Privacy Policy

1. Scope

This Privacy Policy applies to the Popout desktop application, popout.space, the retained withclarity.ai website, and the online services Popout operates to provide authentication, subscriptions, downloads, and selected product features (together, the “Service”). “Popout,” “we,” and “us” refer to ACE IT, the sole-proprietorship business operating the Popout Service.

2. Information we process

Account and sign-in information

When you create or use an account, we process identifiers such as your email address, name, Popout account identifier, authentication status, and security/session information. Authentication is provided through WorkOS AuthKit.

Google sign-in data

If you choose Google to sign in, Google supplies basic identity information through our authentication provider, such as your name, email address, profile information, and a provider account identifier. We use that information only to authenticate you, maintain your Popout account, associate your subscription, protect the Service, and provide support. Popout’s current production sign-in does not request access to your Gmail messages, Google Drive files, Google Calendar, contacts, or other Google product content.

The broader analytics, research, and product-development permissions described elsewhere in this policy do not expand how we use Google sign-in data. We use that data only for the account, authentication, subscription, security, and support purposes described above unless we provide a new disclosure and obtain any permission required by Google or applicable law.

Subscription and transaction information

We process your selected plan, subscription status, renewal or cancellation date, customer and subscription identifiers, and limited transaction or payment-method summaries needed to operate billing. Dodo Payments handles checkout and payment credentials. We do not receive or store your complete payment-card number.

Workspace and user content

Popout may process spaces, notes, text documents, files, images, link metadata, social content, transcripts, layout information, themes, settings, and other material you add to or create with the Service (“User Content”). Depending on the product version, settings, and features you use, User Content may be stored on your device, on Popout-operated or provider-hosted infrastructure, or both. Popout's synchronization service stores account workspace records and may store uploaded file, image, audio, and video bytes in private cloud object storage. Supported apps may keep local replicas and caches for speed, offline access, migration, and reliability. The Service is not local-only.

Features such as hosted access, synchronization, collaboration, backup, sharing, search, automation, or AI-assisted processing may require User Content to be transmitted to and retained by Popout or its service providers. The Service may introduce or change these features over time. Material changes to how personal information is used will be reflected in this policy and accompanied by any notice or consent required by applicable law.

Product usage and analytics

We may collect event-level, account-level, device-level, and aggregate information about how the Service is used. This may include the types and numbers of nodes, spaces, canvases, files, or other items created or used; feature adoption; actions and interaction sequences; usage frequency and duration; navigation, clicks, and settings; app version, operating system, device and pseudonymous identifiers; performance, reliability, crash, network, and error information; and the source, campaign, or referral associated with a visit or account.

Analytics may be associated with your account so we can understand individual and aggregate usage, personalize the Service, provide support, enforce plan limits, and evaluate or improve features. Where reasonably necessary to reproduce a problem, understand feature performance, or improve the Service, diagnostic or analytics records may include limited identifiers, metadata, or excerpts associated with User Content. We may also use analytics, experiments, surveys, session replay, and similar research tools. We do not intend for these tools to collect passwords or complete payment-card credentials.

Administrative usage statistics

Our access-restricted administration dashboard displays account email addresses alongside aggregate content counts, content-type breakdowns, daily creation and latest-update recency, archived-item counts, and aggregate asset storage usage. It does not display or provide access to note titles, note text, links, images, files, tags, or individual node records. Reporting dates are grouped by UTC day. These reports use existing server-synced metadata, do not collect an additional history of edits, and do not run session replay or third-party analytics.

Information sent when you use an online feature

Some features require network processing. The information sent depends on the feature you choose:

• Social-link import or transcript retrieval sends the public URL you request and the minimum related metadata needed to retrieve the public content.
• Background removal sends the image you select, or its source URL, for processing.
• If speech features are offered and you use them, the necessary audio may be sent for transcription and reply text may be sent for speech synthesis.
• Downloads and automatic-update checks request release metadata and files appropriate for your platform and release channel.

Content returned by these features may be saved on your device or in hosted storage used by the Service.

Website, cookie, and technical information

We use cookies and similar technologies to complete sign-in, protect the authentication flow, maintain your session, connect your account to billing, remember preferences, measure usage, and understand or improve the Service. Our hosting, security, and analytics providers may process standard request and interaction information such as IP address, browser or device type, timestamps, requested URLs, referrers, usage events, and security events. Popout does not currently use personal information for cross-context behavioral advertising.

Support communications

If you contact us, we process the message, contact information, and any diagnostic details or attachments you choose to provide so we can respond and investigate the issue.

3. How we use information

We use information to:

• provide, authenticate, secure, and maintain the Service;
• manage subscriptions, payments, cancellations, and downloads;
• perform an online feature when you request it;
• respond to support requests and communicate service notices;
• prevent fraud, abuse, and security incidents;
• diagnose failures and improve reliability;
• measure feature adoption, engagement, node and workspace activity, and other product-usage patterns;
• personalize experiences and research, test, evaluate, train, improve, and develop features, algorithms, automated systems, and related products; and
• comply with legal, tax, accounting, and regulatory obligations.

Where applicable law requires a legal basis, we rely on performance of our contract with you, our legitimate interests in operating and protecting the Service, compliance with law, and consent where the law requires it.

4. When information is shared

We may disclose information for the purposes described in this policy, at your direction, or where required or permitted by law. This includes disclosures to people you invite to a space or collaboration and to providers that host, process, analyze, secure, support, or help develop the Service. Providers and provider categories we use or may enable include:

• Cloudflare for website hosting, API delivery, security, synchronized workspace/account state, private uploaded file and media storage, and release downloads;
• WorkOS for authentication and account identity;
• Google when you choose Google as your sign-in method;
• Dodo Payments for checkout, payment processing, subscriptions, tax, and transaction records, acting as the merchant of record and an independent controller for buyer transaction data;
• ScrapeCreators when you request supported public social content or transcripts;
• Analytics, observability, and research providers when enabled to measure usage, investigate errors, conduct experiments, understand user journeys, and improve the Service.

Authorized ACE IT personnel, contractors, advisers, and service providers may access account information, product analytics, diagnostics, support materials, and User Content where reasonably necessary to operate the Service, provide support, troubleshoot, investigate security or abuse, comply with law, conduct business and product analytics, or research, test, develop, and improve Popout and related systems. Access may be manual or automated and is subject to role, confidentiality, security, and purpose restrictions where appropriate.

We may also disclose information to professional advisers, public authorities when legally required, or as part of a merger, acquisition, financing, or sale of the business, subject to appropriate protections. Popout does not currently sell personal information for monetary payment. If that practice materially changes, we will update this policy and take any notice, consent, or opt-out steps required by applicable law.

5. Retention

User Content, account information, analytics, diagnostics, support records, and other personal information may be retained while your account is active and afterward for as long as reasonably necessary for the purposes described in this policy. Subject to applicable law, operational copies are generally retained for no more than two years after account termination or your last meaningful interaction with the Service. Information will be erased or de-identified earlier when consent is withdrawn or its specified purpose is no longer served and no other lawful basis requires or permits continued retention. Different systems have different deletion and backup cycles. We may retain information longer when reasonably necessary to comply with law, maintain tax or transaction records, prevent fraud or abuse, protect security, resolve disputes, enforce agreements, or establish, exercise, or defend legal claims.

Information stored on your device may remain until you delete it or remove the applicable application data. Uninstalling the desktop application may not erase every Popout file or device backup. Hosted information may remain while your account or the relevant feature is active and afterward in backups, analytics, security records, billing records, or other systems during the applicable retention period. Service providers may retain information under their own legal and operational requirements. When you request deletion, we delete or de-identify eligible information unless retention remains necessary for a lawful purpose. Aggregated or de-identified information that does not reasonably identify you may be retained indefinitely and used for analytics, research, security, and product development.

6. Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a portable copy of personal information, and to withdraw consent. You may be able to manage User Content through the Service or your device. You can also revoke Google account access from your Google Account permissions.

To exercise an account-data right or request account deletion, email us at shibru127@gmail.com. We may need to verify your identity before completing a request. Withdrawing consent may prevent us from continuing to provide features that require the affected processing, but it does not affect processing already lawfully completed. You may also have the right to complain to your local data-protection authority.

7. International processing

Popout and its service providers may process information in countries other than the one where you live. Where required, we use contractual or other lawful safeguards for international transfers.

8. Security

We use technical and organizational safeguards intended to protect personal information, including encrypted transport, restricted provider credentials, authenticated service routes, and access controls. No system is perfectly secure, so we cannot guarantee that information will never be accessed, disclosed, altered, lost, corrupted, or misused. Please protect access to your device and account.

9. Children

The Service is not directed to children. You must be at least 18 years old, or the age of legal majority where you live, to create a paid Popout account. We do not knowingly collect personal information from children in violation of applicable law. Contact us if you believe a child has provided information improperly.

10. Changes to this policy

We may update this policy from time to time as Popout, our providers, technology, and legal obligations change. An updated policy becomes effective when posted or on any later date stated in it, and we will change the “Last updated” date. We will provide additional notice and obtain consent when required by applicable law or when a change materially affects how personal information is processed. Changes needed to address law, security, fraud, abuse, or an urgent operational issue may take effect immediately where permitted by law.