Privacy policy

1. Data we collect

When you create a Spectre account and use the service, we collect the following information:

• Email address — required at signup. Used to identify your account and send verification and service-related emails.
• Password — stored exclusively as a one-way bcrypt hash. Your plaintext password is never stored in any form, cannot be recovered by anyone (including us), and is only ever processed at the moment of signup or login for comparison against the stored hash.
• API key material — stored only as a SHA-256 hash. The raw API key itself is displayed exactly once at generation time and is never stored or retrievable afterward. If you lose the key, you must generate a new one.
• Credit usage metadata — when a tool is called through your account, we record which tool was used, how many credits the call cost, and a timestamp. This is recorded in a ledger table that stores the tool_name, the delta (credit change), and a timestamp — it does not store or cache the actual LinkedIn data returned by that call. No response payloads from LinkedIn are stored on our servers.
• No payment data — no payment gateway is integrated at this time. We do not collect, store, or process credit card details, billing addresses, or any other payment information. This section will be updated when payments are introduced.

2. Third-party data

Spectre surfaces LinkedIn profile, company, and job data through third-party providers (Apify and Bright Data). This data belongs to and describes third parties who are not Spectre customers. We do not scrape LinkedIn directly and do not store LinkedIn profile or company data ourselves — our servers relay it from the providers to your agent and do not retain copies.

3. How we use your data

• To authenticate you and maintain your account (email, password hash, API key hash).
• To send service-related emails (account verification).
• To track credit consumption against your balance so the correct number of available credits is reflected in your dashboard.
• We do not sell, rent, or share your personal data with third parties for their own marketing purposes.

4. Data retention

• Account data (email, password hash, API key hash) is retained for the life of your account plus any period required by applicable law.
• Credit ledger entries are retained indefinitely for accurate balance reconciliation. They contain only tool_name, credit delta, and timestamps.
• Email verification tokens expire after 24 hours and are marked as used once consumed; expired or used tokens are not deleted but are permanently invalidated.
• If you close your account, we will delete your personal data within 30 days, subject to any legal retention obligations.

5. Data security

Passwords are hashed with bcrypt (cost factor 12). API keys are hashed with SHA-256. Database connections use encrypted transport. We apply rate limiting on signup and login endpoints to deter brute-force attempts. No plaintext credential material is stored at rest.

Despite these measures, no online service can guarantee absolute security. If you suspect unauthorized access to your account, rotate your API key from the dashboard immediately and contact us.

6. Cookies

Spectre uses a session cookie (managed by NextAuth) to maintain your authenticated session. This cookie is strictly necessary for the service to function — it does not track you for advertising or analytics purposes. We do not use third-party tracking cookies.

7. International users

Spectre is operated from India. Your data is stored on servers hosted by Neon (our database provider) in a region you select at provisioning time, which may be outside your country of residence. By using the service, you consent to the transfer of your data to these locations. International tax treatment (including GST and export-of-services rules) is not yet addressed for this beta phase and will be clarified before any paid plans launch.

8. Changes to this policy

We will post any changes to this privacy policy on this page. If changes are material, we will notify you by email. Continued use of the service after changes take effect constitutes acceptance.

9. Contact

Questions about this privacy policy? Email us at hello@spectre.dev.