Summary
This draft describes the current implementation. The owner must review legal bases, tax and refund terms, retention periods, contact details and provider practices before release.
- You can browse the catalog without an account.
- We don't use advertising or analytics trackers.
- We don't sell personal data.
Account data
If you create an account, Supabase Auth stores your email address and a hashed password. If you sign in with Google, we receive the basic profile Google shares (name, email address, and profile picture). We use this to sign you in and to contact you about your account.
API and site usage
API keys are stored as hashes with a display prefix and management metadata; the complete key is shown once when created. Durable usage records contain an admission identifier, account/key references, timestamp, bounded route class, method, plan, billing mode and charged cents. History starts when usage history is activated; earlier request details are not reconstructed.
Our hosting providers process standard request data, such as IP address, user agent, and requested URL, in their logs to deliver and protect the service. Application diagnostics use bounded operation, status and error codes rather than raw request bodies, credentials or account identifiers. Provider log retention and access settings require separate review. Public browsing controls keep pseudonymous, purpose-separated hashes of network addresses, signed browser sessions, freshly verified account identifiers when signed in, and requested device slugs. They store request, verification-attempt and distinct-device counters. Raw addresses, cookies and verification tokens are not stored in these counters. IPv6 addresses are grouped by network prefix, so people sharing a network can share limits. Browsing state becomes eligible for cleanup after two full UTC days of inactivity; cleanup happens in bounded batches during later allowed requests, so this is not a guaranteed deletion deadline. Older website-only counters need separate owner cleanup. Customer API usage and financial records have separate retention rules.
Cookies and browser storage
We use only the cookies and browser storage below, all needed for the site to work.
| Name | Type | Purpose |
|---|---|---|
| __Host-sp_browse_session | Cookie | Signed, HttpOnly browsing session lasting seven days, used to enforce public browsing limits. Production uses Secure and host-only scope. |
| __Host-sp_browse_clearance | Cookie | Signed, HttpOnly verification clearance lasting 15 minutes, bound to the browsing session and network identity. Verification does not reset limits. |
| sb-…-auth-token | Cookie | Keeps you signed in (set by Supabase Auth). Only present after you sign in. |
| specspool:recent-devices | localStorage | Your last five searched devices, shown in the search box. Search terms and requested device slugs are sent when you search or open a device. |
| specspool:compare-devices | localStorage | Devices selected for comparison. The selected device slugs are sent to load the comparison and can appear in a shared comparison link. |
You can clear these at any time in your browser settings.
Service providers
We rely on these providers to run the service:
- Supabase: authentication and the catalog database.
- Cloudflare: runs the catalog API.
- Vercel: hosts the website.
Stripe handles hosted card checkout. We store server-owned checkout references, payment verification evidence, signed credit balances, ledger adjustments and refund/dispute review state. We do not store full card numbers. The security challenge uses Cloudflare Turnstile: Supabase Auth verifies account challenges, and our website verifies public browsing challenges directly with Cloudflare. The challenge provider processes browser and network signals for abuse prevention; provider configuration and privacy practices must be reviewed before release.
Your choices
You can ask us for a copy of your account data, or ask us to correct or delete it, by emailing hello@specspool.com. Account deletion does not erase all usage or billing evidence. Account/key relationships can be detached while pseudonymous admissions, tracked totals, credit balances and payment/reconciliation evidence remain recorded. Deletion does not automatically refund unused credit or settle debt. Retention periods and lawful deletion handling still require owner and legal review.
Changes
We'll update this page and the date at the top when our practices change. See also our terms of service.