Privacy Policy

Account data: email address, username, and optional profile picture when you create an account.
Usage data: pages visited, features used, automation run counts, and community interactions.
Technical data: IP address, browser type, device information, and operating system.
Payment data: processed by Paddle; we receive subscription status but never your payment card details.

We use your data to: provide and improve the Service; process subscriptions; personalize your experience; communicate updates; prevent abuse; and comply with legal obligations.

We use essential cookies for authentication (Supabase session cookies). Product analytics and session replay (PostHog) and privacy-friendly page analytics (Plausible) are only used with your consent. See our Cookie Policy for details.

Supabase: authentication and database hosting (EU region).
Paddle: payment processing for premium subscriptions.
PostHog: product analytics and session replay (EU Cloud, eu.i.posthog.com), used only with your analytics consent.
Plausible: privacy-friendly, cookie-free web analytics (EU-hosted).
Vercel: web application hosting.

The Universal Clicker browser extension ("Universal Clicker — Record & Replay") is covered by this policy.

What it records: the extension captures what you do on a web page only while you have explicitly started a recording. During that recording session, your clicks, scrolls, and any text you type into the page are saved as automation steps. When you are not recording, the extension does not capture your activity.
Where recordings go: your recorded automations are stored in your own Universal Clicker account (Supabase). The only network requests the extension makes are authenticated requests to your own account data (your saved automations, stored in the user_automations table of your account). Your data is not sent anywhere else.
No analytics or tracking: the extension contains no analytics, tracking, or telemetry of any kind.
Sign-in: a session token is stored in your browser's extension storage (chrome.storage) so the extension can authenticate those requests to your account.
Replaying automations: when you run an automation, the extension attaches Chrome's debugger API to the tab the automation runs in, which is why Chrome shows a "started debugging this browser" banner. The extension detaches when the run ends.
Your automations stay yours: automations run locally in your browser, and nothing is shared with anyone unless you choose to publish a preset to the community.

Account data is retained while your account is active. After account deletion, personal data is removed within 30 days. Anonymized usage statistics may be retained indefinitely.

Under the General Data Protection Regulation, you have the right to:
• Access your personal data
• Rectify inaccurate data
• Delete your data ("right to be forgotten")
• Port your data to another service
• Object to processing
• Restrict processing
To exercise these rights, contact us at privacy@universalclicker.com. We will respond within 30 days.

Your data may be transferred to and processed in countries outside of Moldova and the EU. We ensure adequate safeguards are in place for such transfers.

The Service is not intended for children under 13. We do not knowingly collect data from children under 13.

We may update this policy from time to time. We will notify you of significant changes via email or an in-app notice.

For privacy inquiries, contact us at privacy@universalclicker.com.
Data Controller: Universal Clicker, Chisinau, Republic of Moldova.