Privacy

Your email address and password, held by Supabase Auth — the password as a hash, which this app never sees and cannot read. Your company: its name, address, contact details and logo, because the specbook is signed with them. Your projects: the client’s name, address and dates. Your rooms, the products on their boards, the photographs attached to them, and any floor plan you upload.

It records nothing about how you use it. There is no analytics, no tracking pixel, and no advertising identifier anywhere in this app.

Three today, and a fourth when there is a subscription to pay for. None of them is paid to receive your data, none is allowed to use it for their own purposes, and nothing is ever sold.

Supabase stores the database and every file — the photographs, the logos and the floor plans. Vercel runs the app itself. Both hold this data on servers in the United States, in Oregon. If you are in Europe or Brazil, your work is crossing a border to get there, and that is worth knowing before you put a client’s project in.

Anthropic reads what you paste — see below, because it is the part most worth understanding.

Stripe will handle payment when there is a subscription to pay for. There is none yet, no card has ever been taken, and Stripe has never received anything about you.

This is the one place your work leaves our own servers, and it is worth being exact about. When you paste a link or a page so that the app can fill in a product’s details, the text of that page is sent to Anthropic’s API, which reads it and returns the fields. When the app reads a photograph to find what is printed on it, that image is sent too.

What is sent is the shop’s page, not your project: not the client’s name, not the room, not your company, not your other products. What Anthropic then does with it is governed by their own commercial terms rather than by anything this page can promise on their behalf.

It is still a transmission to another company, and a page you paste might be a document a supplier sent you privately. It is your call what goes in — and now you know what goes with it.

A product, note or photograph you remove goes to the room’s bin and can be put back for thirty days. A deleted project works the same way. Past thirty days it is no longer recoverable by you, and the app clears it out — with the photographs — the next time something is removed from that room. So an old item in an untouched room may sit in the bin longer than thirty days; it is simply waiting to be swept, and cannot be restored in the meantime.

A copy of the database is taken once a day and kept so that a mistake or a failure does not cost you a project. Something you deleted may therefore sit in a backup for a short time after it leaves the app.

Everything else is kept for as long as your account exists, because it is the work — a specbook you printed for a client two years ago should still open.

A copy is a button, and it does not go through us: Account → Security → Download everything hands back one JSON file with every project, room, piece and schedule line, and the addresses of the photographs. No request, no wait, no asking permission to leave.

Deleting the account is deliberately not a button. Write to the address on your Company settings page. from the address on the account and a person does it with you — after you have downloaded your work, because every project, room and specbook in it goes, for good.

If you are in Europe or the United Kingdom, the GDPR gives you the right to a copy, to correction, to erasure, and to object — and if you are in Brazil, the LGPD gives you much the same. The paragraph above is how each of those is exercised here.

When you copy more than 400 characters from a web page, it writes one record to your browser’s own local storage, on the device you are using: the address of that page, the text you copied, and the time. That record is replaced by the next copy you make, so there is only ever one.

Anything shorter is not written down at all. Copying a price, a name or a line of an address leaves no trace.

A browser does not put a page’s own address on the clipboard. So a product pasted into YzY-Spec arrives with its name, its price and its stock number, and nothing to open when a client asks whether it is still available.

The record is read by one site, YzY-Spec, and only to attach the address of the page you copied from to the product you paste. The board checks that what you pasted really is what was copied before it uses the address at all.

• It never touches your copy. Nothing in it cancels a copy, rewrites the clipboard or re-serialises a selection.
• It never sends anything anywhere. No server — not ours, not anyone’s. There is no account in it, no identifier, and no analytics.
• It is never sold, shared, or used for anything other than the one purpose above.

Uninstalling the extension removes the record with it. You can also clear it at any time from Chrome’s own extension settings, without uninstalling.