Privacy Policy

Last updated: July 5, 2026

This explains what we collect, why, and who we share it with. We keep it minimal.

1. Information we collect

• Account data — your email address and a securely hashed password.
• Content — the prompts you write, the sites you generate, and any images or logos you upload.
• Usage & balances — your Sparks balance, plan, and basic activity needed to run the service.
• Payment data — handled by Stripe. We receive limited billing details (such as your plan and a customer reference); we never see or store your full card number.
• Technical data — a session cookie to keep you logged in, and aggregate, privacy-friendly analytics.

2. How we use it

To provide and operate the service (generate and publish your sites), authenticate you, meter and bill Sparks, send essential account emails (like verification and receipts), prevent abuse, and improve Spellframe. We do not sell your personal data.

3. Service providers we share with

We use a small set of trusted processors to run Spellframe:

• Cloudflare — hosting, storage, database, and bot protection.
• Anthropic (Claude) — the AI that generates your sites; your prompts and relevant content are sent to Anthropic to produce output.
• Stripe — payment processing.
• Resend — sending transactional emails (verification, receipts).

Each processes data only to provide their service to us. We may also disclose information if required by law.

4. Cookies

We use a single essential cookie to keep you signed in. We don't use advertising or cross-site tracking cookies.

5. Data retention

We keep your account data while your account is active. When you delete your account, we delete your associated personal data, except records we're required to keep (for example, transaction records for tax and accounting).

6. Security

Passwords are stored using strong one-way hashing (PBKDF2), traffic is encrypted in transit (HTTPS), and access to systems is limited. No system is perfectly secure, but we take reasonable measures to protect your data.

7. Your rights

You can access, correct, or delete your data — you can delete your account at any time, or email us to make a request. Depending on where you live, you may have additional rights under laws such as GDPR or CCPA.

8. Children

Spellframe isn't intended for children under 13, and we don't knowingly collect their data.

9. International users

Our providers may process data in the United States and other countries. By using Spellframe you consent to this transfer.

10. Changes

We may update this policy; we'll change the date above and, for material changes, make reasonable efforts to notify you.

11. Contact

Privacy questions? Email support@spellframe.app.