Privacy Policy

Effective November 8, 2026 · Last updated November 9, 2026

1. Who we are

ClauBack is operated by HBAI LLC (“HBAI”, “we”, “us”). This policy covers the ClauBack website at clauback.com (including your dashboard), the ClauBack API at api.clauback.com, the ClauBack Mac and iPhone apps, and the integrations ClauBack sets up in your AI coding tools (together, the “Service”). For questions or requests, email privacy@clauback.com.

2. What we collect

Account information

• Your email address and password. The password is stored only as a secure hash by our authentication provider; we never see it.
• If you choose “Continue with Google”, the details Google shares for sign-in: your email address, and the name and profile picture link on your Google account. ClauBack does not use the name or picture.
• When your account was created and when you last signed in.

Your boundaries

Your daily limit, curfew, Pip’s voice, whether ClauBack should catch prompts after your limit or curfew, and your time zone.

Connected tools

For each AI coding tool you connect (for example Claude Code, Codex, Cursor, Cline or Antigravity): which tool it is, a label for the computer it runs on (such as “Alex’s MacBook”), the first characters of its ClauBack key, a one-way hash of the key, and when it last reported.

Activity counts from your AI tools

When you connect a tool, it sends ClauBack numbers only, through the tool’s own telemetry (configured for metrics only) and small hooks that send no text:

• per day and per tool: tokens used (by model name and type, such as input or output), active time, and counts of prompts, sessions, commits and pull requests;
• which minutes of the day each tool was active;
• the time a prompt was sent or finished, without its content;
• night passes you take (when, and for how long).

Our servers keep only an allowlist of fields (counts, the model name and the count type) and drop everything else a tool might send before anything is stored.

Check-ins (optional)

If you agree and choose to answer: how drained you feel and how you slept, each on a 1–5 scale, and tags you pick from a fixed list (such as “Took a walk” or “Deadline”). There is no free text. From these and your activity counts we compute your wellness scores and patterns (see Consumer health data).

Technical information

Like any website or API, our hosting provider processes your IP address, browser or app version and request times to deliver the Service, block abuse and enforce rate limits. Our own logs record the route and error type of a request, never its body, keys or tokens. The Mac app checks www.clauback.com for a newer version about once a day; that request carries only the app and macOS versions, and an update downloads only if you choose to install it. If you allow notifications, the iPhone app gives us that phone’s Apple push token. We use it only to send ClauBack’s own nudges (when your day passes its limit or runs past curfew) through Apple’s Push Notification service, and we delete it when you sign out on that phone, clear its data or delete your account. The website keeps your sign-in session in your browser’s local storage. The website uses no analytics, advertising or tracking cookies.

Optional usage analytics (iPhone app)

The iPhone app has a switch, “Share anonymous usage” under Your data, your choice. It is off unless you turn it on. While it is on, the app sends the following to PostHog, our analytics provider, so we can fix crashes and see which features get used:

• the app being installed, updated, opened or put in the background;
• crash reports (the error and where in the app’s code it happened);
• a few moments: finishing setup, creating an account or signing in, pairing or unpairing your Mac, and turning analytics on;
• the device model, iOS version, app version and language PostHog adds to each event.

These are sent under a random ID created on your phone. They are not linked to your account or email, and we ask PostHog not to look up a location or keep IP addresses. They never include your check-ins, wellness scores, Screen Time data, coding time, prompts or code. Turning the switch off stops sending and forgets the random ID, and so does “Clear data on this phone”.

3. What stays on your devices

• iPhone: if you turn on Screen Time features, Apple’s Family Controls frameworks keep app usage on your phone and do not share which apps you use with ClauBack. The name you give Pip, your notification wording and preferences, and the phone’s timer are stored on the phone. Reminders are local notifications scheduled on the phone.
• Mac and iPhone together: if you pair them on your local network, short activity summaries travel directly between your devices over an encrypted connection. Pairing keys are kept in the Keychain on each device.
• Mac: to connect a tool, the Mac app (or your AI agent following ClauBack’s setup, with your approval) edits that tool’s own settings file on your computer and keeps a backup of the original. The file’s contents are not sent to us.

4. What we never collect

Your prompts, the AI’s responses, your code, file names or paths, repository or project names, browsing history, contacts, precise location, or advertising identifiers.

5. How we use information

• To run the Service: Pip’s mood, your status line, the dashboard, prompt catch after your limit or curfew, night passes and reminders.
• To compute your typical day, wellness scores and patterns, shown only to you.
• To keep the Service secure and reliable: authentication, rate limits and abuse prevention.
• To answer you when you contact us, and to meet legal obligations.

We do not use your information for advertising, we do not sell or rent it, we do not build profiles about you for anyone else, and we do not use it to train AI models.

6. Consumer health data

Some laws, such as Washington’s My Health My Data Act and Nevada’s consumer health data law, treat information about your wellbeing as “consumer health data”. At ClauBack this means your check-ins (drained and sleep ratings, and tags) and the wellness scores and patterns we compute from them and from your activity counts. Our separate Consumer Health Data Privacy Policy sets out exactly what we collect, why, who receives it and how to use your rights.

• Collected from: you, only when you choose to check in, and from your connected tools’ counts.
• Used to: show you your own scores and patterns, such as whether heavier AI days are followed by worse sleep. Nothing else.
• Consent: check-ins are optional. Before your first one, ClauBack shows what it collects, why, who receives it and how to stop, and asks you to agree. The wellness scores computed from your tools’ counts are part of the service you ask for when you connect a tool.
• Shared with: only the service providers in section 7, under contract, to store and process it for us. Never sold, never shared for advertising, never shared with your employer.
• Your rights: see your data in your dashboard. “Stop check-ins” in your account withdraws consent and deletes every check-in; “Clear today’s answers” deletes one day’s; deleting your account removes all of it at once. Or email privacy@clauback.com. We answer within 45 days.

ClauBack is a general wellness tool. Its scores and patterns are not medical advice and are not used to diagnose or treat anything.

7. Who we share it with

We use these service providers to run ClauBack. They process data on our behalf only:

We may also disclose information if the law requires it, to protect people’s safety or our rights, or as part of a merger or sale of the business, in which case this policy continues to apply and we will tell you. We do not share your information with other ClauBack users or with your employer.

8. How long we keep it

• Account, boundaries and connected tools: until you delete them or your account. A tool’s key stops working after 30 days without any reports.
• Activity counts and check-ins: up to 400 days, then deleted automatically every day.
• Night pass records: deleted 30 days after the pass ends.
• Today’s cached status and rate-limit counters: minutes to hours.
• Hosting logs: a short period set by our hosting provider.
• Optional usage analytics: kept by PostHog in our project. Because it carries only a random ID, it can’t be traced back to you or your account.

When you delete your account, everything above is deleted at once. Copies in our database provider’s backups expire within 30 days.

9. Your choices and rights

• See your data: your dashboard at clauback.com/dashboard shows your day, week, check-ins, connected tools and boundaries.
• Change it: edit your boundaries, remove a connected tool, or stop checking in at any time.
• Delete your account: in your dashboard (Settings, then Delete account) or in the iPhone app (Your ClauBack account, then Delete account). This deletes your account and all of its ClauBack data from our servers. You can also email us.
• Clear a phone: in the iPhone app, “Clear data on this phone” removes ClauBack’s data from that phone.
• Usage analytics: turn “Share anonymous usage” on or off in the iPhone app at any time. It starts off.
• Get a copy: email us and we will send you your data in a common format.

We will verify that a request comes from the account holder, usually by replying to the account’s email address, and answer within 30 days (45 where state law allows). We will not treat you differently for using any of these rights.

10. Security

Traffic is encrypted in transit. Tool keys are stored only as one-way hashes. The database allows each account to reach only its own rows, and the most sensitive tables are reachable only through our server. In the Mac and iPhone apps, your sign-in is kept in the system Keychain. No system is perfectly secure; if a breach affects your information, we will notify you and the authorities as the law requires, including under the FTC Health Breach Notification Rule.

11. Children

ClauBack is not for children under 13, and we do not knowingly collect their information. In the European Economic Area and the UK you must be at least 16. If you believe a child has given us information, contact us and we will delete it.

12. Where data is processed

HBAI LLC is based in the United States, and our providers process data in the United States and other countries where they operate. If you use ClauBack from outside the United States, your information is transferred there, protected as this policy describes and as the law requires.

13. State and regional rights

Depending on where you live, for example in California, other US states, the European Economic Area or the UK, you may have the right to know, access, correct, delete or port your information, to object to or restrict some processing, and to appeal our decision on a request. We do not sell or share personal information for cross-context behavioural advertising, and we do not use sensitive information to infer characteristics about you.

Where the GDPR applies, we rely on: performing our contract with you (running the Service); your consent (check-ins and optional usage analytics, both of which you can withdraw); and our legitimate interests in keeping the Service secure and working. You may complain to your local data protection authority.

To use any of these rights, email privacy@clauback.com.

14. Changes to this policy

We will post any changes here and update the date at the top. If a change is significant, we will tell you by email or in the apps before it takes effect.

15. Contact

HBAI LLC, operator of ClauBack · privacy@clauback.com