How SpecIndex handles your data.

What we collect

• Account information. If you sign in, your email address and account identifier are managed by Firebase Authentication (Google). We do not receive or store your password -- Firebase handles authentication directly.
• Contact and demo requests. Name, email, company, and what you tell us about your product categories, if you request a demo or contact us. Stored in our own database and, if email notification is configured, forwarded to our team by email.
• Newsletter signup. Your email address, if you subscribe to The Spec Desk newsletter. This is sent to and managed by Brevo, our newsletter email delivery provider -- see Brevo's privacy policy. Every Brevo email includes an unsubscribe link; unsubscribing removes you from the list.
• Usage analytics. We use PostHog to understand how the site is used (pages viewed, features clicked), including session recording with all form inputs masked and capture of unhandled browser errors. When enabled in a build, we also use Microsoft Clarity for session recording and analytics on public pages only; Clarity is not loaded on the signed in app pages. We also capture UTM parameters and referrer information in your browser's local storage on your first visit, so we can tell which channel brought you here even if analytics scripts are blocked. Neither is used to identify you personally beyond what you've already told us (e.g. your account email, if signed in).
• Search behavior on Google. We review aggregate Google Search Console data (what search terms bring people to specindex.ai) -- this is Google's own aggregated data about search results, not information about you individually.

What we don't do

• We don't sell your personal information.
• We don't share your contact or account information with third parties except the service providers named on this page, each of which processes it only to provide that specific service.
• We don't use your data to train any AI model beyond the operation of the product features you're actively using.

Service providers

• Google Cloud and Firebase. We run SpecIndex on Google Cloud. Firebase Authentication manages sign in and Firebase Hosting serves this site. Cloud Run hosts our API, Cloud SQL holds our database, and Cloud Storage holds documents, including the public spec documents in our index and, in a separate bucket, the private files uploaded for Spec Check. We use Vertex AI, with Google's Gemini models, to classify documents and to answer questions in product features, so document text, extracted spec content, and the question and context for a request are sent to that service for processing. Transactional product email, such as set password and invite email, is sent through Gmail (Google Workspace), not through our newsletter provider.
• Brevo. Brevo manages subscriptions for The Spec Desk newsletter and delivers that newsletter, as described above. Brevo does not send our transactional product email.
• PostHog. PostHog provides usage analytics, session recording with all form inputs masked, and browser error capture, as described above.
• Microsoft Clarity. When enabled in a build, Clarity provides session recording and analytics on public pages only, as described above. It is not loaded on the signed in app pages.
• Mapbox. Mapbox provides map rendering for an internal, staff only map tool that plots projects. It is not a customer facing feature. A staff browser using that tool sends map tile and style requests to Mapbox, and project locations are shown on that internal map.
• Resend and Slack. We use Resend and Slack for internal operational alerting only, such as service heartbeat and pipeline failure alerts. Those alerts go to our own team, not to customers. Neither sends customer facing email or messages for SpecIndex.

Your choices

• Unsubscribe from the newsletter any time via the link in any email we send, or by emailing [email protected].
• Delete your account yourself in Account settings. Deleting your account deactivates it, revokes your live API keys, and signs you out. Deletion is a deactivation, not an erasure: your data isn't erased by that action, so email the address above for a full data deletion request.
• Ask what we hold about you by emailing the address above; we'll respond within a reasonable time.

Questions

Email [email protected] with any privacy question, and we'll get back to you directly rather than pointing you at a form.