Legal
Privacy policy
Who this covers
Spinosis stores data in two roles. Dashboard data is about you, the customer who creates a project. App data is about the end users of the mobile app you connect. You decide what your app sends. We process app data to run experiments and show results to your organization.
Dashboard account
When you sign up we store your email and authentication record, the organization created for that account, membership role, and project settings. A project includes its name, platform, API key, webhook secret, and onboarding step. Billing status, Stripe customer id, and Stripe subscription id are stored on the organization when you subscribe. We use this data to sign you in, run the project, and decide whether the paid API is open.
Mobile app users
The SDK and API can send an external user id, an anonymous id, and a properties object you choose, such as country, platform, or acquisition source. We store first seen and last seen times, the experiment assignment, the variant, exposure time, and events you track. Assignment is sticky: the same user keeps the same variant for that experiment. We do not need a name, phone number, or precise location. Do not send those unless your own product requires them.
RevenueCat
If you connect the RevenueCat webhook, we store the event id, event type, product id, currency, amount, transaction id, event time, and the raw payload RevenueCat sends. We attach the event to a mobile user when the App User ID matches the id you passed to Spinosis, and to the experiment variant that user was assigned. This is how revenue is attributed. Purchases for an organization without an active subscription are rejected and not stored.
Processors
Account and experiment data is stored in Supabase. Card payments are handled by Stripe. We do not see full card numbers. Optional written experiment insights are generated with an AI provider using aggregate metrics, not a list of end-user identifiers. Hosting logs may include IP address and request time for security and rate limits.
How long we keep it
Project data stays until you delete the project or the organization. Deleting a project removes its experiments, assignments, events, and revenue events. You can regenerate an API key without deleting history. We keep billing records as required for tax and fraud prevention after a subscription ends.
Your requests
Dashboard users can ask for a copy or deletion of their account by writing from the email on the account. If an end user of your app asks you for access or deletion, you are the app operator: delete or export their Spinosis user from your project, or ask us to remove the identifiers you send us. We do not sell personal information.