1. Introduction
Decodx ("Decodx", "we", "us", or "our") turns a committed spec into a finished video — deterministically. This Privacy Policy explains what personal data we collect, how we use and protect it, and the choices you have. It applies to everything we operate: the marketing website (decodx.ai), the web application (app.decodx.ai), the API and command-line tools, and the DecodX Capture Chrome extension.
By using our services you agree to the collection and use of information in accordance with this policy.
2. Information we collect
- Account information. When you sign up we collect your name and email address through our authentication provider. If you join or create an organization, we store your membership and role.
- Content you create or upload. Project specs, uploaded media, and — when you use DecodX Capture — screen recordings, optional microphone narration, and the interaction metadata captured while you record (clicks, cursor position, scroll, and page navigations). This is stored in your account as reusable assets.
- Usage data. Basic information your browser or device sends automatically, such as IP address, browser type, pages viewed, and timestamps.
- Payment information. If you subscribe to a paid plan, our payment processor (Stripe) handles your card details. We do not store full card numbers on our servers.
- Cookies and analytics. We use cookies and product-analytics events to understand usage and improve the product. See "Analytics" below.
3. How we use your data
- To provide, operate, and maintain the service — including turning your recordings and specs into videos and documentation.
- To authenticate you and secure your account and organization.
- To process payments and manage subscriptions.
- To provide customer support and respond to your requests.
- To monitor usage, diagnose problems, and improve the product.
- To send service and, where you have opted in, product communications. You can opt out of marketing email at any time.
4. Storage and security
Your data is stored on cloud infrastructure operated by Amazon Web Services (AWS), including object storage for media assets and managed databases for account and project data. Access is governed by strict access controls and data is encrypted in transit. No method of transmission over the Internet or electronic storage is 100% secure, but we use commercially reasonable measures to protect your information. We maintain a strict policy against selling or trading your data.
5. Data retention
We retain your personal data for as long as your account is active or as needed to provide the service, comply with our legal obligations, resolve disputes, and enforce our agreements. You can delete a recording or asset from your library at any time, and you may request deletion of your account by contacting us.
6. Service providers and sub-processors
We share data with a small set of third-party providers only to the extent needed to run the service. They are bound to use it solely to perform services for us. We do not sell your data.
- Authentication — our identity provider (Clerk) manages sign-in and session security.
- Payments — Stripe processes subscription payments under PCI-DSS standards.
- Cloud hosting & storage — Amazon Web Services (AWS) hosts our application, databases, and media storage.
- Analytics — PostHog provides product analytics.
- AI processing — to generate voices, avatars, transcripts, and video, we use third-party AI model providers, including ElevenLabs (voice synthesis) and HeyGen (avatar/talking-head video). Content is sent to them only to produce the output you request.
7. Analytics
We use PostHog to understand how the product is used and to improve it. PostHog records product-usage events and associated metadata. We do not currently use Google Analytics.
8. Integrations
We offer optional integrations that connect Decodx to third-party services you choose to authorize — for example, publishing a finished video to YouTube. Additional integrations may be added over time. When you connect an integration, we request only the access needed to perform the action you asked for, and we store any access tokens securely. You can disconnect an integration at any time. Each third-party service has its own privacy policy governing how it handles your data.
9. CI/CD tools
We use GitHub as our development platform for source-code management and continuous integration and delivery. GitHub is used to build and ship the product; it does not process end-user account content.
10. DecodX Capture Chrome extension
The DecodX Capture extension records the screen surface you select and, if you enable it, your microphone, to create videos and documentation in your Decodx account. The recording and the interaction metadata it captures (clicks, cursor, scroll, page navigations, timestamps) are uploaded only to your authenticated Decodx account over an encrypted connection and stored there as a reusable asset.
The extension captures only while you are actively recording — you control when recording starts and stops. It requests only the permissions it needs. Values entered into password and autofill fields are never captured. We do not sell your data, share it with third parties for advertising, or use it for any purpose unrelated to providing the recording-to-video/document feature. Our use of information received from Google APIs adheres to the Chrome Web Store Limited Use policy, including its Limited Use requirements.
11. International data transfers
Your information may be transferred to — and processed in — the United States and other countries where we or our service providers operate. Where required, we put appropriate safeguards in place for such transfers.
12. Your rights
Depending on where you live, you may have the right to access, correct, delete, or port your personal data, to restrict or object to certain processing, and to withdraw consent. If you are in the EU/EEA or UK, these rights arise under the GDPR; if you are a California resident, under the CCPA — including the right to know what personal information we collect and to request its deletion. We do not sell or rent your personal information to third parties. To exercise any of these rights, contact us at support@decodx.ai.
13. Children’s privacy
Our services are intended for users aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will remove it.
14. Changes to this policy
We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the "Effective date" above. Material changes will be communicated by email or an in-product notice where appropriate.
15. Contact us
If you have any questions about this Privacy Policy or your data, reach us at support@decodx.ai.