How Claro handles your information

We may collect account details such as your name, email address, and sign-in method, along with the content you choose to upload, type, record, or organize inside Claro.

We may also collect basic device, browser, and usage data that helps us keep the product reliable, secure, and easier to improve over time.

We use your information to operate the product, provide note generation and search features, support authentication, sync your workspace, and respond to issues you report.

We may also use product and usage signals to improve performance, reduce abuse, and understand which parts of Claro are helping people most.

When you upload files, create notes, or ask AI questions, Claro may process that content through storage, search, and AI services so the app can generate summaries, answers, and structured outputs.

We try to keep processing limited to what is needed to provide the feature you asked for.

We may work with infrastructure, authentication, analytics, and AI service providers that help us run the product. Those providers process data only as needed to support the service.

We do not treat your notes as public content, and we do not sell your personal information in the ordinary sense of that term.

Your data is not used to train AI models. Our transcription provider (AssemblyAI) is opted out of model training, and our AI generation provider (Google Gemini API, paid tier) does not use prompts or responses for model training. We do not share your content with external services for their own independent use.

We keep account and workspace information for as long as it is needed to operate your account, meet legal obligations, resolve disputes, and keep the service secure.

You can delete your account and all associated data at any time from within the product. Account deletion permanently removes your notes, folders, chats, chat messages, translations, quizzes, flashcards, uploaded files, vector embeddings, and Firebase authentication record. Stripe subscriptions are canceled through the customer portal as part of the process.

You can also request selective data deletion with date filters, choosing to remove all data, only vector embeddings, only Firestore records, or your full account, in line with GDPR right-to-be-forgotten requirements.

Claro is built on Google Cloud infrastructure. Data at rest is protected with AES-256 encryption, and all connections use TLS encryption in transit.

Authentication is handled through Firebase Authentication with Application Default Credentials, meaning no service account keys are stored in or shipped with the application code.

Firestore security rules enforce that sensitive fields like subscription status, free note grants, and chat usage counters can never be written from the client. All entitlement changes go through authenticated server-side endpoints.

Access to the product is gated through a server-side validation flow using httpOnly cookies, so access tokens are never exposed to client-side JavaScript.

All user-generated content rendered in the app is sanitized through DOMPurify to prevent cross-site scripting (XSS) attacks.

AI prompts are protected against prompt injection through content delimiters and input sanitization, keeping user-supplied content separate from system instructions.

No system is perfect, so we cannot promise absolute security, but we apply industry best practices across authentication, access control, and data protection.

Claro is not intended for use by children under 13. We do not knowingly collect information from children under 13 years of age. If you believe a child under 13 has provided us with personal information, please contact us through the support channel in the product, and we will take steps to delete that information.

Claro complies with applicable data protection laws and regulations, including the General Data Protection Regulation (GDPR) for users in the European Economic Area and United Kingdom, and the California Consumer Privacy Act (CCPA) for users in California. Your rights under these laws include access to your data, correction, deletion, and withdrawal of consent.

If you are an EU/UK business user and require a Data Processing Agreement, contact the Claro team through the support channel in the product.

We welcome responsible security research. If you believe you have found a vulnerability in Claro, please report it through the support channel in the product with details of the issue. We ask that you avoid accessing or modifying data that does not belong to you, and that you give us reasonable time to respond before any public disclosure.

If you have privacy questions, concerns, or requests, contact the Claro team through the support or account channel provided in the product.