← Sharkproofed

Privacy

Effective 6 September 2026 · Operated by AC0 AI SL

The short version

You record a pitch and answers on camera. Tape Scan and completed pitch replay use video stored locally in the app on your phone. A completed pitch remains available there for up to 90 days unless you delete it sooner. Saving copies the original local video directly to Photos; sharing with a score creates a separate branded copy on your phone. The app extracts temporary audio on your phone and uploads that audio to Cloudflare for analysis by Google Gemini. While the On camera notes setting is on (on by default, off in Account), the app also uploads a reduced copy of your pitch video, which Gemini reads once to write up to four timestamped notes about eye line, posture, hands and visible facial movement. Those notes are never part of your score. Sharkproofed never grades eye contact, posture, gestures, movement or facial expressions and never infers emotion, confidence or honesty from your face or body. The video copy is deleted after Gemini processes it. Answer video is never uploaded. Cloud backup of the full pitch video is a separate option in Account, off by default; only if you enable it is the pitch uploaded separately and kept in Cloudflare for up to 90 days. It is never AI input. Older installed beta builds may still use their previously disclosed storage contract. Claude receives bounded text for the score-v5 judgment, while OpenAI receives bounded text only when an older score-v4 judgment or Ask the Coach uses it. Neither receives your video, images or audio. If you explicitly start Live Coach, ElevenLabs receives your microphone audio and a bounded version of the priority from that verdict for one voice conversation of at most 90 seconds. ElevenLabs processes the live audio stream without storing the call audio and may retain its transcript for up to 30 days. Sharkproofed stores no live-call audio or transcript. Uploaded analysis audio is deleted after Gemini processes it and before the text-only final judgment or retry. Transcripts, scores, feedback and any written Coach question and answer remain in anonymous history until Delete everything. We never sell your data or use it for advertising.

What we collect

• Your recordings. Pitch and answer videos are recorded on your phone. Tape Scan plays the current take locally. A verified pitch moves from temporary cache into the app's local library; after a completed drill it remains available there for up to 90 days unless you delete it sooner. Save original copies that local file to Photos. Share with score creates a separate branded export locally. The app creates a temporary M4A audio copy on the phone, requests a signed, single-object URL valid for five minutes and uploads only that audio over an encrypted connection. The local M4A is deleted after upload. Gemini receives the extracted audio and, while On camera notes is on, a reduced copy of the pitch video (short side 480 pixels, roughly 6 MB for a 90-second pitch) uploaded the same way after the audio. That copy is read once for the on-camera notes and is never used for the score. Cloud backup is off by default. Only if you enable it is pitch video uploaded separately after analysis starts for replay; that copy is not sent to Gemini. Answer video is not uploaded. Older beta builds may finish already-started score-v4 sessions under the previous temporary video-analysis contract described above.
  
  Your uploaded analysis audio is deleted from our Cloudflare storage after Gemini processes it and before the separate text-only final judgment starts. Deletion is retried durably if storage is temporarily unavailable, with a storage lifecycle rule deleting anything missed within 24 hours. The audio is sent inline in the Gemini analysis request, so the audio analysis creates no Gemini Files API object. The on-camera video copy is deleted the same way after its pass finishes; it is passed to Gemini through the Files API and that file is deleted before the pass returns. Separately, Google may retain prompts, contextual information and generated output for up to 55 days for abuse monitoring; flagged material may be reviewed by authorized staff for policy enforcement.
  
  The panel's questions are read aloud by the provider pinned when the run starts: voice-v2 builds use ElevenLabs and older builds use Fish Audio. Both receive only question text written from your own pitch, never your video, images or audio. Turn Panel speaks off in the app and none of that happens for any run you start from then on: no question text is sent to either provider, and no voice clips are made. A run already in progress keeps the provider it started with. The ElevenLabs startup-grant workspace uses its standard history logging, not Enterprise Zero Retention, so ElevenLabs may retain the question text and generated audio under its standard privacy and moderation terms. The resulting Cloudflare clips are covered by the same 24-hour lifecycle rule described above, deleted immediately if you discard the run, and cleared as part of that same account-wide sweep, not that instant, if you use Delete everything. Deleting in Sharkproofed does not delete ElevenLabs' provider-side history.
  
  After Gemini finishes the audio analysis, we send only text needed for the final judgment to the Anthropic API, where Claude writes the score-v5 judgment. Gemini itself writes the round-one questions. Claude receives the pitch and answer transcripts, those questions, deterministic speech counts and selected typed Gemini audio observations, together with limited language, target, round, answer and timestamp metadata. Claude selects evidence-bound scorecard judgments and drills; our code calculates the visible point contributions and final total. No recording, image or audio is sent to Anthropic. An older installed build may still run its score-v4 judgment through the OpenAI API under the same text-only limits, with store: false and abuse-monitoring logs of up to 30 days. Before the final text call, the validated Gemini text result may be checkpointed in EU-hosted Convex for up to 15 minutes so a timeout can be retried without uploading the recording or rerunning the audio analysis. The checkpoint is never shown as a verdict and is deleted on success, terminal failure, discard or expiry. Anthropic does not use API data to train its models by default; abuse-monitoring logs may retain prompts and responses for up to 30 days.
  
  If you use Ask the Coach, you choose one of two fixed questions or type one written question of up to 240 characters about the existing priority. OpenAI receives that question, the pitch and answer transcripts, the panel questions, the existing priority, its permitted evidence and drill, plus the recording language. It must stay on that priority and cite only the allowed evidence. The request uses store: false. Sharkproofed stores one question and one answer with the completed run so you can reopen it. Keyboard dictation is handled by your operating system; Sharkproofed sends only the text that appears in the question field, not dictation audio.
  
  If you explicitly start Live Coach, the app first shows a separate microphone and retention disclosure. It then opens a private WebRTC voice connection to an ElevenLabs Conversational Agent through its standard global endpoint. ElevenLabs receives your live microphone audio and the verdict's one priority, permitted evidence, drill, existing practice line and recording language. It does not receive the full pitch or answer transcripts, video, images, your anonymous device ID or the rest of the verdict. The agent is limited to one 90-second drill, has no external tools and cannot change the score. ElevenLabs creates a live transcript to run the conversation, does not store the call audio after streaming and may retain the transcript for up to 30 days. The app keeps recent final conversation messages in memory to show your latest attempt and Coach feedback after the call; these disappear when you leave the screen and are not added to your saved run. Sharkproofed saves neither the live audio nor transcript. It stores only the provider conversation ID and whether the drill connected and ended, so it can enforce one completed drill per run and include the provider conversation in Delete everything. Leaving the screen, putting the app in the background or reaching 90 seconds ends the connection.
  
  When Cloud backup is on, your pitch is uploaded separately and kept for up to 90 days. It is never sent to Gemini. Open a run from Your progress to delete its local video and cloud copy, or use Your progress → Account to turn Cloud backup off and delete every cloud copy already kept. Turning backup off does not delete the local 90-day library. We do not manually review your Cloudflare copies.
• Your results. Transcripts, scores and feedback from completed runs are stored until you use Delete everything so the app can show your progress. During finalization, a validated text-only checkpoint may be stored for at most 15 minutes and is deleted on success, terminal failure, discard or expiry. They are keyed to a random app-generated device ID, not your Apple ID or a hardware identifier. If you choose a practice focus, the phone saves only a reference to its source run and fetches that owned result again after a restart. Starting fresh or using Delete everything clears the reference. This does not create another saved copy of the feedback or transcript.
• Your Coach question and answer. If Ask the Coach is available and you use it, the selected or typed question and the single evidence-bound answer are stored with that run until you use Delete everything. We do not send their contents to Sentry or use custom question text for product research.
• Your Live Coach lifecycle. Sharkproofed stores the ElevenLabs conversation ID and timestamps showing whether the optional drill connected and ended. It does not store the live call's audio or transcript. The ID remains with the run until Delete everything so provider-side deletion can be requested.
• Purchase and pass data. The TestFlight beta is free. In a paid build, Apple processes the payment and RevenueCat receives the app's random ID together with product, purchase, expiration and entitlement status so we can unlock time-limited access, restore purchases and show purchase history. The planned passes do not renew automatically. Sharkproofed and RevenueCat do not receive your payment-card or bank details from Apple.
• Other data. No account is required today. An optional display name stays on the phone and is not sent as a structured field. A recording or transcript can still contain any name, face, voice, company detail or other information that you choose to say or show. Do not record other people or submit confidential or sensitive information you do not have the right to share. We do not request contacts or precise location.

Why we process it

We process recordings, transcripts, results and pass status to provide the pitch-analysis, purchase and progress service you request (performance of our agreement with you). We process tightly limited diagnostics, security data and aggregated purchase analytics for our legitimate interests in keeping the service safe, working and commercially sustainable. We may retain information where required by law. The AI verdict is coaching only; it does not make a legal, employment, credit or similarly significant decision about you.

TestFlight beta

Apple distributes the iPhone beta through TestFlight and collects testing information such as installation and usage information, crash logs and feedback you submit. Apple shares relevant testing information with us so we can improve the app. When you join through a public link, your name and email address are not shown to us unless you choose to provide them, for example in feedback. See Apple’s TestFlight privacy information for details.

Website early-access list

If you join the email list on this website, we send your email address, subscription choice and the fact that you signed up on this page to Plunk, our email provider, to send beta invitations and launch updates. This is separate from the app's anonymous history. Plunk also keeps delivery and subscription records and receives technical request information, such as IP address and browser information, when you submit the form. We use your consent for these emails. You can withdraw it through an unsubscribe link in our emails or by writing to hi@ac0.ai, and you can ask us to delete your list entry. Unsubscribing may leave a limited suppression record so we do not subscribe you again accidentally. Plunk processes this information under its privacy policy.

Where your progress lives

Because the only thing identifying your progress is a random ID stored in the app, your history is tied to that install. Delete the app or move to a new phone and you start a new, empty history; we cannot reconnect you to the old rows after that ID is lost. Delete everything before uninstalling if you want the server history erased. A paid App Store purchase can be restored on another device, but that does not move the old pitch history. Sign in with Apple is not shipped yet.

Crash, error and performance reports

When something in the app breaks, such as a recording that will not start, an analysis that times out or a crash, the app sends an error report to Sentry so we can fix it. These reports carry a bounded reason code, duration, round, and device/app/OS metadata and are retained for no longer than 90 days. Beta and Store builds also send a 10% sample of the total time spent in four fixed technical stages: pitch-audio upload, answer-audio upload, round-one start and round-two start. The timings never include URLs, object keys, session IDs or recording contents. Sentry never receives video, transcript, verdict text, display name, Coach question, Coach answer, Live Coach audio, Live Coach transcript or any part of the pitch, and the app does not record your screen.

Who processes it

Nine processors support the app: Google (Gemini analysis of extracted audio and, while On camera notes is on, of the reduced pitch-video copy, plus temporary video analysis for older beta sessions under the previous score-v4 contract), Anthropic (the text-only score-v5 judgment), OpenAI (older text-only score-v4 judgments and, when used, one bounded Ask the Coach answer), Convex (EU-hosted application backend, completed results database and the temporary text checkpoint described above, aws-eu-west-1), Cloudflare R2 (EU-jurisdiction storage for extracted analysis audio, optional pitch-video backup, legacy temporary video and the panel's spoken questions), ElevenLabs (voice-v2 text-to-speech and, only when you start it, the optional Live Coach voice conversation), Fish Audio (text-to-speech for older builds), RevenueCat (the random app ID, purchase history, entitlement and pass-expiration status), and Sentry (bounded diagnostics). Anthropic and OpenAI receive no video, images or audio. For panel speech, ElevenLabs and Fish Audio receive question text only. For Live Coach, ElevenLabs receives the live audio and bounded priority data described above. These processors may handle data outside the EEA under their data-processing terms and transfer safeguards. Nothing is shared with advertisers or data brokers.

Deletion

The temporary M4A created on your phone is deleted after upload. Extracted analysis audio is deleted from Cloudflare after Gemini processes it and before the text-only final judgment or retry, with Cloudflare's 24-hour lifecycle rule as fallback. The reduced on-camera copy is deleted after its pass finishes, or when the run is discarded, with the same fallback. The validated text checkpoint is deleted within 15 minutes at the latest. ElevenLabs is configured not to store Live Coach audio after streaming and to retain its transcript for at most 30 days. A completed pitch video remains in the app's local library for up to 90 days and is removed when expired entries are pruned on launch or library access; uninstalling the app removes that local library. Optional Cloudflare pitch backups expire after 90 days. Answer video is not uploaded by current builds. To see videos available locally or in cloud backup and delete them individually or all at once, open Your progress → Account → Your recordings. Deleting a recording removes its local video and any cloud copy while leaving its score, transcript, written Coach answer and progress curve untouched. Turning Cloud backup off deletes cloud copies but leaves the local library until its normal expiry. Delete my account data erases the local library and starts deletion of sessions, verdicts, transcripts, Coach content, temporary checkpoints, known cloud objects and known Live Coach conversations for the current anonymous ID. Live Coach provider deletion is retried before its server ledger is removed. An already-issued upload link cannot be recalled before it expires, so final server cleanup may wait for that expiry and continue through durable retries. Delete everything does not erase Apple and RevenueCat records that must be retained for purchases, restore, accounting, fraud prevention or legal obligations. The planned passes do not renew and therefore need no cancellation.

Your rights

Depending on the circumstances, you can ask for access, correction, deletion, restriction, portability or object to processing. Email hi@ac0.ai. We may need information from the current install to verify which anonymous history is yours. You may also complain to the Spanish Data Protection Agency (AEPD) or your local supervisory authority.

Age

Sharkproofed is a professional pitch-training service for adults. You must be at least 18 to use it.

Changes

6 September 2026: added On camera notes, a default-on setting under which a reduced copy of the pitch video is uploaded after the audio and read once by Gemini for up to four timestamped, unscored notes about eye line, posture, hands and visible facial movement; the copy is deleted after the pass. Updated the Google processor line and the deletion section. Clarified TestFlight testing information and the separate website email list with its Plunk processor.

22 August 2026: added the optional 90-second Live Coach flow, its separate consent screen, ElevenLabs audio and transcript retention, and provider deletion through Delete everything.
13 August 2026: made completed pitch replay local-first for up to 90 days, made Cloud backup an explicit option that is off by default, and clarified direct original saving, on-device score sharing and local/cloud deletion behavior.
8 August 2026: moved AI analysis to audio extracted locally on the phone, added score v5 and clarified the conditional Ask the Coach flow.
5 August 2026: added the versioned ElevenLabs voice provider and its standard history behavior.
31 July 2026: named Fish Audio and clarified voice-clip storage and deletion.
30 July 2026: clarified legacy video-analysis retention and temporary text-checkpoint behavior. If this policy changes in a way that matters, we update the date above and note the change here before it takes effect.

Contact

AC0 AI SL · Avenida Pintor Joaquin Sorolla 77, 29016 Málaga, Spain · hi@ac0.ai