Not ready to publish. The bracketed details below are placeholders in App\Legal. Fill them in and have this reviewed before launch.

Privacy Policy

Last updated August 3, 2026

This explains what Spandrel collects, why, and who else sees it. It is written to be read rather than skimmed past, and everything in it describes how the product actually works today.

Two different relationships

Spandrel does two separate things with personal data, and which one applies to you changes what this page means.

• If you have a Spandrel account: you build and host websites here. We decide how your account data is handled, and this policy governs it.
• If you visited a website built with Spandrel: we host that site for its owner and act on their instructions. Their own privacy notice, at /privacy on their domain, describes what that site collects. Contact the site's owner first; if you can't reach them, contact us and we will help.

What we collect from account holders

• Account details: your name, email address, and a hashed password. Passwords are never stored in a readable form.
• Sign-in security: failed sign-in attempts and lockout times, so an account can't be guessed into. If you turn on SMS two-factor, the phone number you give us.
• Workspace details: your organization name, billing email, and the postal address required in marketing email footers by anti-spam law.
• Billing: your Stripe customer and subscription identifiers, your plan, and its status. Card numbers never reach our servers; Stripe collects and holds them.
• Everything you build: pages, images, files, products, orders, member accounts on your sites, and email lists you upload.
• Usage records: a record of each build request and what it cost, so we can show you your credit balance and bill fairly.
• Support records: an activity log of significant account actions, and anything you send us through the editor's issue reporter, which includes a copy of the page you were working on.
• Domain registration details: if you register a domain through us, the registrant contact details the registry requires.

Website content and generation

Building or editing a page sends your instructions and the relevant parts of that site's content to Anthropic, which runs the model that writes it. That is the core of how the product works and cannot be switched off while using it. If you dictate instead of typing, the audio is sent to Groq to be transcribed.

Do not put anything into a page or a prompt that you would not want processed by those providers. Payment card numbers, government identifiers, and health records have no place in a website's source content.

Data from visitors to your websites

Sites hosted here collect some visitor data by default, and we process it on the site owner's behalf. Each site's own notice sets this out in full; in summary it can include page visits (counted without cookies and without storing an IP address), form submissions along with the sender's IP address and browser, orders, and member accounts. Site owners can export or delete this data from their account at any time.

Who else is involved

We use other companies to run parts of the service. They are only permitted to use the data to provide their service to us.

We do not sell personal data, and we do not share it for advertising.

Domains and public records

Registering a domain means giving the registry the contact details ICANN requires, and some of those details can appear in public WHOIS records. Registrations through us have WHOIS privacy applied where the registry allows it, which substitutes a proxy for your personal contact details. Some registries publish regardless, and transferring a domain away can require the real details to be exposed.

Cookies

This marketing site sets no cookies. It does load an icon script from unpkg.com, which means your browser contacts that host and it sees your IP address.

Signing in to the app sets a session cookie, and "stay signed in" sets a second one. Both are strictly necessary to keep you signed in, both are limited to the app's own address, and neither is used for tracking or advertising. Websites hosted here handle their own cookies; each site's notice covers them.

How long we keep things

• Your account and content: for as long as your account is open.
• After you cancel: sites stop being served, and content is deleted once the reclaim window described in the terms has passed.
• Visitor statistics on hosted sites: about 13 months, then removed automatically.
• Billing records: kept as long as tax and accounting rules require, which outlasts the account.

Security

Passwords are hashed, traffic is encrypted in transit, and access to production data is limited to the people who need it for support. No service can promise perfect security, and we would rather say that plainly than imply otherwise.

Your rights

Depending on where you live you may have the right to see the personal data we hold about you, correct it, delete it, or receive a copy. Email privacy@spandrel.build and we will respond. If your request concerns data held by a site built here rather than by us, we will pass it to that site's owner, who decides what happens to it.

Children

Spandrel is a business tool and is not intended for children under 13. We do not knowingly collect their personal data.

Changes

If this policy changes in a way that materially affects you, we will email account holders before it takes effect. The date at the top always reflects the current version.

Contact

[REGISTERED ENTITY NAME], trading as Spandrel, [REGISTERED BUSINESS ADDRESS].
Privacy inquiries: privacy@spandrel.build

See also the terms of service.