Privacy Policy

1. Information We Collect

We collect the following types of information:

• Account information: When you create an account through our authentication provider (Clerk), Clerk manages your email address and password. DemoSix stores the public username and display name you choose.
• Content: Screen recordings, videos you upload, and associated metadata (titles, descriptions, thumbnails, and transcoded video formats) that you upload to the Service. For an uploaded video we also keep who uploaded it and when, its length and size, and which version of the upload confirmation they accepted.
• Usage data: Information about how you interact with the Service, including demos viewed, follows, reports, search queries, subscription and checkout events, and navigation patterns. On public Networks, demo views are stored only as an anonymous total; we do not keep a record of which demos you personally watched. Private Networks are the one exception, and they are described immediately below.
• Legal acceptance and compliance records: The Terms and Privacy versions you accepted, acceptance time and surface, publishing-rights confirmations, formal legal reports, case events, deadlines, restrictions, and related delivery evidence.
• Device information: When using the desktop recorder, we may collect basic device and session information (device name, operating system, app version, and last-seen timestamps) for authentication, account security, compatibility, and support.
• Network information: We use IP addresses for rate limiting and abuse prevention, and where we keep one it is hashed, not stored in plain text. One exception: for each API key a business customer makes, we keep where its most recent call came from (the city and country, and the address with its last part removed, such as 203.0.113.x) and the name of the tool that made it, so the key's owner can spot a key used from somewhere unexpected.
• Analytics and diagnostics data: We collect product, performance, playback-quality, and error data to monitor and improve the Service. Some diagnostics may be associated with your account or device when needed to debug abuse, playback, billing, or account issues. An error report carries your account's ID so we can find it when you write to us; it does not carry your name or email address.
• Problem reports: When you use “Report a problem”, we keep what you wrote, the page you were on, your browser type, and your account, so we can find and fix what went wrong. On the pages of your own account, a recording of your last minute on that page goes with it, as described under Sentry in section 3. You can also attach a screenshot; that is your choice and we never require one. Unlike the recording, a screenshot is not masked: it shows whatever was on your screen when you took it. We remove hidden data from the image file (such as where a photo was taken), keep it privately with your report where only DemoSix support can see it, and delete it when we resolve your report or when your account is deleted, whichever comes first. When your report is resolved we may email you to let you know; that email repeats what you wrote so you can tell which report it is about.
• Feedback: When you send us feedback on our Feedback page, we keep what you wrote and the word you picked (do, change, or improve) with your account, and it is deleted when your account is deleted. We use feedback to decide what to build, change, and fix.

Views inside private Networks

Private Networks are closed spaces, typically run by a company, team, or organization for its own members. When you are signed in and Watch a Demo in a private Network, DemoSix records that you watched it, when you last did, and how much of it played. The owners and admins of that Network can see this: they see your display name, your public username, the time of your most recent view, and whether you have not watched a demo, stopped part way through it, or played it to the end. They do not see your email address, and no one else on DemoSix can see it at all. They can also read the same figures from their own tools, through an API key or an AI assistant they connect to DemoSix; nothing more travels that way than they see on the page.

How much played is measured from the parts of the video your player actually advanced through while playing. Replaying the same minute counts once, and dragging the scrubber to the end counts for nothing. It is not a measure of attention, and DemoSix does not record where your mouse went, whether the tab was in front, or anything else about how you watched.

You can always see your own figures — the same ones the Network's owner sees about you — on the page where you Watch a Demo.

This exists so the person who published a recording to their team can tell whether the team has seen it. It applies only to private Networks. On public Networks, and for anyone who is not signed in, DemoSix does not record who watched what anywhere on the Service. We keep these records for 730 days after your most recent view of that demo, after which they are deleted automatically. They are also deleted if the demo is deleted or if you delete your account.

Demo links that ask for your name and email

Some DemoSix business customers put a link in their email signature that opens a short form before their demos play. That form is the one place on DemoSix where a Network's owner does receive a viewer's name and email address — because you typed them in yourself, on a page that named the company receiving them, under a sentence saying so directly above the button you pressed.

When you submit that form, the company running that Network receives the first name, last name, and email address you entered, your answers to any other questions that company added to its form, and a summary of which of their demos you watched and roughly how much of each — measured from playback that actually ran, so it is an approximation rather than proof of attention. You do not get a DemoSix account, you do not join anything, and DemoSix does not add you to its own marketing. The company is responsible for its own email, calls and texts, and for its own opt-outs.

If the form asks for your phone number, the company receives that number too. Such a form also has a box agreeing to calls and texts. It starts unticked and you don't need it to watch; the company sees whether you ticked it, and when. Any call or text comes from that company, not from DemoSix. Our Terms require the company to have your permission, where the law requires it, before it calls or texts you for marketing, and to stop when you ask. To stop its calls or texts, tell that company, or reply STOP to a text.

Your browser is remembered for 30 days from the moment you submit, so you are not asked again on the same device. Detailed playback records are deleted after 90 days; your details and the viewing summary are deleted after 12 months without further activity from you. To see, correct, or delete what a company holds, or to stop its marketing email, calls or texts, contact that company — or contact us and we will pass the request on and delete our copy. We will confirm that a request really comes from you before revealing anything.

The company can also receive its leads outside DemoSix: through webhooks it sets up (DemoSix posts each new lead, each lead who watched half a demo, each request for a demo, each withdrawn permission and each deletion to an address the company gives), through an API key it makes, through an AI assistant it connects to DemoSix, and through apps such as Zapier it connects. Each of those carries the same details the company already sees on its Leads page and nothing more, and each goes only to systems the company's owner chose. A company may also show its Watch a Demo page inside its own website; what you enter there goes to the same place. When you ask that company, or us, to stop or delete, DemoSix tells those systems that the permission was withdrawn or the lead deleted, so the company can keep them in step; the company is responsible for doing so.

This applies only to these signature links with the form. Every other way of watching on DemoSix works as described above: no owner receives a viewer's email address.

2. How We Use Your Information

We use collected information to:

• Provide, maintain, and improve the Service
• Process, transcode, and deliver your screen recordings and uploaded videos
• Send notifications about activity relevant to you — in the app and by email when a Network you follow or belong to publishes a new recording. These are notifications about content you asked for, not marketing. Every one carries an unsubscribe link for that Network, and you can turn email off entirely in Settings → Notifications.
• Enforce our Terms of Service, moderate content, and protect the safety of our users
• Monitor and analyze usage trends to improve user experience
• Prevent fraud, abuse, and unauthorized access through rate limiting and security measures
• Respond to legal requests and comply with applicable law (see Section 7)

3. Third-Party Services

We use the following third-party services to operate the platform:

• Clerk for authentication and user management
• Mux and Mux Data for video processing, hosting, delivery, thumbnails, playback analytics, and quality monitoring, and for the automated check of videos for nudity and violence, which scores still frames from the video
• Stripe for workspace billing, payment processing, fraud prevention, invoices, tax/legal payment records, and billing telemetry
• Vercel and Vercel Blob for web hosting, file storage, deployment infrastructure, analytics, and performance monitoring
• Vercel Analytics & Speed Insights for privacy-minded usage analytics and performance monitoring
• PostHog for first-party product analytics that show how people move through signing up, creating a Network and choosing its access type, installing and signing in to the recorder, first upload, publishing, adding a payment method, and inviting a team. Event properties do not include recording titles, Network names, customer names, email addresses, or recording content. Website visits are measured without cookies and without a persistent identifier; account milestones are recorded against your account so we can tell whether the product works, not to build an advertising profile. Processed in the United States.
• OpenAI, Meta, and LinkedIn for ad measurement as described in section 11: OpenAI (ChatGPT Ads) unless you turn it off, Meta and LinkedIn only after your choice. See Meta’s privacy policy and LinkedIn’s privacy policy, and OpenAI’s privacy policy.
• Sentry for error tracking and performance monitoring, and for one narrow kind of recording. While you are signed in and on the pages of your own account (your studio, settings, feed, search, and setup pages), your browser keeps a recording of up to the last minute of the page you are on. It stays in your browser and is discarded unless that page reports an error or you choose “Report a problem”; then that minute is sent to Sentry once and recording starts over. In the recording every character of text is replaced with an asterisk, and everything you type, every image, and every video is left out, so it shows the page's layout and where you clicked, not what the page said. Link addresses and query strings are removed before it is sent. This never runs when you are signed out, and never on a demo's watch page, a creator's or Network's public page, a lead form, or the sign-in, checkout, and marketing pages. We do not record whole visits.
• Neon for database hosting
• Upstash for rate limiting (processes hashed IP addresses)
• Ably for real-time notification delivery
• Inngest for background job processing
• Resend for transactional and relationship product email — private Network invites, new-recording notifications for Networks you follow or belong to, and account, billing, and legal notices — when configured
• Axiom for optional structured log forwarding when configured
• Cloudflare Turnstile for bot protection when Clerk Smart CAPTCHA is active
• Algolia for search functionality (when enabled)
• Cloudflare R2 and GitHub for recorder release distribution and private build artifact workflows where applicable

Each of these services has its own privacy policy governing its handling of your data. We encourage you to review their respective privacy policies. We share only the minimum data necessary for each service to perform its function.

4. Recordings, Uploaded Videos and Third-Party Data

Screen recordings and other videos uploaded to DemoSix may capture personal data, proprietary information, or other sensitive content belonging to individuals other than the person who made the video. This may include the faces and voices of people seen or heard in it, and names, email addresses, messages, documents, or other information visible on screen at the time of recording.

DemoSix does not review, scan, or analyze the contents of your recordings or uploaded videos for third-party personal data. You are solely responsible for ensuring that your recordings and uploaded videos comply with all applicable privacy laws, including but not limited to the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and any applicable state or federal wiretapping, eavesdropping, or consent laws. You must obtain all necessary consents from individuals whose data may appear in your recordings or videos before uploading them to the Service.

5. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including encryption in transit (TLS/SSL), secure authentication, and access controls. Private Network content is protected through signed playback tokens and membership verification. However, no method of transmission over the internet or method of electronic storage is 100% secure, and we cannot guarantee absolute security.

6. Data Retention

We retain your account data for as long as your account is active. If you delete a demo, it enters a soft-delete state and is permanently removed (including deletion of the underlying video asset) after 7 days. If you delete your account, we enqueue an account purge immediately. The purge deletes your Clerk identity, DemoSix profile data, owned workspaces, networks, demos, stored video assets, uploaded images, recorder sessions, and search index records. If you own a Stripe-billed workspace, the purge deletes the Stripe customer record first, which cancels active subscriptions and removes saved payment methods.

Records of who viewed a demo inside a private Network, and how much of it played (described in Section 1) are deleted 730 days after the most recent view, and sooner if the demo or the viewer's account is deleted.

Content from terminated or banned accounts is removed through the same account-purge workflow unless we are legally required to preserve it. Stripe and DemoSix may retain invoices, payment records, dispute records, minimal billing identifiers, security logs, abuse records, and support records where necessary to comply with legal, tax, accounting, fraud-prevention, dispute-resolution, or Terms enforcement obligations. Some data may remain in database backups for up to 30 days, after which it is automatically purged.

A video our automated check holds is kept until we review it, even if it or its account is deleted. A video we remove for breaking our rules is kept, locked so no one can play it, for 90 days. A video we report to the National Center for Missing & Exploited Children is kept for one year, as the law requires. Each is then deleted.

7. Law Enforcement and Legal Requests

We may disclose your personal data to law enforcement agencies, regulatory authorities, or other third parties when we believe in good faith that disclosure is necessary to:

• Comply with a legal obligation, subpoena, court order, or other legal process
• Protect the safety, rights, or property of DemoSix, our users, or the public
• Investigate, prevent, or take action regarding suspected illegal activities, fraud, or violations of our Terms of Service
• Respond to an emergency involving danger of death or serious physical injury

We will notify affected users of law enforcement requests for their data unless we are legally prohibited from doing so, or we reasonably believe that providing notice would pose a risk to safety or would be futile.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict processing of your data
• Request portability of your data in a machine-readable format
• Withdraw consent at any time (where processing is based on consent)

To exercise any of these rights, contact us at support@demosix.com. We will respond to your request within 30 days (or sooner if required by applicable law).

9. California Privacy Rights (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights regarding your personal information:

• Right to know: You have the right to request information about the categories and specific pieces of personal information we have collected about you.
• Right to delete: You have the right to request deletion of your personal information, subject to certain exceptions.
• Right to opt-out of sale or sharing: DemoSix does not sell personal information for money and does not use advertising pixels such as Meta Pixel or Google Analytics. ChatGPT Ads measurement applies when you arrive from one of our ChatGPT ads, unless you turn it off. Meta and LinkedIn ad measurement is off unless you allow it. You can opt out of this sharing or withdraw your permission at Privacy choices. We honor Global Privacy Control for this ad sharing. Contact us to exercise other privacy rights or limit optional analytics or diagnostics processing tied to your account.
• Right to non-discrimination: We will not discriminate against you for exercising any of your CCPA rights.

To exercise your rights under the CCPA, contact us at support@demosix.com.

10. International Data Transfers

The Service is operated from and data is stored and processed in the United States. If you are accessing the Service from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction. By using the Service, you consent to the transfer of your information to the United States.

11. Cookies and advertising choices

We use essential cookies for authentication and session management through Clerk, and one that remembers the language you chose. We also use analytics, playback-quality, fraud-prevention, and diagnostics technologies from providers such as Vercel, Mux, Stripe, Sentry, and PostHog to operate and improve the Service. Our product analytics run in a cookieless mode: PostHog does not store a cookie or any identifier in your browser, and visits are counted using a privacy-preserving hash rather than a profile that follows you. We do not use third-party advertising pixels. If you reach us by clicking a Google ad, Google attaches a click identifier to that visit; if you then create an account, download the recorder, or publish your first demo, our servers report that milestone and the click identifier back to Google Ads so it can measure the ad. No advertising cookie or pixel is placed on our pages to do this, and nothing else about you is sent. You can manage cookie preferences through your browser settings, though disabling essential cookies may prevent you from using certain features of the Service.

ChatGPT Ads is measured in a similar way. If you reach us by clicking one of our ads in ChatGPT, OpenAI attaches a click identifier to that visit and we store it on our servers. If you then create an account, click the recorder download button, or publish your first demo, our servers send OpenAI that click identifier, the milestone, its time, and a deduplication identifier. A website event can also include a static product or marketing page address, without query parameters or private content paths. OpenAI events are marked to opt out of future user-level personalization. We do not ask first. You can turn this off at any time at Privacy choices, and we do not store or send the identifier when your browser sends Global Privacy Control.

Meta and LinkedIn measurement is optional and separate. If one of those connections is active, we ask before storing its ad click identifier or sharing a milestone with that partner. If you allow it, our servers send the partner its own click identifier, the milestone, its time, and a deduplication identifier. Meta website events can also include a static product or marketing page address, and Meta additionally receives the browser user-agent. OpenAI, Meta and LinkedIn use this information to measure and improve ad delivery under their own privacy policies. We do not send names, email addresses, IP addresses, recording titles, Network names or recording content through these integrations.

When you arrive from a ChatGPT ad, or make a choice, we set a first-party cookie that holds only a random reference to a record on our servers, kept for up to 180 days. Click identifiers are held server-side for up to 30 days, with expired records removed by our daily cleanup. When you sign in, we can link that record to your account so a later milestone can be measured. Delivery receipts contain no click or account identifier and are kept up to 90 days.

You can turn measurement off or decline it without affecting the Service at Privacy choices. Doing so clears stored click identifiers and stops future and queued sends. While signed in, this covers records linked to your account; while signed out, it covers this browser. A request already being transmitted or accepted by a partner cannot be recalled by this switch. We honor Global Privacy Control for OpenAI, Meta, and LinkedIn sharing. None of this enables analytics cookies, session replay, or an advertising pixel.

12. Children's Privacy

The Service is not intended for children under 13 (or under 16 in the European Economic Area). We do not knowingly collect personal information from children under these ages. If we learn that we have collected personal information from a child under the applicable age, we will take steps to delete that information as promptly as possible. If you believe a child has provided us with personal information, please contact us at support@demosix.com.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and notify you through the Service or by other reasonable means. Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated policy.

14. Contact

DemoSix is a product of Sunny Systems LLC. For privacy-related questions, to exercise your rights, or for general inquiries, contact us at support@demosix.com.

To submit a formal privacy, publicity, likeness, voice, NCII, or other legal report, use the legal report form.