it. Google's sign-in script loads on the sign-in and sign-up pages for everyone who opens them, which tells Google that a browser opened the page.
  • Venue autocomplete on the setup page, which sends Google what an organizer types into that one field and looks up the chosen venue's location for the event's time zone; and, where an organizer has turned on place names for an event, a guest's coordinates sent from their own browser to find the name of the place they are in (section 3).
  • Captions, only when an organizer asks for them in the editor: the sound of that recording, and nothing else, goes to Google's Gemini service, which writes the words back. The editor says so before anything is sent. How long Google keeps that sound is set by Google's own terms for the service.
  • A connection helper that tells each browser the address the internet sees it at, so cameras and watch parties can connect. Google receives that browser's IP address and nothing else.
  • Google Analytics, and only if you accepted it. It receives the addresses of the pages you visited on this site, which can include the address of an event or a watch party you opened, an identifier for your browser, and the general location and device details any web request carries. It receives nothing you recorded and nothing you uploaded. Section 16 says how to turn it off.
• Zoho, which sends our email: sign-in codes, account notices and notes about events.
• The push service of a phone's browser (Apple, Google or Mozilla), to deliver a call to a phone an organizer chose to be able to call. The message itself is encrypted for that phone.

Where these are outside your country, the transfer relies on the EU and UK standard contractual clauses and the Data Privacy Framework where those apply.

We may also disclose information when the law requires it, when we must to protect somebody's safety or our rights, and to a buyer if the Clockitlive service or the business is sold or reorganised within our group, in which case this policy follows the information.

Kooemma Digital Holdings LLC runs other things besides Clockitlive. What is recorded or shared here stays inside Clockitlive: we do not move it to another product in the group, and we do not combine it with information held by one.

Section 12How long we keep it

• Recordings, with their stills, added sounds, cuts, captions and timing records, and the recordings other cameras and phones made beside them, are kept until the organizer deletes them or closes the account, on every plan. Deleting a recording deletes those with it. A plan ending deletes nothing.
• Parts of a video that were never finished, because it was discarded or the upload broke off, are swept from storage within a few days.
• Moments and albums are kept while the event exists, including moments that were taken down. Deleting an event deletes its stored media with it.
• Guest records are part of the event and go when it does.
• Watch party rooms and camera pairings are held in a short-lived store rather than in a database, for six hours and two hours at most. The names in them go when their owners leave, or when the room does.
• Phones an organizer can call are kept until the organizer forgets them, or until the phone's browser says it can no longer be reached.
• Organizer accounts are kept until the account is closed. To close one, write to us from the address on it; we cancel any plan, and delete the account, its recordings and its events. Section 13 has the detail.
• Billing records, meaning what was charged and when, are kept for as long as tax and accounting law requires, which is longer than the account.
• Sign-in records are kept to spot misuse of an account, and go when the account is closed.
• Server logs and request counts are kept for a limited period and then rotated away.

We take copies of the database from time to time so that a fault cannot lose everyone's records. Deleted content is not erased from those copies the instant a deletion happens; it falls out of them as they are replaced.

Section 13Your privacy rights

Depending on where you live, you may have the right to know what personal information we hold and how we use it, to get a copy of it in a portable form, to correct it, to delete it, to object to or restrict some uses of it, and to be free of discrimination for asking. California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana and a growing number of other states give some or all of these rights; so do the European Union, the United Kingdom and other countries, whose residents may also complain to their local data protection authority.

To exercise any of them, write to support@clockitlive.com from the address on the account, or tell us enough about your involvement in a recording or an event that we can find the records. We will confirm who you are before we act, because handing somebody else's recording to the wrong person is the failure that matters here. We answer within forty-five days, or within a month where European or UK law applies, and will tell you if we need longer.

Closing an account is a request like any other: write to us from the address on it. We cancel any plan so nothing further is charged, and delete the account, its recordings, the recordings phones made for it, and its events and their moments, keeping only the billing records the law makes us keep. There is no button for this yet, which is why it is an email.

An authorized agent may act for you with written permission. If we refuse a request, you may appeal by replying to our answer, and we will review it and give reasons.

If you are in a photograph or a recording you did not make, you do not need an account to ask for it to be taken down. Tell the organizer, who can remove a moment from every screen at once and can delete their recordings, or write to us and we will act on it.

California residents may also ask, once a year and free of charge, for the list of any personal information disclosed to third parties for their direct marketing purposes under California's Shine the Light law. There is nothing to report: we disclose nothing for that purpose.

Section 14Children

Clockitlive is not directed to children under 13, and we do not knowingly collect personal information from them. Holding an organizer account requires being 18 or older.

Children are at the events this is built for, and in the rooms it records. An organizer who records or invites them takes on responsibility for what is kept and shared of them, and a parent or guardian who wants a child removed should tell that organizer, who can take a moment down in seconds and delete a recording. If you believe we hold information from a child under 13, write to support@clockitlive.com and we will delete it.

A watch party link is made to be forwarded, which means it can reach somebody it was never sent to. We cannot tell how old the person opening one is, and we do not try to work it out: doing so would mean collecting more about them than the name they typed. So it rests with the person recording, who sees who is asking to come in and decides. The same is true of a phone handed across a table to be lent as a camera. If a child has ended up in a recording, ask the person who made it, and write to us as well.

Section 15Security

Passwords are hashed with scrypt, a memory-hard function, and are never stored in a form we could read, and a passkey is a stronger way in that leaves us holding only a public key. Sign-in failures return the same message whether the address is unknown or the password is wrong, so the service cannot be used to work out who has an account. Traffic is served over HTTPS, and the pictures and sound between two browsers are encrypted end to end. Stored files are kept at addresses with a long random part, so a file cannot be found by guessing; anyone given a file's address can open it, which is why section 7 says to treat one as a private link.

No service is perfectly secure, and this one is candid about where its edges are. If you find a weakness, please tell us at support@clockitlive.com before telling anyone else. If a breach ever puts your information at risk, we will tell you, and the authorities the law names, as the law requires.

Section 16Cookies, tracking and Do Not Track

We use the storage in your browser to keep you signed in, to remember which event you joined, to keep a lent phone in its seat if the page reloads, to remember a phone that can be called, to remember your recorder settings, and to hold recordings on your own device: while one is being made, so a reload cannot lose it; until it has finished uploading; and as a copy of recent ones so they open without downloading again. None of that is optional, because without it the thing you asked us to do does not work. We do not ask permission for it and we do not use it to follow you anywhere. Installing Clockitlive as an app on your desktop or phone adds nothing to this: the app is the same site in its own window.

One thing is optional, and we ask first. We use Google Analytics to count visits and see which pages get used. It sets cookies on your device named _ga and _ga_<id>, which last up to two years and hold a randomly generated number that lets Google tell one browser from another. It does not load at all until you accept it. If you refuse, or if you never answer, no Google analytics script is requested and no such cookie is set.

Change your mind whenever you like: Cookies at the foot of the front page, the demo page and these legal pages reopens the choice. Turning it off deletes those cookies and stops the script loading on any page from then on; a page you already had open keeps the script until you reload it. We ask again after a year, so an answer you gave once does not stand forever.

We use no advertising cookies and we run no advertising trackers. Google's advertising signals are switched off explicitly on our side, so what we send is used to count visits and not to build a profile or to target anything at you.

Because we do not sell or share personal information, there is nothing for a Do Not Track signal to opt you out of. We do act on Global Privacy Control: if your browser sends it, we treat that as a refusal of analytics, we do not load Google Analytics, and we do not ask you the question.

Section 17Changes

If this policy changes we will update the date at the top of this page, and for anything significant we will tell organizers by email, or say so in the product, rather than leaving you to notice.

Section 18Contact

Kooemma Digital Holdings LLC
support@clockitlive.com

One address for all of it: privacy requests, account closures, security reports and everything else. Say in the subject line which it is and it reaches the right person.