Spectr ("Spectr", "we", "us", or "our") is a product of Crowdlinker Inc., a company incorporated in Ontario, Canada. This Privacy Policy explains how we collect, use, store, and share information about you when you use Spectr's services, including our web application at app.spectr.pm and marketing website at spectr.pm (collectively, the "Service").

By using the Service, you agree to this Privacy Policy. If you do not agree, please discontinue use of the Service.

---

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

Name and email address
Password (stored as a bcrypt hash - never in plain text)
Workspace name and optional profile details
Billing information (processed and stored by Polar.sh - we receive subscription status events, not raw payment card data)

1.2 Meeting Transcripts

Spectr's core function is processing meeting transcripts to extract actionable engineering work. We collect:

Uploaded transcripts: text, PDF, DOCX, or TXT files you upload directly
Imported transcripts and notes: meeting transcripts and notes you import from Fathom, Granola, Read.ai, or Fireflies via their APIs when you connect those accounts

Transcripts are stored in encrypted AWS S3 buckets. You can delete any transcript at any time from within the app, which permanently removes it from our storage.

1.3 Integration Credentials

To connect third-party tools (Linear, Notion, GitHub, Google, Figma, Jira, and Read.ai via OAuth; Shortcut, Fathom, Granola, Fireflies, Harvest, Forecast, PostHog, and Sentry via API keys or access tokens), we store the OAuth access and refresh tokens or API keys you provide on your behalf. These credentials are:

Encrypted at rest using AES-256 encryption before database storage
Never returned to the client in API responses - they are read server-side only, on a query-by-query basis
Revocable at any time from the Integrations settings page

1.4 AI-Generated Content

Specs, user stories, and AI memory files generated by the Service are stored in our database and S3. These are owned by you and can be deleted at any time.

1.5 Product Health Data

If you connect PostHog or Sentry to a project, we periodically read a read-only summary of that project's product signals and cache it so we can display it in Spectr. Specifically:

Errors: error group titles and messages, the code path the error occurred in, first- and last-seen timestamps, occurrence counts, and a count of distinct affected users
User feedback (PostHog surveys): the response text and the survey's name and date
Feature rollouts (PostHog feature flags): the flag's name, key, active state, and rollout percentage

We do not request or store any person-level records from these providers. Affected-user figures are counts, never lists - no person record, user id, email address, session, IP address, page URL, stack frame, or event payload is read or stored. Spectr never writes anything back to PostHog or Sentry.

We do store the free text those providers return - error messages, code paths, and survey responses. A survey response is written by one of your own users, so it can contain whatever they chose to type. Before storage we pass this text through an identifier-scrubbing step that removes email addresses, UUIDs, long runs of digits, and API-key-shaped tokens, and we discard any response that scrubs down to nothing. This is best-effort minimisation, not a guarantee: it is pattern-based, so it will not catch a person's name, a postal address, a short account number, or a phone number written with separators. If your surveys invite users to share personal details, please account for that - what reaches us is determined by what you collect in PostHog.

This cached summary is deleted when you disconnect the integration from the project, or when the project is deleted.

1.6 Usage Data

We collect standard server logs (IP address, browser type, pages visited, timestamps) to operate and improve the Service. We may also collect anonymised product analytics (feature usage, error rates) using self-hosted tooling.

1.7 Advertising Measurement

We advertise Spectr on X (Twitter) and LinkedIn. When you arrive at our marketing site from one of those ads, the platform appends a click identifier to the link (twclid for X, li_fat_id for LinkedIn). We store that identifier in a first-party cookie on spectr.pm and carry it through to our signup page, so we can tell the platform that its ad led to a signup.

When you complete an action we measure - reaching the signup page, or creating an account - we send the following to the advertising platform from our servers:

The click identifier described above
For a completed signup, your email address hashed with SHA-256. The hash is computed on our servers; your email address itself is never sent to the advertising platform, and the hash is not stored by us
The name of the action, when it happened, and the page it happened on (address and path only - never the query string)

We do not send your IP address, browser user agent, name, or any other identifier to these platforms, and we do not send anything at all for visitors who did not arrive from one of our ads.

We keep a record of which conversions we have already reported - the click identifier, the action, and whether the report succeeded - for 90 days, so that the same action is never counted twice. Nothing in that record identifies you by name or email address.

---

2. How We Use Your Information

Providing the Service: Processing transcripts, generating specs and stories, publishing to your project management tool
AI processing: Transcripts and project context are processed by Spectr's AI to generate structured output. See Section 4 for details
Account management: Authentication, subscription management, billing
Customer support: Responding to questions, diagnosing issues
Service improvement: Aggregated, anonymised usage analysis to improve features
Legal compliance: Responding to lawful requests from authorities where required

---

3. Data Storage and Security

All data is stored on AWS infrastructure in the us-east-2 region (Ohio, USA)
Data in transit is encrypted with TLS 1.2+
OAuth tokens are encrypted at rest with AES-256 before being written to the database
Meeting transcripts are stored in S3 with server-side encryption (SSE-S3)
Database backups are retained for 7 days
Access to production systems is restricted to authorised Crowdlinker engineering personnel

---

4. AI Processing

Spectr uses AI to process your meeting transcripts and generate specs and user stories. All AI processing runs within secure AWS infrastructure - your data is not exposed to third parties for AI processing and is not used to train any AI models.

What is processed by AI:

Meeting transcript text (up to 60,000 characters per processing job)
Your project description, preferences, and reference files (up to 20,000 characters)
Integration context (Notion pages, GitHub context, etc.) you have connected
The product health summary described in Section 1.5, where PostHog or Sentry is connected - the aggregate figures, and alongside them the scrubbed free text: error titles and messages, feature flag names and keys, and survey responses quoted with their survey name and date. Each block is labelled with its provider and the date it was read
AI memory files from previous sessions (contextual project knowledge you have built up)

What is NOT processed by AI:

Your password or authentication credentials
OAuth access tokens for third-party integrations
Payment information

---

5. Data Sharing and Third Parties

We do not sell your personal data. We share data only as necessary to operate the Service:

AWS: Infrastructure hosting (compute, database, storage, AI inference - all within AWS infrastructure)
Polar.sh: Subscription billing - they process your payment information under their own privacy policy
Fathom, Granola, Read.ai, and Fireflies (if connected): Meeting transcript and notes import only - we read your transcripts and notes via their APIs, scoped to your account
Third-party integrations you connect (Linear, Shortcut, Notion, GitHub, Google, Figma, Forecast): We read context from and/or write data to these services on your behalf, using the OAuth tokens or API keys you authorise
Atlassian / Jira (if connected): We read and write issues and read your Jira project's assignable-user list so we can publish and keep stories in sync on your behalf. Because Jira user records include personal data (names, email addresses, and Atlassian account IDs), we store only the minimum needed to link and sync assignees, and - as Atlassian's developer policy requires - we report the inventory of Atlassian accounts whose data we hold back to Atlassian through their Personal Data Reporting API. When you disconnect Jira from a project, we erase that stored Atlassian personal data
Harvest (if connected): Project budget and time data - we read your budget and spend figures via their API, scoped to your account
PostHog and Sentry (if connected): Read-only product health data - we read the error, feedback, and feature-flag summary described in Section 1.5 via their APIs, scoped to the projects you select. We never write to these services, and we do not request any person-level records from them
X Corp. and LinkedIn (Microsoft): Advertising measurement. If you reached us through one of our ads, we report that conversion to the platform as described in Section 1.7 - the click identifier the platform itself issued, and for a completed signup a SHA-256 hash of your email address. Under some privacy laws this counts as "sharing" personal information for cross-context behavioural advertising; see Section 8 for how to opt out
Google (Tag Manager): Our marketing site loads Google Tag Manager, which we use to manage measurement tags. Google receives the standard information any embedded script receives, including your IP address

---

6. Cookies

Cookie	Purpose	Duration	Type
`pm_authenticated`	Client-side indicator that a session exists, used to show "Go to App" on the marketing site	7 days	Functional
Auth tokens (localStorage)	JWT access and refresh tokens for authenticated API requests	Session / 30 days	Strictly necessary
`pm_attribution`	Stores the advertising click identifier from an ad you clicked, so a resulting signup can be attributed to that ad (Section 1.7)	90 days	Advertising
`pm_consent`	Records your choice in our cookie notice, so we do not ask again and can honour a decline on later visits	180 days	Strictly necessary
`pm_reactions` (localStorage)	A random identifier, created only if you react to a blog post or What's New entry, plus which reactions you picked - so the buttons show as pressed when you come back and one reaction per person is counted once. We store no name, email address, account or IP address against a reaction	On your device until you clear it; on our servers, kept with the reaction (see below)	Strictly necessary

Reactions are not advertising and are not covered by the cookie notice. The identifier above is created only when you actually react, is used for nothing else, and is never shared. Because it carries no advertising purpose, declining in the cookie notice does not switch reactions off - they keep working normally either way.

What happens to the reaction identifier on our side. When you react, that random identifier is sent to us and stored alongside the reaction, so that the same reaction from the same browser is only counted once. It is kept for as long as the reaction is - we do not expire it, because deleting it would let the same browser be counted again and quietly inflate the totals. It is never connected to an account, an email address or an IP address, and we do not log it.

The consequence is worth stating plainly: we have no way to work out whose reactions are whose. That is deliberate, and it means we cannot action an access or deletion request for them - there is nothing we could look you up by, and we are not required to start collecting extra information just so that we could. You can remove the identifier from your own device at any time by clearing site data for this site; any reactions you already sent remain as anonymous totals that are no longer attached to anything, including to you.

We do not sell cookie data to third parties. We do use the advertising cookie listed above, set by us as a first-party cookie, for the measurement described in Section 1.7. Google Tag Manager, loaded on our marketing site for analytics, may set its own cookies subject to Google's policies.

On your first visit we show a cookie notice. Advertising measurement runs from that first page view and the notice tells you so - choosing Decline stops it from then on: we delete the pm_attribution cookie, remove the click identifier from links to the app, and signal to Google Tag Manager that advertising storage is denied. Analytics is not affected by that choice. You can change your decision at any time using the Cookie preferences link in the footer of any page, or by clearing or blocking these cookies in your browser. None of this affects your ability to use Spectr.

---

7. Data Retention

Account data: Retained while your account is active. Deleted within 30 days of account deletion
Meeting transcripts: Retained until you delete them or close your account
AI memory files: Retained until you delete them or close your account
Generated specs and stories: Retained until you delete them or close your account
Product health data: Replaced on each refresh and deleted when you disconnect the integration, delete the project, or close your account
Server logs: Retained for up to 90 days
Advertising conversion records: The click identifier and reported action described in Section 1.7, retained for 90 days and then deleted automatically
Blog and What's New reactions: The reaction and the anonymous browser identifier that cast it, retained indefinitely. Expiring it would let the same browser react again and inflate the totals. It identifies no one - see Section 6
Billing records: Retained as required by applicable financial regulations (typically 7 years)

---

8. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

Access: Request a copy of the personal data we hold about you
Correction: Request correction of inaccurate personal data
Deletion: Request deletion of your account and associated data
Portability: Request an export of your data in a machine-readable format
Objection: Object to certain processing activities
Withdrawal of consent: Where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, email hello@crowdlinker.com. We will respond within 30 days.

8.1 Opting out of advertising measurement

You can stop the advertising measurement described in Section 1.7 in any of these ways:

Choose "Decline" in our cookie notice, or open Cookie preferences in the footer of any page and decline there. This is the quickest route and takes effect immediately
Clear or block the pm_attribution cookie in your browser, or visit us without clicking one of our ads. With no click identifier stored, we send nothing to the advertising platforms
Email hello@crowdlinker.com and ask us to stop sharing your information for advertising measurement. If you are a California resident, this is your right to opt out of the "sharing" of personal information for cross-context behavioural advertising
Send a Global Privacy Control signal - we honour it as a valid opt-out request

Opting out has no effect on your ability to use Spectr, and we will not treat you differently for doing so.

---

9. Children's Privacy

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

---

10. International Transfers

Your data is processed and stored on servers in the United States (AWS us-east-2). If you are located in the European Economic Area, United Kingdom, or Canada, your data is transferred to the US in accordance with applicable data protection laws. We rely on standard contractual clauses or equivalent safeguards where required.

---

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top. Please check this page periodically. Continued use of the Service after changes constitutes acceptance of the updated policy.

---

12. Contact Us

For privacy-related questions or requests:

Email: hello@crowdlinker.com
Company: Crowdlinker Inc., Ontario, Canada

Governing law: Ontario, Canada.