Privacy Statement

Privacy Policy — Spec AI Assistant

Last updated: March 25, 2026

Spec AI LLC ("we," "our," "us") operates the Spec AI Assistant Chrome extension. This policy describes what data we collect, how we use it, and your rights.

1. What Data We Collect

Account Information. When you create an account, we collect your email address and a password. Your password is stored in hashed form using industry-standard encryption. We use this information to authenticate you and manage your subscription.

Usage Data. We track the number of specification requests you make per day in connection with your account for the purpose of enforcing usage limits. We do not track which sections you generate or retain the content of your requests.

Project Information You Enter. When you generate a specification, the CSI section, building type, project location, construction type, and any project notes you enter are sent to our server and forwarded to a third-party AI processing service for generation. This project data is transmitted in real time and is not stored on our servers after your request completes. It is not logged, saved, or retained once the response has been delivered to your browser.

Feedback. If you submit feedback through the built-in feedback form, your star rating and comment text are collected via Google Forms and stored in Google Sheets. Feedback is anonymous unless you voluntarily include identifying information in your comment.

Terms Acceptance. Your acceptance of the Terms of Use is stored locally in your browser using Chrome's storage API. This data does not leave your device.

Authentication Tokens. The extension uses a signed authentication token (JWT) for each API request. This token contains your account identifier and email address in encoded form. It is transmitted over HTTPS and is not accessible to third parties.

Security Logs. In the event of a failed authentication attempt, our server may log the IP address associated with the request for security and abuse prevention purposes. IP addresses are not collected during normal, successful use of the extension.

2. Third-Party Services

AI Processing Service. Your project parameters are forwarded through our server to a third-party AI service for specification generation. This third-party provider processes your project parameters solely to generate the requested output. Per our agreement with this provider, data submitted via their API is not used to train their models. Their data handling is governed by their own privacy policy.

Google Drive API. If you use the "Open in Google Docs" feature, the generated specification is uploaded to your Google Drive using OAuth2 authentication. We request only the drive.file scope, which limits access to files the extension creates. We cannot access your other Google Drive files.

Google Forms. Feedback submissions are collected through Google Forms.

Hosting Infrastructure. Our server is hosted on a third-party cloud platform. Data transmitted between your browser, our server, and the AI processing service is encrypted in transit using HTTPS.

3. What We Do Not Collect

We do not collect your name, browsing history, or any data from web pages you visit. The extension does not read or access any browser tab content. We do not sell, rent, or share your personal information with third parties for marketing purposes.

4. Data Security

Passwords are stored using bcrypt hashing with a cost factor of 12. Authentication tokens are signed using a server-side secret and expire after 7 days. All data transmission between the extension, our server, and third-party services occurs over encrypted HTTPS connections.

5. Data Retention

Account information (email and hashed password) is retained for the duration of your account. Usage counts are reset daily and are not retained as historical records. Project data is not retained. Feedback data is retained indefinitely for product improvement purposes. Security logs containing IP addresses are retained in accordance with our hosting provider's standard log retention period. You may request deletion of your account or feedback data by contacting the address below.

6. Your Rights

You may uninstall the extension at any time to stop all data transmission. You may request a copy of the personal data we hold about you. You may request deletion of your account and all associated data. Contact the address below for any privacy-related requests. We will respond to requests within 30 days.

7. Changes to This Policy

We may update this policy as the product evolves. Material changes will be communicated through the extension or by email to registered users. The "Last updated" date at the top will always reflect the most recent version.

8. Contact

For privacy-related inquiries: admin@specifications.ai

Specifications AI LLC