Useful context.
Deliberate boundaries.

OUR RESPONSIBILITY

Sup and its operator.

Sup is operated by Carmy Labs Inc, a California corporation, at 2108 N Street, Ste N, Sacramento, CA 95816. Christopher Carmichael is its authorized representative. This policy is effective September 30, 2026. Our privacy and support contact is chris@carmylabs.com; the email link is in the footer.

The workspace is for app owners and people they authorize to review project feedback. A connected host app remains responsible for its own audience, permissions, and recording disclosures, including any required authority for information about children or other people. Sup sign-in is separate from a host app’s customer account.

01 / JUST LOOKING AROUND

Visiting the website.

The public marketing site does not use advertising trackers or third-party font services. Opening it does not start microphone capture or fill a workspace with sample feedback.

The recorder is a separate visible control. Recording requires an approved identity and an explicit start action. If you choose to record, the collection described below applies. This website does not enable optional browser screenshots.

The private workspace uses a necessary HttpOnly session cookie for owner authentication. The service also processes request information such as IP address to operate the site, enforce request limits, and protect accounts.

02 / YOUR ACCOUNT

Signing in to Sup.

Email sign-in uses your email address and a short-lived verification code. When configured, Resend delivers the verification email. If Apple sign-in is configured, Apple verifies your identity and may share the name and email address you authorize, including a private relay address. Apple sign-in loads Apple’s authentication script when you choose that option.

Your verified sign-in identity is associated with your Sup owner account, not with the customer account in each host app. Available sign-in methods are shown by the service; a method is not treated as working before it is configured. Existing workspace username sign-in remains available during migration.

We store Apple’s stable account identifier and encrypted server-side refresh tokens to maintain the sign-in connection. The service periodically validates that connection, scheduled approximately once a day, and revokes affected Apple-origin sessions when Apple confirms the grant was revoked. Apple tokens are not given to host SDKs or placed in URLs. Account deletion queues Apple-token revocation separately.

Account and session records support authentication and access controls. Email codes expire after ten minutes and are single-use. Expired sign-in challenges and completed delivery payloads are cleaned up by the service worker. Native Sup sessions use protected device credential storage; the browser workspace uses an HttpOnly cookie.

Earlier access requests, if retained, contain a submitted name, email address, app or team name, and optional platform. They are kept in the designated owner inbox for up to 90 days unless deleted sooner; they are separate from an owner account and do not create one automatically.

03 / WHEN YOU CHOOSE TO RECORD

What a feedback session includes.

Depending on the integration, a session can include microphone audio, a timed transcript, app-supplied screen and sheet names, annotated control identities and safe labels, tap locations and bounds, scroll events, explicit state changes, and sanitized diagnostics. App build, device, and network conditions may also be included.

The app developer chooses semantic annotations. The SDK is not intended to read arbitrary form values or infer which account is signed in. Developers must keep personal information and secrets out of annotations and breadcrumbs.

Recording has a visible status and can be paused or stopped. Leaving or locking the app pauses capture. A return to the app never silently restarts the microphone. A compatible iOS camera can share its live audio stream with sup so feedback continues while the camera is open; other integrations can record an explicit gap instead.

Audio can include anything you say or sounds around you while capture is active. Avoid recording information you do not want to share with your workspace.

04 / OPTIONAL VISUAL CONTEXT

Screenshots depend on your host’s settings.

The iOS and browser recorders keep screenshots off by default. When explicitly enabled, they can capture still images at useful moments. They do not record screen video.

Marked private views and text entry fields are masked before encoding. Developers must mark app-specific sensitive content and protect private or system interfaces. Other visible content may still appear in a screenshot; masking is not a guarantee that every possible piece of personal information has been removed.

The opt-in browser renderer captures the app viewport, not browser chrome or other tabs. Inaccessible embedded content and protected external media may not appear. Capture failures are reported rather than silently presented as complete evidence.

05 / WHERE THE EVIDENCE GOES

Private storage. Live transcription.

Audio segments and events are written locally while recording, then uploaded to the Sup service over an encrypted connection. The website and service run on Railway with database records and private object storage. Service credentials, including the Soniox API key, remain on the server.

Soniox processes the audio for speech transcription. Sup stores audio, transcript updates, and synchronized context in the workspace. The Soniox connection can continue processing audio already received when a phone disconnects. OpenAI processes enabled support conversations and app guidance, including indexed support documents, to produce answers. These providers receive content for their respective service functions, not to publish it as a customer testimonial.

Unsynced evidence can remain in app or browser storage for recovery. After a durable server acknowledgement, uploaded local payloads can be removed. Device storage availability and browser cleanup behavior affect what remains recoverable.

Voice sessions and earlier voice-companion conversations expire after 30 days. Current written feedback and text conversations remain until deleted. Published support guides remain until removed by their workspace owner or account deletion. Whole-session deletion is available sooner and revokes access to that session’s media through the service; background cleanup removes stored payloads.

Provider cleanup is separate from deleting active Sup records and may be delayed or retried. We do not promise immediate removal from provider-controlled backups or security records, or a fixed backup lifetime that has not been verified. Providers’ applicable policies and legal requirements govern those copies. Ask us for current retention details if you need them for a specific use.

Hosting and service providers may process information outside your country. Provider terms and configured services govern that processing; this policy does not claim that all data remains in a particular country. Access controls, encrypted transport, and server-side protection of credentials reduce risk, but no service can guarantee complete security.

06 / WHO CAN REVIEW IT

Your workspace controls access.

Workspace owners register apps, approve or enroll recording devices, and can revoke credentials. A public app identifier is not a recording or review credential. Signing in to Sup does not bypass authentication in a connected host app.

The private workspace and API require authenticated access scoped to that workspace. Media URLs are signed and expire, and also require a valid workspace-scoped session or authorized bearer credential. Possessing an expiring URL alone does not grant access to a recording or screenshot.

Owners can create and revoke workspace-scoped reader credentials for Codex. Existing tools read recordings and voice-companion conversations and search that evidence. A companion skill describes how to inspect it; it does not itself grant access. Sending evidence to Codex makes it available in the conversation where you request it, under the terms of your Codex account.

Owners can delete individual recordings or saved feedback, export account data, and request account deletion from Account. Account deletion requires recent sign-in, revokes connected credentials, and removes saved customer text. Provider cleanup is queued separately. Reviewing feedback does not automatically authorize coding, app changes, or a release.

07 / PRACTICAL LIMITS

Context, not certainty.

A crash can lose the last fraction of audio that has not been committed. Transcription can be wrong or arrive late. Timestamps show which events happened around speech; they do not prove what the speaker intended. Untagged controls remain unidentified.

Physical-device crash recovery, microphone handoffs, gesture behavior, and screenshot masking require acceptance testing. Developers are responsible for checking their own app screens and providing accurate recording disclosures.

This overview describes current product behavior. Material changes to collection or access require updated documentation and appropriate choices.

YOUR PRIVACY CHOICES

Make a request without sharing private evidence.

Depending on applicable law, you may have rights to access, correct, delete, or receive a copy of your personal information, or to object to or restrict particular processing. Contact chris@carmylabs.com with the subject “Sup privacy request.” We may ask for information needed to verify your identity and authority, but do not send a password, verification code, private recording, or API secret.

Owners can initiate account deletion from Account after a recent sign-in. The account export contains current project and text data; original voice recordings are reviewed separately from their recording page. If your submission belongs to another app owner’s workspace, identify the host app so we can help route your request. See support for the exact export and deletion steps.

You can stop recording and change microphone permissions in device or browser settings. Notification permissions can be changed in system settings. These actions do not delete submissions already uploaded. Support correspondence includes information you choose to send us; keep it limited to what is needed to resolve the request. Where applicable, you may also raise a privacy concern with your local data-protection authority.