Clapwave helps people rally friends and colleagues behind their social media posts. This page explains what we collect, why, who can see it, and how to have it deleted. We keep it short and specific to what the product actually does.
Who we are
Clapwave is operated by Your name or company name, Your business address, city, country. Contact us at hello@clapwave.com for any question or request about your data.
What we collect
- If you create campaigns: your email address (to sign you in), the campaigns you create, and your brand (logo and colour) if you set one. The company shown on your pages is always the domain of your work email, never a name you type. If you sign in with a work email, your campaign links include its domain (for example clapwave.com/c/northwind.io/…), so people can see which company a campaign comes from. If you subscribe to Pro, your subscription status. Payments are handled by Stripe, and we never see your card number.
- If you join a campaign: the name you enter, which steps you open and mark as done, and when. That's all until you choose to save your points: then we email you a 6-digit code to confirm your email is yours, and keep it with your progress. Confirming it creates a free Clapwave account for that email, so you can see the campaigns you joined. It only opens with a code or link sent to that email, so nobody else can get in.
- Supporters: when you save your points on a campaign (or join one while signed in), your name and email go on that host's list of supporters, so they can email you an invite through Clapwave when they have a new post. Joining with just a name adds nothing. Hosts can also add people who agreed to hear from them. Every invite has links to stop invites from that host, or from everyone on Clapwave, and a stop stays a stop.
- Referrals: if you create your account from someone's campaign, we note whose it was, so you both get a free month of Pro if you start your own.
- If you try Clapwave on the home page: which steps of the “try it” box your browser reached (saw it, pasted a post, asked for a code, confirmed, shared), counted the same cookie-free way. We use the totals to improve the page and delete them after 90 days.
- If you join the Team waitlist: your email. We first send you a link to confirm it; only confirmed emails get the single email when Team launches. Unconfirmed ones are deleted a week later.
- If you open a campaign link: we count you once a day as a visitor, without any cookie: we keep a one-way code made from your IP address, your browser and a random value that changes every day and is then deleted, so the code can't be linked across days or back to you. We also note the name of the site that sent you there (like LinkedIn or Slack), never the full address. Owners only see totals.
- Security data: to block abuse (rate limiting), we count requests per IP address. We only store a one-way code of it, never the address itself, and delete the counts within two days. Our hosting provider keeps short-lived server logs.
We don't use advertising trackers or third-party analytics, and we never sell your data. Clapwave can't see your social media accounts: you like, comment and share on the networks themselves.
How we use it
- To run campaigns: show your steps, progress, points and the leaderboard.
- To let the campaign owner see who joined and what they did.
- To show you the campaigns you created and joined when you sign in.
- To email you sign-in codes and links when you ask for one.
- To email campaign owners a daily summary (only on days with activity), people who joined a campaign but haven't finished it a reminder when the host asks (at most one every 3 days), and people on a host's list of supporters an invite when the host asks (once per campaign). Every one of these emails has a link to turn them off.
- To keep the service secure and prevent abuse.
We rely on providing the service you asked for (contract) and on our legitimate interest in keeping it secure.
Who can see it
- The campaign owner sees the names, emails (once saved) and activity of the people who join their campaign, and the names and emails of their supporters. For that data, the owner decides why it's collected and Clapwave processes it on their behalf.
- Other participants see names (possibly shortened, like “Sarah C.”) and points on the leaderboard, if the owner turned it on. Never emails.
- Our service providers, only to run Clapwave: Railway (hosting and database), Resend (sign-in codes, notifications and invites) and Stripe (payments, only if you subscribe). Some of them may process data outside your country, under the safeguards required by law, such as standard contractual clauses.
How long we keep it
- Campaign and participant data is kept while the campaign exists. Deleting a campaign deletes its participants and their activity.
- Deleting your account deletes the campaigns you created (with their participants' data and your list of supporters), removes you from campaigns you joined and from other hosts' lists of supporters, and removes you from the Team waitlist. If you asked for no invites from anyone, we keep just that email and that request, so it keeps being honoured.
- A host's list of supporters is kept until the host removes someone, or deletes their account.
- Sign-in links and codes expire after 15 minutes and are deleted within a day; records of wrong codes after two days. Sign-in sessions end after 30 days. The home page's “try it” counts are deleted after 90 days.
Cookies
We only use our own cookies, and only the ones the service needs to work. No advertising, analytics or third-party cookies, and visitors are counted without cookies:
- cw_session: keeps campaign owners signed in (30 days).
- cw_p_…: remembers your progress on a campaign you joined, on this device (12 months).
Your rights
You can ask to access, correct, export or delete your data, or object to its use. Email hello@clapwave.com. If you joined a campaign, you can also ask its owner to remove you. You can delete your account yourself: sign in and use “Delete account” at the bottom of your dashboard. You can also complain to your data protection authority (in France, the CNIL).
Changes
If we change this policy, we'll update this page and the date at the top.