Privacy

What Hindsight stores about you and your PC, and why. Last updated 30 October 2026.

Your clips

Clips are recorded and saved on your PC only. Hindsight never uploads clips, thumbnails, game audio or anything you record.

Your account

• Username and a password hash (scrypt with a secret key; we can't read your password).
• The invite you joined with, and your two-step sign-in key if you turn it on (stored encrypted).
• Sessions: when and from which IP address and browser or PC you're signed in, so you can see and end them.

Your PC

When you sign in to the app, Hindsight registers the PC so accounts and bans can't simply be moved to a new installation. To do that the app reads hardware identifiers:

• the firmware system UUID and motherboard and system serial numbers,
• the serial numbers of physical disks and the addresses of physical network adapters,
• the public part of the TPM security chip's endorsement key, Windows' installation ID and date,
• the processor and graphics card models, the Windows version and the app version.

Each identifier is hashed on your PC before it is sent, then hashed again on our server with a secret key. We never receive or store the raw serial numbers. The app also creates a sign-in key on your PC (in the TPM security chip when there is one) that never leaves it. To name your PC on your account page we use its processor and graphics model, not your computer's name.

We also check that the app hasn't been modified and note whether it runs in a virtual machine or under a debugger. These checks only add to a risk score that admins can review.

Why

To keep the platform private and secure: invite-only sign-up, protecting accounts from stolen passwords and tokens, and letting admins block a PC that abuses the service. This is a legitimate interest in security and preventing abuse; reading the identifiers is part of the service you sign in to.

How long

• Account data: until your account is deleted.
• Sessions: until they end, plus 90 days.
• PC data: 12 months after last use, unless the PC is banned.
• The audit log of sign-ins and admin actions: one year.

Who can see it

Only Hindsight's admins. Nothing is sold, shared or used for advertising. The website sets one cookie, which keeps you signed in. There is no tracking or analytics.

When you choose a password, its first five SHA-1 characters (not the password) are checked against the Have I Been Pwned breached-password list.

Your choices

You can see your sessions and PCs on your account page and sign any of them out. To get a copy of your data or have your account deleted, ask an admin.