Privacy policy
Your answers describe your own experiences and may count as health-related data in some places. This policy explains what we collect, how we protect it, how long we keep it, and how to delete it. We never sell personal data.
Draft for owner review. This page has not yet been approved and may change.
Who is responsible
This policy covers the SpectrumFox website and assessment, run by Sourdough AI LLC, which operates SpectrumFox ("we"). Questions about privacy go to support@spectrumfox.com.
What we collect
- Your answers to the assessment statements and the time spent on each, so the server can compute your result.
- Your computed result: the overall result and, for the Spectrum Profile, your area levels and the statements you agreed with.
- The country your connection comes from, read at the network edge, to apply a regional price. We do not store your IP address; we keep a one-way salted hash of it to limit abuse.
- Your email address, only if you give it: for a save link, or at checkout for your receipt and report recovery. If you leave checkout without paying, we may send at most two notes about it (see below).
- How you found us: the first page you landed on, the referring site, and campaign tags in the link.
- Usage events such as "assessment started" or "report viewed". These contain no names, emails, answers or results.
Payment details are entered on Stripe's checkout page. We never see or store your card number.
Health-related data
- Encrypted: your answers and your results are encrypted with AES-256-GCM before they are stored, under a key kept as a server secret.
- Stored without that extra encryption, because the site needs to read them: your email address if you gave one, how you found us (the landing page, the referring site and campaign tags), a one-way salted hash of your IP address, your country, the page versions you were shown, counts and dates, the price, and payment references from Stripe. None of these contain your answers or results.
- Answers and results never go into web addresses, analytics, logs, payment records or email subject lines. Emails contain links, not results.
- We do not use advertising pixels, and we never share or sell your answers or results.
- The assistant never receives your answers. If you tick "share my overall result" on a message, it receives only your overall result and how many statements you answered, for that message only.
- Some US states treat data like this as consumer health data, and in the European Economic Area and the United Kingdom it may be special category data. How these laws apply to SpectrumFox is flagged for review by legal counsel before launch.
How we use it
- To compute and show your free result and, after payment, your Spectrum Profile.
- To send the emails you asked for: a save link, a receipt, report recovery. We send no newsletters or marketing email.
- Checkout notes: if you enter your email at checkout and leave without paying, we may send at most two notes with a link back to your results page. Each address gets no more than two, ever, and every note has an unsubscribe link.
- To set the regional price, to understand in aggregate which pages lead people to the assessment, and to find and fix errors.
How long we keep it, and how to delete it
- Unpaid attempts, including encrypted answers and any email you gave for a save link: deleted automatically 30 days after the attempt started.
- Paid attempts, including encrypted answers, the result and the checkout email: kept 3 years from payment so you can return to your report, then deleted.
- Delete any time: use "Delete my data" on your results page or report. It removes your encrypted answers and results and ends every link at once. For a paid attempt we keep only the payment record (amount, date and payment references) that accounting law requires.
- Analytics events and daily counters: 400 days. Assistant conversation metadata: 30 days; message text is not stored.
Who processes data for us
- Stripe: payment processing.
- Amazon Web Services: encrypted database storage and transactional email, in the United States.
- Cloudflare: hosting, content delivery and network security.
- Google Analytics: aggregate website analytics with advertising features off, on the production site only. In the European Economic Area, the United Kingdom and Switzerland, analytics cookies are off by default and Google receives cookieless measurements only.
- Anthropic: writes assistant replies from the messages you send.
- The site owner's text-message alerts: when someone starts the assessment, the owner receives a short text through a private relay and a text-message provider with how the visitor found us (for example a search engine and the landing page), the device type (for example iPhone) and the city the connection comes from. After a purchase or an unfinished checkout, a similar text has the traffic source, the landing section and the country. These texts never contain answers, results, email addresses or IP addresses.
Your choices and rights
You can ask us to access, correct or delete the data tied to your attempt or email address by writing to support@spectrumfox.com. Depending on where you live, you may have further rights under local law, such as withdrawing consent or complaining to a data protection authority.
Adults only
SpectrumFox is for adults 18 and over. We do not knowingly collect data from children. If you believe a child has used the site, contact us and we will delete the attempt.
Changes to this policy
When this policy changes, we update the reviewed date on this page. Material changes apply only to data collected after they take effect.