Legal

Privacy

What we collect when you use Spool or just visit the site, who processes it, and how to opt out. Written to match what the code actually does.

Effective July 30, 2026

Who we are

Spool (spoolkit.dev) hosts walkthrough videos that coding agents record and publish themselves. A spool is a narrated screen recording of a web app, served as one link that people and agents can both read.

We are a small team, and one inbox handles privacy. For a copy of your data, a correction, a deletion, or any question about this page, email aarnav@lyratechnologies.com.au.

Account data

Authentication runs on Clerk. We never see or store your password.

When you sign up, Clerk stores your email address and sign-in metadata: the method you used, session records, and timestamps. We read your Clerk user id and email so your spools, your plan, and your usage counters belong to you. Signing in through the CLI works the same way: the browser approves a short code, and the token that gets minted is tied to that same account.

Content you publish

A published spool is unlisted, not private. Treat it like a screenshot you are about to post.

Publishing stores the rendered video, the narration transcript, step names and timings, click positions, one keyframe image per step, and the browser console output captured while recording. A PR guide also stores the pull request metadata and the code diff the guide reads. Whatever your app showed on screen during the take is in the video, so do not record credentials, customer data, or anything you would not paste into a public link.

Anyone with the watch link can open a spool, and the video files are served from a public blob store, so the link is the only access control. Vertical spools from a repository that has opted into the feed can also appear in the feed of signed-in users who follow that repository. Everything else stays link-only.

Publish tokens are stored only as a SHA-256 hash. The raw token is shown once when it is created and cannot be recovered from us afterwards.

Payments

Stripe processes every payment.

Card details go to Stripe and never touch our servers. We store your Stripe customer id, your plan, and when the current billing period ends. Stripe tells us about a subscription through signed webhooks; it is the only writer of paid plans.

Usage analytics

Three separate things run here, and they collect different amounts.

  • PostHog records page views, product events (a signup, a publish, a watch view), and session replay. Replay captures the pages you visit on spoolkit.dev along with your clicks, scrolling, and typing activity, and it can include output your browser wrote to the console. Replays are kept for 30 days. When you are signed in we send PostHog your Clerk user id and email so a session ties back to your account.
  • Vercel Web Analytics reports aggregate traffic: page, referrer, country, device class. It sets no cookies and is not tied to a person.
  • View counts store one row per spool, day, and hashed IP. Your IP address is hashed with SHA-256 and a secret salt before anything is written, so we hold the hash and not the address. The same hashed value meters the daily limit on watch-page questions.

Visitor identification

This site identifies its visitors, and for United States traffic that can mean a named person.

We want to know which companies are looking at Spool, so we and our data partners use cookies, similar technologies, and IP-based signals to associate a visit with the company behind it, and for US visitors with an individual professional profile. RB2B, a third-party identification service, runs on visits to this site whether you are signed in or not. It may match a US visit to a professional profile, including a name and work email, and notify us of the visit along with what it inferred, such as the company and an approximate location.

Required notice from our data partner. When you visit or log in to our website, cookies and similar technologies may be used by our online data partners or vendors to associate these activities with other personal information they or others have about you, including by association with your email. We (or service providers on our behalf) may then send communications and marketing to these email addresses. You may opt out of receiving this advertising by visiting https://app.retention.com/optout.
You also have the option to opt out of the collection of your personal data in compliance with GDPR by visiting https://www.rb2b.com/rb2b-gdpr-opt-out.

Both opt-out links are clickable under your choices below. Under some United States state privacy laws, matching a visit across contexts like this counts as sharing or selling personal information. That is the only sense in which we do it. We do not sell anything else, and we never sell or license the spools you publish.

Cookies and storage

Small, and mostly to keep you signed in.

  • Clerk sets session cookies. Without them there is no signed-in dashboard.
  • PostHog uses a cookie and local storage to recognize a returning browser and group events into a session.
  • RB2B and its partners set cookies and similar identifiers, as described above.
  • Your own preferences stay in your browser: the watch page keeps your chosen playback rate in local storage, and the feed keeps whether you turned sound on in session storage.

AI processing

OpenAI is the model provider. Nothing you publish is used to train a model by us.

  • Voiceover. Narration text for each step is sent to OpenAI, which returns the spoken audio and the word timings the captions are built from.
  • Watch-page questions. Asking a question on a spool sends your question, the recent turns of that conversation, and the parts of the spool the answer needs (transcript, step data, and for a PR guide the diff and the project knowledge for that repository) to OpenAI, which writes the reply.
  • Edit chat. Asking for a change sends your instruction plus the spool's current title, step order, and narration to OpenAI, which turns plain English into the render operations we run.

We train no models of our own and we do not hand your content to anyone for training.

Data sharing

Only the services that run Spool, listed here in full.

  • Clerk: authentication and account records.
  • Stripe: payments and subscription state.
  • Vercel: hosting, request logs, Web Analytics, and the blob store the videos are served from.
  • Neon: the Postgres database everything above is stored in.
  • Fly.io: the worker that re-renders a spool for a cloud finish or an edit.
  • OpenAI: voiceover, watch-page answers, and edit parsing.
  • PostHog: product analytics and session replay.
  • RB2B: visitor identification.
  • Discord: a private internal channel that receives operational alerts through a webhook.

We also disclose data when the law requires it. Apart from the visitor identification described above, we do not sell your personal information.

Your choices

Everything here works without an account and without asking us.

  • Opt out of the advertising described in the notice above at app.retention.com/optout.
  • Opt out of RB2B collecting your personal data under GDPR at rb2b.com/rb2b-gdpr-opt-out.
  • We honor Global Privacy Control and similar browser opt-out signals where the law requires it.
  • Any content blocker stops PostHog and RB2B. Watching, publishing, and the dashboard all work without them.
  • Delete a published spool from your dashboard whenever you like. The video, its artifacts, and its link go with it.
  • Email aarnav@lyratechnologies.com.au to get a copy of your data, correct it, or delete your account and everything in it. Deleting your account revokes every publish token with it.

Changes

This page tracks the code, so it changes when the code does.

If we add a service, drop one, or start collecting something new, we update this page and move the effective date at the top. If a change is material we will say so here rather than let you find it.