Privacy Policy

Effective date: 23 October 2026 · Operator: 172 Tech

1. Who is responsible

172 Tech, a sole proprietorship registered at Hno 58, Sector 2, Panchkula, Haryana, India, is responsible for personal information processed through GoClickIT. Correspondence may be sent to ESS ENN Associates (c/o 172 Tech), SCO 197, Sector 7C, Chandigarh, India 160019. Use our contact form for personal information and privacy requests.

2. Information we process

• Account details: name, email, password hash and, if you choose Google sign-in, your Google account identifier and basic profile.
• Your captures and uploads, source URLs, titles, access settings, workspace memberships, invitations and review comments.
• Service records such as storage totals, render counts, security rate-limit records, subscription identifiers and billing status.
• Technical logs generated by our hosting and service providers, which may include IP addresses and request information.

Website screenshots may contain personal or confidential information present on the target website. Local edits and recordings stay on your device until you choose to upload them. URL capture sends the requested public URL and capture options to the browser-rendering provider. Do not include secrets in URLs.

If you install a GoClickIT browser extension, screenshots, recordings and drafts are stored in that browser profile until you delete them or they expire, normally after 72 hours while the browser and cleanup run. Local drafts are limited to 20 drafts and 300 MB. The extension has no analytics or automatic media upload. Choosing Save to GoClickIT creates a temporary transfer of the flattened file, chosen title and optional page address to the dedicated app import tab; the address excludes query parameters, fragments and embedded credentials. Transfer records expire after 10 minutes or are removed after receipt. The app then asks you to confirm the cloud upload. Firefox may request optional data-transfer permission. Local draft deletion does not remove existing downloaded files or cloud copies.

Signed direct screenshot URLs contain a target website address, capture settings, an expiry and a signature. Anyone with a valid link can request its image until expiry or revocation, subject to the profile’s rules. These links are separate from private workspace media sharing. Optional embedding-host checks process Referer or Origin information; they are hotlink controls rather than identity verification. Do not put confidential information in target URLs or public embeds. Requests and signed URLs may appear in hosting access logs; the operator should restrict and minimize such logs.

3. Purposes and legal grounds

We process information to provide the service you request, manage accounts and billing, deliver verification and invitation messages, prevent abuse and meet legal obligations. Where relevant, these purposes rely on performance of a contract, legitimate interests, legal duties or consent. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing.

4. Providers and recipients

Hostinger hosts the marketing website, app and MySQL account database. Cloudflare provides Browser Run rendering and private R2 media storage. Google processes Google sign-in when you choose it. Paddle handles checkout and payment information under its own privacy terms; we do not store your complete card details. Formspree processes contact-form submissions, including your name, reply address, message and associated technical information. Verification and account emails are delivered through our configured SMTP email provider. If you consent to optional analytics, Google Analytics processes general usage and technical information. We have removed remote Google Fonts requests from the marketing homepage. Providers may process data internationally, subject to applicable transfer requirements.

5. Sharing controls

Private captures are accessible to authorized workspace members. Anyone-with-link captures can be opened by anyone who receives the URL. Public captures are also available without sign-in and may be redistributed. Email-restricted captures require a verified invited account or authorized workspace membership. Recipients can download or copy media; revoking access cannot recall copies they already saved. Media delivery checks access through the app. Revoking a link does not remove copies already downloaded or cached by a recipient.

6. Cookies and device storage

The app uses an essential session cookie to keep you signed in and protect requests; session records are stored in MySQL. The session cookie expires after 24 hours. The app uses local storage for your workspace preference and a pending capture-job identifier; you can clear this through your browser settings. Local downloads use your browser’s file handling. Google sign-in and Paddle checkout may use their own cookies and storage. Optional Google Analytics 4 (measurement ID G-2YWX4CT891) is blocked until you expressly accept analytics. This is used to understand general visits and named app screens, based on consent; advertising storage, Google Signals and ad personalization are disabled. Our measurements use generic page or screen names rather than account names, emails, capture contents, source URLs or media-link identifiers. Authentication, shared-media, extension-import and URL entries containing query parameters or fragments are excluded from analytics. Browser extension pages remain untracked.

Your consent or refusal is stored locally under gci-consent-v1 for 180 days on each website/app hostname. Both choices are equally available. Use the persistent Cookie settings control to change or withdraw consent. Refusing analytics does not restrict the service. We respect browser Global Privacy Control and Do Not Track signals by keeping optional analytics disabled. When enabled, Analytics cookies use the gci prefix and are configured for host-only storage and a maximum 180-day expiry without renewal on every visit. On withdrawal, we disable the tag, clear accessible Analytics cookies and reload the page. This stops future collection; it does not automatically delete data previously sent to Google. Contact us for privacy or deletion requests.

Google receives network information, including your IP address for processing, and may process information outside your country, including in the United States. Google’s contractual terms, processing arrangements and applicable transfer safeguards govern its processing. See Google’s Privacy Policy and how Google uses information from partner sites. Analytics retention and sharing settings are configured in the Google Analytics property. Necessary account/security storage and contact-form processing are separate from optional Analytics.

7. Retention and deletion

Account and saved-media records are retained while your account is active and needed to provide the service. Deleting a capture removes its live stored file, sharing grants and comments; scheduled cleanup retries incomplete removals. Temporary website-render results expire after one hour and are removed by scheduled cleanup, normally within the following 15 minutes while the service is operating. Abandoned upload reservations are eligible for cleanup after one hour.

Request account deletion through our contact form. After verifying your identity and confirming the scope, we complete account-deletion requests within 30 days. Backup copies are scheduled to expire within 90 days of deletion and are not used for ordinary service delivery. If restoration is necessary, deletion requests are reapplied. Shared workspace content may need to be transferred or retained for other authorized members; we explain any limits before completing your request.

Expired session, verification, reset and rate-limit records are removed by scheduled cleanup. Support enquiries, security records and purchase records are kept only while needed to resolve the matter, prevent abuse or meet legal and accounting obligations, then deleted or anonymized. Providers may retain their own records under their published policies. Where law or a legal hold requires longer retention, we limit it to the necessary records and purpose.

8. Your choices and rights

Depending on your location, you may have rights to access, correct, delete, export or restrict processing of personal information, object to certain uses, withdraw consent, or complain to a supervisory authority. Contact us to exercise a right. We may verify identity before fulfilling a request. The service is not intended for children.

9. Contact and complaints

Use the privacy request form or the correspondence address below to request access, correction, export or deletion, withdraw consent or raise a privacy complaint. We may request the information needed to verify the account and respond to your request. We handle verified account-deletion requests within 30 days; other requests follow the time limits required by applicable law.

10. Security

We use access checks, password hashing, protected sessions and server-side service credentials. No online service can promise absolute security. Notify us promptly if you suspect unauthorized access.