Draft. This page needs legal review before launch.

Privacy policy

This policy is a first draft. It will change before launch.

The short version

Your notebook lives on your own computers. This website never sees it. If you make an account, we keep only what we need to run it.

What we keep

• Account: your email, your name, and how you sign in (an email link, Google, Microsoft or Apple). We need these to run your account.
• Consents: what you agreed to, and when. We must be able to show this.
• Account history: a short list of changes, like "signed in" or "added Google", with the date. No places or devices. If you delete your account, the list stays with no name or email on it.
• Signed-in browsers: when each one signed in and was last seen, so you can sign out everywhere.
• Purchases: what you bought, when, and whether it's still on. Payments go through Stripe. We never see your card number.
• Linked apps: the name each app gave itself and when it was linked, so you can remove it. A linked app can only see which extras you have. It never sends us your notes.
• Kit list: if you ask us to tell you when kits are ready, which kit and any note you add. You can take your name off on the kits page.
• Check my PC: nothing. The answer is worked out from what you pick and shown to you.
• Old web app: if you tried the old web app, your saved notebook is still in its old database until the last download day. We read it only when you ask for it, signed in with the same email. We keep a scrambled code of your email to show we sent you the one email about the move, and another if you ask us to stop emailing you.
• Downloads: how many times each app was downloaded each day. No names, addresses or IP addresses.
• Server logs: errors on our side, kept for 30 days, to fix problems. They don't hold your email.

What we never collect

From the apps: your notebook pages, your questions and answers, who you share with, or anything on your Home Brain.

Who else sees it

• IONOS hosts this website.
• Stripe handles payments, if you buy something. It keeps its own records of payments, as the law asks, even after you delete your account here.
• Our email provider sends sign-in links and emails you asked for.
• Cloudflare Turnstile checks that a person, not a bot, is using the email forms. It sees your IP address and browser while it checks.
• Google, Microsoft or Apple, only if you choose to sign in with them. They tell us your email and name.

We don't sell or share your data, and we don't use ads or tracking tools. If your browser sends Global Privacy Control, that's already how we treat you.

Your rights

You can see, download or delete what we keep about you from your account page. You can also write to hello@createspot.com. We answer within 30 days. Deleting your account also stops any plan, so you won't be charged again.

Cookies

We use a few small cookies, and only when you use the forms or sign in:

• one that keeps you signed in, for up to 30 days after your last visit;
• one that proves a form came from this site;
• one that ties an email link to the browser that asked for it, for one day;
• two short ones that hold your place while you sign in or finish making an account, for up to 30 minutes.

There are no tracking cookies. Just reading the website sets no cookies at all.