Privacy Policy

2. Information We Collect

While we minimize data collection, we require specific information to operate the service and manage billing.

A. Account & Billing Information

• Identity: When you register, we collect your email address and authentication credentials (hashed passwords or OAuth tokens).
• Payments: We use Stripe for payment processing. We do not store your credit card information. We store a stripe_customer_id, your current subscription status (e.g., Plan Tier, Quota Limits) to enforce usage caps, and the amount and currency of each paid invoice. When you start checkout we use the country Cloudflare derives from your IP address to choose between US checkout and international checkout; we do not store it.

B. Bridge Configuration Data

To persist your setup between sessions, we store the metadata of your bridges in our database:

• Target URLs: The base URL of the API you are bridging.
• Endpoint Definitions: The specific Open API/Swagger schemas you selected for the bridge.
• Tool Names: The function names generated for the LLM (e.g., get_user_status).

C. Usage Telemetry

We collect technical logs to monitor system stability and calculate your bill. This includes:

• Request Counts: The number of times a tool is called (used for the 'Requests/Month' quota).
• Error Rates: HTTP status codes (e.g., 200 OK, 500 Error) to help us debug connection issues.
• Timestamps: When connections are opened or closed.
• Product analytics: On specsync.io we record which pages are viewed, which buttons are clicked and how far the signup and bridge-creation flows get, using a random first-party identifier stored in your browser. We do not use third-party analytics services, advertising trackers or fingerprinting, we do not store IP addresses, and we honour the Global Privacy Control and Do Not Track signals by collecting nothing. These events are processed in our own Cloudflare account.

3. How We Use Your Information

• To Provide the Service: We use your Bridge Configuration to route requests correctly.
• To Bill You: We aggregate your usage counts to determine if you have exceeded your monthly free tier or paid quota.
• To Protect the Network: We monitor traffic patterns to detect abuse, such as DDoS attacks or attempts to use our proxy for Server-Side Request Forgery (SSRF) against internal networks.

4. Data Retention

• Transient Data (API Keys/Payloads): < 1 second. Exists only during the HTTP request lifecycle.
• Persistent Data (Bridges/Account): Retained until you delete your account or the specific bridge.
• Usage Logs: Retained for 3 months to resolve billing disputes, then anonymized.

5. Third-Party Subprocessors

We use a small set of trusted infrastructure providers:

• Stripe: Payment processing, and merchant of record (through Link) for purchases made outside the United States.
• Cloudflare: DNS, TLS and request proxying for specsync.io, and storage of the product analytics events and web performance measurements described above.
• Resend: Sending account emails, such as password reset codes.
• DigitalOcean: Hosting the FastAPI backend and Redis/Postgres databases.

6. Security

We implement 'Security First' design principles:

• Sanitization: We automatically strip sensitive headers (like Set-Cookie) from your Target API responses before they reach the AI client to prevent session leakage.
• Encryption: All data in transit is encrypted via TLS/SSL. API Keys provided by you are never written to disk.

7. Your Rights

You own your bridge configurations. You can:

• Export: Request a JSON dump of your bridge configurations.
• Delete: Delete a bridge or your entire account at any time. Upon account deletion, all persistent configuration data is wiped from our Postgres database.

8. Contact

For privacy concerns or to request data deletion, email us at: [Insert Email Address]