Privacy Policy

Effective Date: October 31st, 2025
Last Updated: July 21st, 2026

Introduction

Welcome to Clams ("we," "us," or "our"). This Privacy Policy is designed to help you understand how we collect, use, and safeguard your personal information.

Information We Collect

Depending on how you use Clams (locally, self-hosted, or with our Enterprise services), we may process the following categories of data. As explained under "Local & Self-Hosted" below, when you run Clams locally or on your own server, most of this stays on your machine or infrastructure and is never transmitted to us.

Data We Process

Category	Examples
Account and authentication	Email address, SSO identifiers (Google, Apple), login and session data, IP address, basic device/browser metadata
Billing	Name, email, company name, invoices, Stripe customer and payment metadata, Lightning payment hash and amount
Your accounting data	Wallet addresses, xpubs and descriptors where you provide them, transaction history, balances, notes, tags, journal entries, cost-basis data, and the reports generated from them
Integration credentials and configuration	API tokens, node endpoints, TLS certs, macaroons, runes, exchange import settings
Logs and diagnostics	Server and error logs, crash reports, redacted snippets, timestamps
Support and sales	Enterprise quote submissions, emails, support requests
Website analytics	Aggregate Plausible analytics
Newsletter	Email and subscription status

Local & Self-Hosted

When running locally or connecting to your own server, your accounting data (your ledger, transactions, and reports) stays on your device or infrastructure and is not transmitted to Clams. Clams does operate hosted services around the software: authentication (magic link, Google, or Apple) processes your email address, and the licensing, billing, and exchange-rate services process the account, billing, and request data described above.

Website Analytics

We use Plausible Analytics on our website. Plausible is a privacy-focused analytics tool that:

• Does not use cookies
• Does not collect personal information
• Does not track you across websites
• Collects only anonymous, aggregate data (page views, referrer, country)

What We Don't Do

• No information is shared with advertising companies
• No information is mined for personal and behavioral trends
• No information is sold or monetized

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We do disclose data to the service providers that help us run Clams, under contractual restrictions, as described below.

Why We Process Your Data

We process the data above only to run Clams and our business:

• Provide the software and services, and authenticate users
• Process payments and enforce licenses
• Sync and import your wallet, node, and exchange data, and generate reports
• Provide customer support and debug issues
• Maintain security and prevent fraud and abuse
• Meet legal, tax, and accounting-record obligations
• Deliver Enterprise implementation and managed services where engaged
• Send product and account communications, and newsletters where you have opted in

Service Providers and Subprocessors

We rely on a small set of vendors to operate Clams, covering hosting and infrastructure, authentication, payment processing, website analytics, email, and error logging. They may process data only to provide services to us, under appropriate contractual restrictions. Providers we use include Stripe (card payments), Plausible (privacy-focused website analytics), and Google and Apple (optional single sign-on). Enterprise customers can request our current subprocessor list.

How Long We Keep Data

• Account and authentication data: while your account or license is active, and for a reasonable period afterward.
• Billing and invoices: as required by applicable tax and accounting law.
• Error and diagnostic logs: a short period, around one week.
• Support and sales records: as long as needed to handle your request and for reasonable follow-up.
• Newsletter data: until you unsubscribe.
• Enterprise engagement data: as set out in your enterprise agreement, and deleted or returned on termination as described there.

Your Choices and Rights

You can access, correct, export, or delete much of your data directly in Clams, or by contacting us at hello@clams.tech. You can unsubscribe from the newsletter at any time using the link in any email.

Depending on where you live, you may have additional rights under laws such as the EU and UK GDPR or the California Consumer Privacy Act, including the right to know what data we hold, to request correction or deletion, and to opt out of the sale or sharing of personal information. We do not sell personal information or share it for cross-context behavioral advertising. To exercise any of these rights, contact us at hello@clams.tech and we will respond as required by applicable law.

Security

We take reasonable measures to protect the data we hold, including encryption in transit, careful handling of secrets and credentials, limiting who can access data, and keeping backups. We will notify you of a security incident affecting your data as required by law or your agreement. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We will notify affected customers of security incidents involving their data as required by applicable law, and for Enterprise customers as set out in the applicable agreement or data processing addendum.

Our Role: Controller and Processor

For account, billing, sales, support, website, and newsletter data, Clams acts as the data controller (or "business") and decides how and why that data is processed. For data we process on behalf of an Enterprise customer under an enterprise agreement or data processing addendum, the customer is the controller and Clams acts as a processor (or "service provider"), processing that data only on the customer's instructions and as set out in that agreement.

Enterprise and Managed Services

Where Clams provides implementation, integration, reporting, dashboard, or other enterprise services, Clams may access and process your data to deliver those services. That processing is governed by your separate enterprise agreement, including a data processing addendum where applicable.

Billing Information

When you purchase a license, we collect the information needed to bill you: name, email address, company name where applicable, and payment method.

Card payments are processed by Stripe. Clams never stores your card number. Stripe's handling of your payment data is described in the Stripe privacy policy.

Bitcoin Lightning payments involve no card data; we retain only the payment hash and amount.

Invoices and transaction records are retained as required by law. Billing information is never sold, shared, or used for advertising.

Links to Other Websites

Our website or services may contain links to third-party websites. We are not responsible for the privacy practices or content of these websites. Please review the privacy policies of third-party sites before providing any personal information.

Changes to This Privacy Policy

We may update this Privacy Policy periodically. The "Last Updated" date at the beginning of this policy indicates when it was last revised.

Contact Us

If you have any questions or concerns about this Privacy Policy, please contact us at hello@clams.tech.

This Privacy Policy explains how we collect, use, disclose, retain, and protect information. Your use of Clams is governed by our Terms of Use. Where consent is legally required, we will request it separately.