This policy explains what personal data Recap processes, why, and what your rights are. It covers the Recap desktop apps and Recap Cloud. It's written to meet the Swiss Federal Act on Data Protection (FADP) and, for people in the EU and EEA, the General Data Protection Regulation (GDPR).
Who is responsible
Ampersand Labs by Davide Morotti, Flüelastrasse 10
8048 Zürich
Switzerland.
For anything about your data, email legal@ampersand.ch.
The desktop apps
Recordings are made and saved on your computer. Nothing is sent to us unless you connect a Recap Cloud account. A connected app uploads each new recording, with its title, length, size and a thumbnail; you can turn this off in the app's settings and upload only the recordings you choose. A connected app also checks for activity on your videos every 30 seconds to show notifications.
To check for updates, the apps regularly ask GitHub (GitHub Inc., USA) for the latest release. GitHub sees your IP address. App downloads are also served by GitHub.
What we process in Recap Cloud
Your account
- Name, email address, password (stored only as a secure hash), passkeys and two-factor settings if you set them up, and your notification preferences.
- Access tokens for connected desktop apps.
Your videos
- The videos you upload, including your image and voice and anything visible on your screen, with titles, descriptions, thumbnails and sharing settings.
- Each day's total storage used, which we need to bill extra storage.
People who watch your videos
- When someone plays a video, we record a view: the account if they're signed in, otherwise a random ID stored in a cookie on their browser. This lets us count each person once and tell you who watched. We don't store viewers' IP addresses with views.
- Reactions and their position in the video, and comments with the commenter's name.
Every visitor
Like any website, our server keeps a session for each visitor with the IP address and browser type. It expires after 2 hours of inactivity, or when you sign out.
Payments
Subscriptions are handled by Stripe. Stripe collects your card or other payment details, billing name and address and, if you give one, your VAT ID. Stripe uses your address to work out the right tax. We never see your full card number; we keep your Stripe customer ID and the status of your subscription.
Emails
We send account emails (verification, password reset), activity emails you can turn off in Settings › Notifications, and billing emails such as payment failures and deletion warnings.
Why we process it
- To provide Recap under our contract with you: storing and streaming your videos, showing activity, billing (GDPR Art. 6(1)(b)).
- To meet legal duties, such as keeping accounting records and charging the correct VAT (Art. 6(1)(c)).
- Our legitimate interests: keeping Recap secure, preventing abuse, and counting views so video owners know their message was seen (Art. 6(1)(f)).
We don't sell your data, show ads, or use your videos to train AI models.
Cookies
We only use cookies that Recap needs to work. There are no analytics or advertising cookies.
- Session and security cookies keep you signed in and protect forms. They expire when you sign out or after a period of inactivity; “Remember me” keeps you signed in for longer.
- recap_visitor: a random ID for viewers who aren't signed in, so a view or reaction is counted once. It lasts one year.
Our pages load fonts from Bunny Fonts (BunnyWay d.o.o., Slovenia), which receives your IP address to deliver them. Bunny Fonts doesn't set cookies.
Who else receives data
We use these service providers. They process data only on our instructions and under data processing agreements:
- Stripe (Stripe Payments Europe Ltd., Ireland, and Stripe Inc., USA): payments, invoices and tax.
- Hetzner Online GmbH (hosting and video storage
- Germany)
- Laravel Forge (server management
- USA)
- Brevo (transactional emails
- France)
Some providers are in the USA. Transfers rely on the Swiss–US and EU–US Data Privacy Framework where the provider is certified, and otherwise on the standard contractual clauses approved by the European Commission and recognised by Switzerland.
The people you share a video with see the video, its title and description, comments and reactions. As the owner you see who watched, commented and reacted.
How long we keep it
- Videos: until you delete them, or 30 days after your subscription ends (we email you first).
- Your account: until you delete it in Settings › Profile. Deleting it removes your videos, comments, sessions and app connections straight away; backups are overwritten within 30 days.
- Views and reactions on other people's videos remain as anonymous counts after you delete your account.
- Invoices and payment records: 10 years, as Swiss accounting law requires. Stripe keeps these.
Security
Connections are encrypted with HTTPS, passwords are hashed, and you can add two-factor authentication or a passkey. Desktop app tokens are stored in the Mac Keychain or encrypted with Windows' data protection. Share links use long random IDs that can't be guessed.
Your rights
You can ask for a copy of your data, have it corrected or deleted, have it handed over in a common format, and object to processing based on our legitimate interests. Most of this you can do yourself: edit your profile, download your videos, or delete your account. For anything else, email legal@ampersand.ch. We reply within 30 days.
You can also complain to a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), or the authority in your EU country.
Children
Recap accounts are for people aged 16 and over.
Changes
If we change this policy in a way that matters, we'll tell you by email before it applies. The date at the top shows the latest version.