Security and privacy at Scuba
Scuba is the shared memory your team has been missing. You decide what’s worth capturing. You share what matters. It’s context from your team’s work, so we treat it seriously.
Our privacy principles
You decide what’s worth capturing.
Scuba only saves what you capture. Save a tab, share a file, record a voice note, or use a capture shortcut. For convenience, you can turn on auto-capture for selected websites. You can still cancel any capture and change those settings anytime. There’s no passive screen, mic, or webcam recording.
Captures are private by default.
No one else sees a Capture until you share it.
You share what matters with your team.
- Share Captures and Collections with individuals or your entire team.
- Collection editors can add and remove Captures. Viewers can only read.
- Only Captures and session responses can be shared outside Scuba, with a link you can always revoke.
Every AI response shows its sources.
Every response is deeply grounded in your Captures and your team’s, with interactive citations. Scuba uses AI providers to search, summarize, and draft from that context.
Your data is yours.
We never sell your data, and we only use it to run Scuba for you and your team. We don’t train models on customer data, and neither do our AI vendors. We use their APIs under no-training terms or account-level opt-outs.
When you sign up with Google, Scuba only asks for your email and profile. It doesn’t import your email, Drive, calendar, or anything else.
How we protect your context
We encrypt connections between your device and our servers. Your data is also encrypted at rest in our file storage and database. You sign in with Google, so Scuba never receives your Google password.
Our servers handle AI requests. Scuba’s apps and browser extensions send Captures to Scuba, which sends the relevant content to AI providers.
Security resources and questions
Latacora is our security partner, and our SOC 2 audit is underway. Visit our trust center to learn more about our security practices.
Have a question about security, privacy, or how Scuba handles your data? Email security@scuba.app. You can also send us your team’s requirements or security questionnaire. We’ll help you understand how Scuba fits your needs.
The Chrome extension uses open tabs and browsing history to suggest pages to capture and sites for auto-capture. Those suggestions are evaluated locally in your browser. Suggested pages are saved only when you capture them or enable auto-capture for that site.
Your Captures are private until you share them. Sharing a Capture or adding it to a shared Collection gives the recipients access. Public links are optional: anyone with an enabled public link can view its content. Collection permissions determine who can view, contribute, and manage access.
Yes. Scuba stores and processes Captures in the cloud to support search, summaries, sharing, and access across devices. Relevant content is sent to third-party AI providers to process your requests. All providers that process data on our behalf, including AI providers, are SOC 2 compliant. Our core infrastructure and primary storage are in the United States. Providers process data under their own terms and locations.
Deleted Captures immediately disappear from Scuba and shared views. They are removed from all backups by 30 days.
Raw audio from voice Captures is stored temporarily and automatically deleted from our storage after 28 days. The transcript remains with the Capture. Our transcription providers have separate retention terms.
We keep your saved content until you delete it. This includes Captures, Collections, Sessions, and anything else you can delete in the app. Deleted data is removed from all backups within 30 days. The same policy applies when you delete your account. We retain AI prompts and responses for debugging and quality evaluation only if you submit feedback on that specific response. Contact security@scuba.app about a specific retention requirement or removal request.
Google sign-in only gives Scuba your email and profile: your name, email address, and profile picture. Signing in does not grant access to your Gmail, Google Drive, or calendar contents. If you choose to capture a Google document or email through the browser extension, Scuba processes that content as a Capture.
Send your requirements or security questionnaire to security@scuba.app. We’ll explain which controls are available today and which are still being developed.
Email security@scuba.app with a description of the issue and steps to reproduce it. Please avoid including other people’s private data. We’ll follow up with you to investigate.