Privacy Policy
- We collect only what we need to run Specdio.
- We never sell your data, and we never use it for ads. No ad or tracking cookies.
- Your project files belong to your studio. We do not use them, or anything from Google or Dropbox, to train AI.
- If you sign in with Google, we get your name, email and picture — nothing from Gmail, Calendar, Contacts or Google Drive. Details.
- If you connect Dropbox, we only read the folders you pick. We never change, move or delete anything in your Dropbox. Details.
- You can download or delete your data, and disconnect Google or Dropbox, any time. Here is how.
1. Who we are
Specdio (https://www.specdio.com) is a file and review tool for interior designers and architects. It is run by Thiriverse LLC, a California limited liability company (“Thiriverse”, “we”, “us”), [FILL IN: mailing address]. Questions about privacy: support@specdio.com.
2. Two roles we play
- Your account data (name, email, sign-in, billing): we decide how it is used, so we are the controller.
- Project content (files, renders, drawings, specs, comments, client names on share links, and anything read from a Dropbox the studio connects): the studio that owns the project decides. The studio is the controller and we are its processor. If you are a client of a studio, contact that studio first about your data — we will help them answer.
3. What we collect
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Email, password (stored hashed, never in plain text), name, optional phone | Create and secure your account | Contract |
| Google profile: name, email, picture, Google account ID — only if you use Google sign-in (§4) | Sign you in | Contract |
| Microsoft profile: name, email, Microsoft account ID — only if you use Microsoft sign-in | Sign you in | Contract |
| Studio name, team members, roles | Run shared workspaces | Contract |
| Files, versions, comments, approvals you upload or create | The service itself | Contract (for the studio) |
| Dropbox account details, file lists, previews and copies — only if your studio connects Dropbox (§5) | Show and sync the folders you pick | Contract (for the studio) |
| Name typed by a client on a share link, their comments and answers | Show the studio who said what | Studio's legitimate interest |
| Share-link activity: time, action, browser type, and a daily-changing hash of the IP address (the raw IP is never stored) | Audit trail, abuse protection | Legitimate interest |
| Billing name, address, tax ID, billing email. Card details are typed on Stripe's page and kept by Stripe — we never see or store your card number | Invoices and tax | Contract, legal obligation |
| Support messages | Help you | Legitimate interest |
| Product step counts, kept in our own database: a studio was created, a file uploaded, a set sent, a link sent (by email, WhatsApp or copy), a client link opened, a client answer given. IDs and times only — no file names, emails or comments | See where studios get stuck, and improve Specdio | Legitimate interest |
| Error reports: what broke, on which page, browser type | Find and fix bugs | Legitimate interest |
We do not collect: precise location, your contacts, health data, or data from advertising networks. We do not use advertising or analytics cookies, and no third-party tracking scripts.
4. Data from Google
This section is about data we get from Google when you choose Continue with Google.
What we access
Only these basic permissions. Google shows them to you before you agree:
| Google permission | What it gives us |
|---|---|
openid | Confirms it is really you signing in |
email | Your Google email address |
profile | Your name and profile picture |
We do not ask for, and cannot see, your Gmail, Google Calendar, Google Contacts, Google Drive or any other Google data. We never see your Google password.
Google Drive: Specdio does not connect to Google Drive today. Before it ever does, we will update this section to say exactly what it reads and keeps, and Google will ask for your permission on its own screen first. Nothing is read from Google Drive until you say yes there.
How we use it
- To create your Specdio account and sign you in.
- To show your name and picture to you and your teammates in the app (for example, on comments you write).
- To email you about your account (sign-in codes, invites, reminders you turned on).
How we store it
Your Google name, email, picture link and account ID are kept by our sign-in provider (Supabase) in the USA, encrypted in transit (HTTPS) and at rest. Database rules mean only you, and the studios you join, can see them.
Who we share it with
Nobody, except the service providers in §7 that host and run Specdio, under contracts that let them use it only for us. We never sell Google data, never use it for ads, and never give it to data brokers.
How long we keep it, and how to remove it
- We keep it while your account is open.
- Remove Google from your account any time: Account → Security → Ways you sign in (you need one other way to sign in first).
- You can also cut our access from Google's side at myaccount.google.com/connections.
- Close your account and we delete your Google data within 30 days. Backups are overwritten within 30 days after that.
Google API Services User Data Policy
Specdio's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In plain words, that means:
- We use Google data only for the features you can see in Specdio and that this policy describes.
- We do not transfer it to anyone, except to provide those features, for security, to follow the law, or as part of a merger or sale (we will tell you first).
- We do not use it for ads, and we never sell it.
- No person at Specdio reads it unless you ask us to (for support), it is needed for security or abuse, or the law requires it.
- We do not use Google data to develop, improve or train artificial intelligence or machine learning models.
5. Data from Dropbox
This section applies only if someone in your studio clicks Connect Dropbox (Settings → Connections, or New project → Dropbox). Dropbox shows the permissions below on its own screen before anyone agrees.
The permissions we ask for — all read-only
| Dropbox permission | Why we need it |
|---|---|
account_info.read | Your Dropbox account ID, name and email — so Settings can show which Dropbox is linked |
files.metadata.read | File and folder names, paths, sizes, dates and Dropbox file IDs — to list and sync the folder you pick |
files.content.read | The contents of files in that folder — to make previews, open originals, and copy a file in when you send it to a client |
A studio Dropbox link (Dropbox Business, linked once by a studio admin who is also the Dropbox team admin) also asks for:
| Dropbox permission | Why we need it |
|---|---|
team_info.read | Your Dropbox team’s name and ID |
members.read | The team admin’s own member ID — Dropbox needs it to read files as that admin. We do not read or store your team’s member list |
team_data.member | Read files in your team’s space as the admin who linked it, so projects keep syncing when people leave |
We do not ask for permission to write, edit, move, share or delete anything in Dropbox, and we never do.
What we read
- Your Dropbox account ID, name and email (to show which Dropbox is linked).
- Folder names, while you browse to pick a project folder. We do not save that list.
- For each folder you pick: the names, paths, sizes, dates, Dropbox file IDs and content fingerprints of its files and subfolders, and the file contents.
- A notice from Dropbox that “something changed” in a linked account. It carries only the account ID; we then check the folders you picked.
We never read folders outside the ones you pick, except their names while you are browsing.
What we keep, and where
| What | Why | How it is kept |
|---|---|---|
| The Dropbox sign-in key (a “refresh token”) | So sync keeps working when nobody is signed in | Encrypted (AES-256-GCM) before it reaches our database. The key to unlock it is stored separately, on our server only. No browser can read it |
| The list of files and folders in the folders you pick (names, paths, sizes, dates, IDs, fingerprints) | Show the project, notice changes | Our database (Supabase, USA), visible only to people in your studio who can open that project |
| Small preview pictures of those files (about 480 px and 2,560 px wide) | Open big renders fast | Our private file storage (Supabase, USA) |
| A full copy of a file — only when your studio sends it to a client in a set | So the client's link keeps working even if the file later changes or moves in Dropbox | Our private file storage. It counts toward your plan's storage |
| Short-lived download links (about 4 hours) | Open or download an original straight from Dropbox | In your browser's memory only. Never saved by us. The file goes from Dropbox to your browser, not through our servers |
What we never do with Dropbox data
- Change, move, rename, share or delete your files in Dropbox.
- Sell it, use it for ads, or share it with other studios or other Specdio users. Only people your studio adds to a project, and clients you send a set to, see it.
- Use it to train artificial intelligence or machine learning models.
- Let our staff open it, unless your studio admin turns on support access (Settings → Support access), and then only to help you. Every visit is logged.
Disconnecting, and deleting Dropbox data
- Disconnect in Settings → Connections. We delete the sign-in key at once and tell Dropbox to cancel it. We stop reading that Dropbox immediately.
- You can also remove Specdio at dropbox.com/account/connected_apps. We stop working with that Dropbox the next time we try.
- File lists, previews and sent copies already in a project stay with that project, because they are your studio's record. Delete the project (or the files) and they go to Trash, then are deleted for good after the Trash period. Backups are overwritten within 30 days.
- Want every trace of a Dropbox removed now? Email support@specdio.com and we will do it within 30 days.
- When a studio closes its account, all of it is deleted as described in §9.
Dropbox's own handling of your files is covered by the Dropbox Privacy Policy. Specdio is not made, endorsed or sponsored by Dropbox, Inc.
6. How we use data
- To provide, secure and support Specdio.
- To send service emails — for example due-date reminders. You can turn reminders off with the link in each email.
- To bill and meet tax and legal duties.
- To prevent abuse and fix bugs.
We do not sell personal data, do not “share” it for cross-context behavioral advertising (as the CCPA defines it), and do not use project files, Google data or Dropbox data to train AI models. We do not make decisions about you based solely on automated processing.
7. Who we share data with
Only with the service providers below, under contracts that limit use to running Specdio:
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, sign-in and file storage | USA |
| Vercel | Hosting the app and running server code | USA and global edge network |
| "Continue with Google" sign-in — only if you choose it | USA | |
| Microsoft | "Continue with Microsoft" sign-in — only if you choose it | USA |
| Stripe | Card payments, subscriptions, invoices and receipts — only if you buy a paid plan | USA |
| Resend | Sending emails: sign-in codes, invites, review updates, reminders and purchase confirmations | USA |
| Sentry | Error reports, so we can fix what broke | USA |
Services your studio can connect. These are your own accounts. We read from them only when you ask:
| Service | What Specdio does with it |
|---|---|
| Dropbox | Reads the folders a studio picks, to show and sync them in Specdio. Read-only. |
| Google Drive | Not available yet. This page will be updated, and Google will ask you first, before Specdio ever reads Google Drive. |
We may also disclose data if the law requires it, to protect people's safety, or as part of a merger or sale of the business (you will be told first, and this policy will still apply to your data). People you share a project with see what you choose to send them.
8. International transfers
Our providers store data in the USA. When data leaves the EU, UK or Switzerland we rely on the European Commission's Standard Contractual Clauses (and the UK addendum) or the EU-US Data Privacy Framework where the provider is certified.
9. How long we keep data
- Account data (including Google or Microsoft sign-in details): while your account is open. After you close it, we wait 30 days (so you can change your mind), then delete it.
- Project content (including file lists, previews and copies from Dropbox): as long as the studio keeps the project. It belongs to the studio, so it stays with the studio when one member leaves.
- Dropbox sign-in keys: deleted the moment someone disconnects that Dropbox; otherwise kept until the studio's account is deleted.
- Approval and share-link audit records: for the life of the project, because they are the record of what a client approved. Deleting the project deletes them.
- Invoices: as long as tax law requires (usually 7 years).
- Backups: overwritten within 30 days.
10. Your rights
Depending on where you live (for example the EU/UK GDPR, or California's CCPA/CPRA and similar US state laws), you can:
- see and get a copy of your data,
- correct it,
- delete it,
- object to or limit some uses, and take your data elsewhere,
- withdraw consent at any time, where we rely on consent — including disconnecting Google or Dropbox,
- not be treated differently for using these rights.
Most of this you can do yourself in Account and Settings → Connections. Otherwise see Your data or email support@specdio.com. We answer within 30 days. We may ask you to confirm your email first, so nobody else can get your data. An authorized agent may make a request for you with your signed permission. You may also complain to your local data protection authority.
California residents: in the last 12 months we collected the categories in §3 — identifiers (name, email, account IDs), commercial information (plan and invoices), internet activity on share links, and the content you upload — from you, your studio, and the services you connect, for the purposes in §6. We disclosed them only to the providers in §7. We do not sell or share personal information, so there is nothing to opt out of; we still honor Global Privacy Control signals. Your password is the only “sensitive” information we keep, and we use it only to sign you in.
11. Security
Data travels over HTTPS. Database rules check every row, so people see only their own studio's data. Dropbox sign-in keys are encrypted before they are stored, and the key that unlocks them is kept apart from the database. We ask Google and Dropbox for the smallest permissions that make each feature work. Share links can expire and carry watermarks. Our staff open a studio only to give support; every visit is logged, and studio admins control support access in Settings → Support access. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.
12. Children
Specdio is a tool for design professionals. You must be at least 16 to create an account. We do not knowingly collect data from anyone under 16 (or under 13 in the USA). If you believe a child gave us data, email support@specdio.com and we will delete it.
13. Cookies and browser storage
We use only storage needed to sign you in and remember your settings. No ad or analytics cookies. Full list: Cookie Policy. Because we do not track you across sites, browser “Do Not Track” signals change nothing here.
14. Changes
If we make a material change — for example, reading a new kind of Google or Dropbox data — we will email account owners or show a notice in the app before it takes effect, and ask again where the law or Google or Dropbox require it. The date at the top shows the latest version.
15. Contact
Thiriverse LLC, a California limited liability company
[FILL IN: mailing address]
support@specdio.com