Your data, in plain English.

1. Who we are

ClawCast is operated by Vince Martin, a sole proprietor based in Denmark. For the purposes of the EU General Data Protection Regulation (GDPR), Vince Martin is the data controller responsible for your personal data. You can reach the controller at Vince@theclawcast.com.

This policy covers the ClawCast iOS app, the private RSS feeds we generate for listeners, and this website (theclawcast.com).

2. What we collect

Information you give us directly

• Sign in with Apple identifiers.When you sign in, Apple sends us a stable user identifier (the “Apple subject”), your name, and either your real email or Apple’s private relay email. You control which of those you share.
• Podcast preferences.The hosts, voices, tone, duration, humor style, and any free-text guidance you write (e.g. “keep it light, no sports”).
• Source selections.Which newsletters, publications, or custom RSS feeds you’ve added to your catalog.
• Delivery schedule. What days and times you want episodes delivered, plus your timezone.
• Voice intake transcripts. If you complete the voice onboarding step, your spoken brief is transcribed on-device by iOS. The audio recording never leaves your phone. The transcript text is sent to our server and to OpenAI so we can extract the topics, names, and tone notes that personalize your podcast — the resulting topics and notes are stored, but the raw transcript itself is not retained after extraction.
• Feedback. Anything you type or dictate into the in-app feedback form.
• Optional weather location.If you turn on the weather feature, your device’s GPS coordinates are reverse-geocoded on-deviceto a “City, Country” string. Only that string is sent to our servers; the raw coordinates are not.

Information we generate as you use the app

• Swipe signals.When you swipe right or left on a story card, we record the direction, the article’s title and link, and a numerical embedding of its content. This is how the app learns what you find interesting.
• Episode and run history.Records of the episodes we’ve generated for you, when they were delivered, and which source items they covered.
• Newsletters forwarded to your alias. Each user gets a private yourname@theclawcast.comemail alias. Newsletters you forward (or that arrive via Substack subscriptions you set up in the app) are stored as text so we can include them in upcoming episodes. We store the subject, sender, plaintext body, and any “read on web” link.
• Substack subscription intents.When you tap “Subscribe” on a publication inside the app, we record the publication URL, title, and author so we can confirm the subscription on your behalf.
• Subscription and billing state. Your current tier (Free, Pro, Max), product ID, renewal and expiry dates, and the raw notifications Apple sends us when your subscription changes.

What we do not collect

• We don’t use any third-party analytics, advertising, or attribution SDKs.
• We don’t collect device identifiers (no IDFA, no identifierForVendor).
• We don’t collect your contact list, photos, browsing history, or precise GPS location.
• We don’t collect payment card details. Apple handles all payment processing inside the App Store — we only ever see the subscription state Apple reports back to us.
• Voice recordings from the microphone are never sent off your device.

3. How we use it

• To make your podcast. Your preferences, sources, swipes, forwarded newsletters, and (optionally) weather city are used to generate the script and audio of each episode.
• To deliver your podcast. Each user gets a unique, token-gated RSS feed and audio URL. We use your account identifiers to make sure only you can access your feed.
• To manage your subscription. Your tier and trial state determine which features you can use (premium voices, weekly quotas, etc.).
• To improve the app.Aggregated feedback and error logs help us fix bugs and prioritize features. We don’t use any individual’s data to build advertising profiles or derive insights about you for any third party.
• To prevent abuse. Authentication tokens, rate limits, and subscription checks help us prevent fraud and keep the service running.

4. Legal bases (for users in the EU/EEA/UK)

Under the GDPR, we rely on the following legal bases under Article 6:

• Contract (Art. 6(1)(b)). Most of our processing — generating and delivering your podcast, authenticating you, managing your subscription — is necessary to provide the service you signed up for.
• Consent (Art. 6(1)(a)). The weather feature uses your approximate location only after you explicitly turn it on and grant the iOS location permission. You can withdraw consent at any time by turning the feature off.
• Legitimate interests (Art. 6(1)(f)). We rely on legitimate interests for security monitoring, fraud prevention, product improvement, and responding to your support requests. These uses are limited and proportionate; you can object to them at any time.
• Legal obligation (Art. 6(1)(c)). Records related to payments and tax may be retained as required by Danish and EU law.

5. Who we share data with

We don’t sell your data and we don’t share it with advertisers or data brokers. We do use a small number of vetted service providers (“sub-processors”) to actually run the service. Each receives only the minimum data needed to do their job.

We may add or change sub-processors over time as the service evolves. Material changes will be reflected here.

6. International data transfers

Some of our sub-processors (notably OpenAI and ElevenLabs) are based in the United States. Where personal data is transferred outside the EU/EEA, we rely on the European Commission’s Standard Contractual Clauses or equivalent safeguards provided by those vendors’ data processing agreements.

7. How long we keep your data

We keep your account data — profile, preferences, sources, episodes, swipe history, forwarded newsletters, and feedback — for as long as your account is active. We don’t currently run automated retention or cleanup jobs against this data.

When you delete your account (in-app, or by emailing us), we remove your personal data from our database and audio storage. Some records we’re legally required to retain — chiefly payment and billing records, which under Danish bookkeeping rules must be kept for up to five years — will remain in a limited-access archive until that retention period ends, after which they are also deleted.

Server logs (for security, debugging, and operational monitoring) are kept according to Google Cloud Logging’s defaults — typically 30 days for standard logs, and up to 400 days for security-relevant logs.

If we introduce automated retention windows for things like old episodes or processed newsletter content in the future, we’ll update this section before that change takes effect.

8. Your rights

If you’re in the EU, EEA, or UK, the GDPR gives you the following rights. We honor the same rights for users elsewhere as a matter of policy.

• Access. Request a copy of the personal data we hold about you.
• Rectification.Ask us to correct anything that’s wrong or incomplete.
• Erasure.Delete your account from inside the app (Settings → Delete account), or email us. Personal data is removed promptly; billing records that we’re required by law to keep are retained for the legally required period (see “How long we keep your data”).
• Restriction and objection. Ask us to pause certain processing, or object to processing based on legitimate interests.
• Portability. Receive your data in a machine-readable format.
• Withdraw consent. Turn off any feature you previously opted into (e.g. weather).
• Complain. Lodge a complaint with the Danish Data Protection Agency (Datatilsynet) or your local supervisory authority.

To exercise any of these rights, email Vince@theclawcast.com. We’ll respond within 30 days.

9. Security

Your data is stored on Google Cloud infrastructure in the europe-west1 region. We rely on Google’s default encryption-at-rest and TLS in transit. Secrets (API keys, signing keys) live in Google Secret Manager and are not exposed to client-side code. Your podcast feed and audio URLs are gated by per-user tokens so they can’t be guessed or shared accidentally.

No system is perfectly secure. If we ever discover a breach that affects your data, we’ll notify you and the relevant authorities as required by law.

10. Children

ClawCast is not directed to children under 16. We don’t knowingly collect personal data from anyone under 16. If you believe a child has signed up, email us and we’ll delete the account.

11. Changes to this policy

We may update this policy as the product changes. The “Last updated” date at the top of the page will reflect the most recent change. For material changes, we’ll surface a notice inside the app before the change takes effect.

12. Contact

Questions, requests, or just curious? Email Vince@theclawcast.com.