Trust & security
Your notes are yours. We just keep them safe.
Claro stores the things you think about — lectures, meetings, ideas worth keeping. That makes security part of the product, not a footnote. Here is exactly what we do to protect it, in plain language.
Your data
- Your notes and recordings are never used to train AI models
- We never sell your data — to anyone, for anything
- Delete a note or your whole account anytime; removal is permanent, not a soft-delete
- Your content stays private to your account by default
The platform
- TLS in transit and AES-256 at rest, hosted on Google Cloud in the US
- Subscription and quota state can only be changed server-side
- Cloudflare filters traffic at the edge; per-user rate limits bound AI abuse
- Payments handled by Stripe — we never see your card number
Encrypted in transit and at rest
All connections use TLS encryption, and data at rest is protected with AES-256 on Google Cloud infrastructure.
No AI training on your data
Our transcription provider (AssemblyAI) is opted out of model training, and our AI generation provider (Google Gemini API, paid tier) does not use prompts or responses for training.
Server-enforced entitlements
Subscription status, quotas, and usage counters can only be written by our backend — Firestore security rules make them unreachable from the client.
Deletion is real deletion
Deleting a note or your account permanently removes the content, files, translations, and vector embeddings. No trash folder, no recovery period, no shadow copies.
Protected at the edge and the origin
Cloudflare filters traffic at the edge, and per-user rate limits on our AI endpoints bound abuse even if the edge is bypassed.
Hardened session handling
Sessions run through httpOnly cookies so tokens never touch client-side JavaScript. User content is sanitized with DOMPurify, and AI prompts are fenced against injection.
Do we train AI on your data?
No — and it isn't a setting you have to find. Your notes, recordings, and transcripts are processed to give you answers, summaries, and search results, then left alone. Both of our AI providers are bound by agreements that bar training on your inputs: AssemblyAI is opted out, and Gemini's paid API tier does not use customer data for model training.
Do you use my notes to train AI models?+
No. Your content is never used to train AI models. Our transcription provider is contractually opted out of training, and our AI generation runs on Google's paid Gemini tier, which does not train on prompts or responses.
Where is my data hosted?+
On Google Cloud and Firebase infrastructure in the United States, encrypted in transit with TLS and at rest with AES-256.
Does Claro store my payment details?+
No. Payments are handled entirely by Stripe. We never see, store, or process your card number — only your subscription status.
Who can see my notes?+
Your notes are private to your account and are only readable by you in normal operation. Access to production data is limited to what's needed to operate the service or respond to a support request you initiated.
How do I delete my data?+
Self-serve, from Settings. Deleting a note removes it permanently along with its files and embeddings. Deleting your account removes all notes, chats, uploads, embeddings, and your authentication record — with no retention period.
I found a vulnerability. How do I report it?+
Report it through the support channel in the product with details of the issue. Please avoid accessing data that isn't yours and give us reasonable time to respond before public disclosure.