Privacy Policy

Last updated October 13, 2026

1. Scope and roles

This policy explains how Thirsty Beast LLC (“Dugout”, “we”, “us”) handles personal information when you use our websites, our web, desktop, and mobile apps, and related services (the “Services”). Terms used here have the meanings in our Terms of Service.

• Customer Content is the content in a workspace: messages, files, documents, boards, calls and transcripts, agent instructions and output, and the like. The organization that owns the workspace controls it, and we process it on that organization’s behalf and under its instructions. If you have questions about how your organization uses it, contact your workspace administrator.
• Other information is information about accounts, billing, usage, and devices, and information from our websites. We are responsible for it as described in this policy.

2. Information we collect

• Account information: your name, email address, password, profile photo, time zone, and language. If you sign in with Google, GitHub, Apple, or your organization’s single sign-on, we receive your name, email address, and profile image from that provider.
• Customer Content: what you and your workspace create, upload, or connect, including messages, files, documents, sheets, slides, boards, voice and video messages, call transcripts when a huddle saves one, call recordings where a workspace turns them on, repository content, and what agents read, produce, and do.
• Billing information: your plan, billing contact, and transaction history. Payment card details are entered on our payment processor’s checkout page; we do not store full card numbers.
• Usage and device information: IP address, browser, device and operating system, app version, notification tokens for your devices, the pages and features you use and when, and diagnostic logs.
• Call diagnostics: our call software sends connection and quality information, such as network type, device model, operating-system version, latency, audio interruptions, and video freezes, to our call infrastructure. These diagnostics can be associated with your call participant identifier, which identifies your account and workspace, and help operate and troubleshoot calls.
• Android background blur: the app uses Google ML Kit to separate you from your background on your device. ML Kit does not send the images it processes or the segmentation results to Google. It sends Google SDK usage and performance metrics, including device and app information, installation identifiers, feature events, latency, and error codes, for diagnostics, maintenance, usage analytics, and abuse prevention. Your call video is still transmitted through our call infrastructure when you enable your camera. See Google ML Kit’s privacy information.
• Camera, microphone, and screen sharing: when you choose to send a voice or video message, use audio or video in a call, or share your screen, the apps request the relevant device permission. The audio, video, or shared screen is sent to the people in that conversation through our call infrastructure, or uploaded as a message attachment. Call recordings and transcription capture, when enabled, are separate from the live call and can store audio, video, or transcripts. You can change device permissions in your operating system’s settings.
• Push notifications: we register device notification tokens with your account and workspace to deliver message alerts and incoming-call notifications. The push delivery service may receive conversation and sender identifiers and the notification’s title or message preview. On Android, Firebase Cloud Messaging and Firebase Installations send installation identifiers and technical app information to Google to operate push notifications. See Firebase’s privacy information. Device permission and Dugout’s notification preferences control which alerts appear on your device.
• Cookies and local storage: cookies that keep you signed in and protect your account, and Google Analytics cookies on dugout.so, including the web app, that tell us how the Services are used. We do not use cookies to show you ads. Our apps also keep some data on your device, such as a copy of recent messages, so they load quickly.
• What you send us: contact forms, support requests, feedback, and your email preferences. When you report content or a user, we receive the selected content or user identifiers, the reason you choose, and any details you provide. Authorized staff can access this information to review and respond to the report.
• Connected services: information from services you connect, such as GitHub or Google, as needed to make the connection work.

3. How we use information

• To provide and operate the Services, including running agents, transcribing and translating calls, and keeping your devices in sync.
• To secure the Services, prevent fraud and abuse, and enforce our Terms.
• To manage accounts and billing.
• To send service messages, security alerts, and support replies, and, if you opt in, product updates you can unsubscribe from at any time.
• To understand and improve the Services, using usage information and aggregated or de-identified data.
• To comply with the law and respond to lawful requests.

We do not use Customer Content to train our own AI models. We do not sell personal information or use it for targeted advertising.

Where the law requires a legal basis, such as in the European Economic Area and the United Kingdom, we rely on performing our contract with you or your organization, our legitimate interests in running and securing the Services, your consent (for example, to marketing emails), and our legal obligations.

4. AI processing

When you use agents, summaries, transcription, translation, image generation, or voice features, we send the content needed for that work to third-party AI providers, such as providers of language, image, speech, and voice models, which process it to return results. Each provider handles that content under its own terms, which vary by provider. When you connect your own API key or provider account, your agreement with that provider governs its processing.

Depending on the feature, that content can include the messages and conversation context an agent needs, files or repository content it reads, audio for speech processing, and text for translation or generated speech. Workspace configuration and the selected model determine which providers process it. Allowing microphone or camera access is a device permission; it does not itself explain a third-party AI provider’s processing.

5. How we share information

• In your workspace. Members see what workspace settings let them see. Workspace administrators control the workspace’s content and may access, export, or delete it.
• Service providers. Companies that help us run the Services, such as cloud hosting and storage, logging, AI and speech processing, sign-in, email delivery, push notifications, payment processing, and analytics. They may use the information only to provide services to us.
• Services you connect. When you or your workspace enable an integration, we exchange the information it needs.
• Legal and safety. When we believe it is needed to comply with the law or a lawful request, or to protect the rights, property, or safety of Dugout, our users, or others.
• Business transfers. As part of a merger, acquisition, financing, or sale of assets, subject to this policy.
• With your consent or at your direction.

6. Retention

We keep account information while your account is active, and afterwards as long as needed to provide the Services, meet legal obligations, resolve disputes, and enforce our agreements.

Customer Content is kept according to the workspace’s settings. Workspace administrators can set retention periods for messages and files; by default, content is kept until the workspace is deleted. A deleted message is hidden right away, and its content is removed permanently when the workspace’s retention settings expire it or the workspace is deleted. Some items, such as documents in trash and earlier versions of files, are removed automatically after about 30 days. When a workspace is deleted, we delete its content from our active systems within a reasonable period, except where the law requires us to keep it. Copies in backups and logs can persist for a limited time.

Temporary audio captured for transcription is handled separately from saved call recordings and transcripts. The transcription service removes temporary audio after re-transcription when no workspace audio-retention window is set, and sweeps expired captures. Saved recordings and transcripts remain Customer Content; deleting temporary transcription audio does not delete those saved items. Third-party providers may keep information according to their own terms and the agreements that apply to the selected service.

7. Security

We use technical and organizational measures designed to protect information, including encryption in transit, encryption of stored credentials such as API keys, and access controls. No method of transmission or storage is completely secure, so we cannot guarantee the security of information. Tell us through our contact page if you believe your account has been compromised.

8. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. You can delete your account yourself, in the Dugout app or on the web: it is locked right away and deleted with your personal data 30 days later, while content you posted in workspaces shared with others stays, shown as from a deleted user. How to delete your account explains the steps and what is kept. To make any other request, contact us. For Customer Content, send your request to your workspace administrator, who controls it; we will help them respond. We will not discriminate against you for exercising your rights. If you are in the European Economic Area or the United Kingdom, you can also complain to your local data protection authority.

You can unsubscribe from marketing emails using the link in them. You can block cookies in your browser, but you will not be able to sign in without them.

You can also manage camera, microphone, and notification permissions in your device’s settings. Turning off a permission limits the features that need it; it does not remove content you already sent or uploaded.

9. International transfers

We and our service providers process information in the United States and other countries, which may have different data protection laws than where you live. Where the law requires, we use appropriate safeguards for these transfers, such as standard contractual clauses.

10. Children

The Services are not directed to children, and we do not knowingly collect personal information from anyone under 16. If we learn that we have, we will delete it.

11. Changes to this policy

We may update this policy. We will change the date at the top when we do, and for material changes we will notify you by email or in the Services before they take effect.

12. Contact

Thirsty Beast LLC is responsible for the information this policy describes. Send questions and requests through our contact page, or by mail to Thirsty Beast LLC, 30N Gould Street, #47580, Sheridan, WY 82801.