Privacy notice

Who we are

Morgan Jonasson Consulting AB, organisation number 556991-2321, c/o Morgan Jonasson, Kopernikus Väg 6, 147 46 Tumba, Sweden, is the controller for the personal data this notice describes: your account, your teams, billing and the website. Write to privacy@spool.page with any question or request. We have no data protection officer, because the law doesn't require one of us; the same address reaches the people responsible.

spool on your own computer sends us nothing. What follows begins when you sign in to spool.page or use Spool Cloud, or visit the website.

Your account and signing in

Your account holds your email address, the name you give, when it was created, and the devices and browsers signed in to it, with when each was last used. You sign in with a code we email you (sent through Resend), with Google, which tells us your Google account's email address, name and identifier, or with a passkey, of which we keep only the public key and a label. We use this to run your account and keep it secure: the legal basis is our contract with you (Article 6(1)(b) GDPR).

To stop abuse of sign-in, we keep a keyed hash of the network address that asked for a code, and the count of codes sent, for one day. That rests on our legitimate interest in keeping accounts safe (Article 6(1)(f)).

Teams, invitations, shares and comments

A team has a name, an address on spool.page, and members with roles. When someone invites you, we keep your email address, the role, and who invited you, and email you the invitation. A share names people by email address or opens by link; people a share names get an email with the link, and someone outside the team who opens a share signs in as an account to comment. When you comment, the people in the thread may get an email about it, which you can turn off from the email. All of this is how the team asked Spool Cloud to work, so it rests on our contract with the team and our legitimate interest in letting it work with the people it chooses.

Team content

What a team puts into its projects (files, frames, comments on them) is the team's. For any personal data in it, the team is the controller and we are its processor under our data processing agreement. Ask the team about that data; we pass any request we receive to them.

We keep every save to a team project for 90 days, with who made it, from which device and when, so the team can see what changed and restore it; older saves are deleted. A daily backup of each team project is kept for 30 days, only for us to restore from.

Billing

When a team pays, Stripe takes the payment. We keep the team's billing email, the plan, the seats and the state of its subscription; Stripe keeps the card, the company name, address and VAT number you give at checkout, and the invoices. We keep invoices and the accounting records behind them for seven years, because Swedish accounting law requires it (bokföringslagen, Article 6(1)(c)), even after an account or team is deleted.

Security and service logs

Cloudflare delivers and protects spool.page and Spool Cloud. It processes connection data such as IP addresses, requested URLs and browser details to serve requests and stop abuse. We read our own error logs to fix problems. This rests on our legitimate interest in a reliable, secure service.

Who receives your data, and where

We use Cloudflare, Stripe, Resend and Google sign-in to run Spool Cloud, and PostHog for the website only with your consent. Subprocessors lists each, what it handles, where, and the safeguard for any transfer outside the EU: the EU-US Data Privacy Framework, with the Commission's standard contractual clauses as the fallback. Ask us for a copy of a safeguard at privacy@spool.page. We don't sell personal data, and we share it with authorities only where the law requires.

How long we keep it, and deleting your account

We keep your account while you have it. You can delete it yourself at the foot of your account page. It goes at once: you are signed out everywhere, your computers stop syncing, and their folders stay as ordinary local projects. Your teams keep the work you did in them, and their history shows your saves as a former member, with no name. A team where you are the only member is deleted with your account, and purged 30 days later. If a team's billing email is your address, it moves to another of its admins.

After deletion, daily backups roll off within 30 days, and invoices stay for seven years. A team that stops paying is deleted from Spool Cloud 6 months later.

If your account ever started a free trial, we keep one thing after deleting it: a one-way keyed hash of your email address, never the address itself. It only tells us that an address signing up again has already had its trial, so a new account doesn't get a second one; its teams start without a trial.

The website: anonymous request totals

Our server counts requests for the landing page, including when you decline the optional choices. It stores only a daily total (UTC) for fixed source categories, such as Skeppat, GitHub, Google or other. These totals contain no visitor identifiers, IP addresses, full referral URLs or browsing histories. They include repeat requests and automated traffic, so they do not represent unique people.

This counting uses the page request already needed to serve the website and adds no cookies, browser storage or tracking scripts. We use the totals to understand overall traffic sources. They are stored in Cloudflare D1 in the EU and removed after one year as new requests arrive.

The website: what it measures

With your consent, PostHog processes the options you choose:

• Website analytics: page visits and departures, referral domains and campaign tags such as ref=skeppat, clicks on Download for Mac, and successful copies of the install command. A download click tells us that a link was pressed, not that the app was installed. On the landing page it also counts a click on the line to Spool Cloud's price (cloud_price_clicked), the Spool Cloud section coming into view, once a visit (cloud_chapter_reached), and a press of Start a 14-day trial with the billing cycle shown and what the team starts as (trial_start_pressed), never the team's name.
• Error reports: website error messages, the code locations involved, and technical browser details that help us investigate failures.
• Session recordings: a reconstruction of the page layout, scrolling, pointer movements, clicks and navigation, so we can see where using the website is confusing. Recording begins after you agree and stops when you withdraw this choice.

These events include timestamps, page paths, browser and operating-system details, screen dimensions, and random browser/session identifiers. Those identifiers can link events during your visit and are treated as personal data.

We strip query strings and fragments from page URLs, keeping only the selected campaign tags for analytics. Error reports are filtered to remove recognisable email addresses and URL parameters. Error text can still contain information produced by the website.

Recordings show the website's public text and layout. Input values, text marked as private and descriptive element attributes are masked in your browser before sending. Recognisable email addresses and URL parameters are filtered from recorded text. Embedded frames, editable areas, video and canvas contents are blocked. Console logs and network request bodies and headers are not recorded. We do not read clipboard contents or identify you by name or email. It measures this website only, not your local projects or use of the spool app.

The Spool Cloud waitlist

The waitlist is closed: Spool Cloud is open, and it takes no new addresses. For the addresses that joined, we keep the email address, when it joined, when it was confirmed and when it was let in, and the fixed source category of the page it joined from, such as GitHub or other. We store nothing else. We use a confirmed address only to send one more email, to say Spool Cloud is open, because you asked to join; then we delete the list.

The waitlist is stored in Cloudflare D1. Its emails are sent through Resend, Inc., which processes your address and the message to deliver it. Letting you in creates a spool account for your address.

An address that was not confirmed within 48 hours is deleted. To be removed sooner, email privacy@spool.page from that address and we delete it.

Cookies and browser storage

Optional measurement starts only after you allow it. We use browser storage rather than analytics cookies. The same consent choices apply. Signing in uses the cookies below, which are strictly necessary for the service you asked for and need no consent.

The preference record is used to respect your choice. Optional storage requires your consent. If your browser prevents saving preferences, your choice applies to the current page and you may be asked again later.

The website's measurement providers

PostHog, Inc. processes the optional measurement data for us. We use PostHog Cloud EU, hosted in Frankfurt, Germany. Analytics and error events are kept for up to one year under the Free plan’s retention period. Session recordings have a separate retention period of up to 30 days, followed by deletion processing. We use this history to compare traffic sources and investigate website problems.

Your IP address reaches PostHog as part of the network connection. Our event configuration disables IP storage and location enrichment. EU hosting does not mean every provider operation occurs in the EU: international processing is subject to the safeguards described in PostHog’s data-processing agreement and subprocessor list.

Cloudflare delivers and protects this website. It processes connection data such as IP addresses, requested URLs and browser information to serve requests and protect against abuse. This is separate from optional analytics and is based on our legitimate interest in operating a reliable, secure website. Cloudflare’s processing locations, retention criteria and transfer safeguards are described in its privacy policy.

If you email us, we use your email address and message to respond and handle your request, based on our legitimate interest in answering enquiries and, where applicable, our legal obligations. We keep that correspondence while needed to resolve the request and meet those obligations.

Your rights

You can withdraw consent using the controls at the top of this page. Withdrawal stops future optional collection; it does not undo earlier lawful processing or automatically delete data already received.

You can ask to access, correct or delete your personal data, restrict its use, receive a portable copy where applicable, or object to processing based on legitimate interests. Email privacy@spool.page, and we answer within a month. Because we do not link website identifiers to email addresses, we may need information to locate the relevant records.

You may also complain to IMY, the Swedish Authority for Privacy Protection, or your local data-protection authority. We do not use these events for decisions that have legal or similarly significant effects on you.