The short version. We collect your email, the things you make, and a record of your AI usage. We don't sell your data and we don't track you around the internet — there are no analytics and no advertising cookies here.
But when you use an AI feature, your content goes to the company whose model does the work — including, for the assistant, a company in China. Every one of them is named below. Email markmciver83@gmail.com any time to get a copy of your data or have your account deleted.
Who we are
Spaxle is a design and publishing tool for social media, run by The McCoops LLC — a very small company registered in New Mexico, United States. You can reach a human at markmciver83@gmail.com.
We're a US company, so US law is our home ground. But anyone can sign up from anywhere, and if you live in the EU or the UK your data protection rights follow you here — so we honor them too. Where that law uses the term, we are the data controller for the information described on this page.
What we collect
Only what the product needs to work. We don't buy data about you from anyone else, and we don't build a profile of you.
- Your account. Your email address — it's how you sign in, because we don't use passwords. When you sign in we email you a one-time link, which works for 15 minutes and then expires.
- What you make. Your designs, the photos and video you upload, media the AI generates for you, your templates and collections, your captions, and your scheduled posts. This is private to your workspace.
- Your brand kit. Business name, contact details, colors, fonts, tone of voice, example posts — whatever you choose to put in Settings so the AI sounds like you.
- Your conversations with the AI. Everything you say to the assistant, everything it says back, the prompts you type, and the notes it saves about your preferences so it doesn't ask twice.
- AI usage records. For each AI request: which model ran, how many tokens it used, what it cost, and how many credits it consumed. This is how your credit balance works, and how we know if we're losing money.
- Billing. Your Stripe customer ID, your plan, and your credit balance. We never see or store your card details — those go straight from your browser to Stripe.
- Connected accounts. If you connect Instagram or TikTok: an access token, your username, and your account ID. Tokens are encrypted before we store them.
- Technical bits. A session cookie, and ordinary server logs (IP address, what you requested, when) which we use to keep the service up and to stop people abusing it.
- Anything you send us. Feedback, bug reports, emails.
The AI part, honestly
This is the section most privacy policies skip, so here it is first.
Spaxle does not run its own AI models. When you ask the assistant to write a caption, generate an image, remove a background, or make a track, we send what's needed to a third-party model provider and send you back the answer. There is no way to do this without your content leaving our servers. If that's not acceptable for a particular piece of content, don't run an AI feature on it — every AI feature in the product has a manual equivalent that keeps your content on our servers.
What that means concretely:
- Ask the assistant to improve a design, and a picture of your canvas and the design's contents go to the model, so it can see what it's changing.
- Use magic erase or background removal, and the photo goes to the provider.
- Ask the assistant to search the web, and your question goes to a search provider.
These providers process your content to answer the request. Under our agreements with them, they are not permitted to use it to train their models. They each keep inputs for a short period to detect abuse, then delete them — their own policies govern that, and we can't promise more than they do.
One provider is in China. The assistant's core reasoning and its ability to look at your designs run on GLM models from Z.ai (Zhipu AI), a company based in China. When you talk to the assistant, your messages, your brand kit, your designs and images of your canvas are processed there.
China is not covered by a UK or EU "adequacy decision", which means it hasn't been formally judged to offer equivalent data protection. We rely on contractual safeguards, but we'd rather you knew plainly than found out in a footnote. If that isn't acceptable to you, don't use the AI assistant — the editor, the templates, publishing and scheduling all work without it.
We also use AI internally, rarely: when diagnosing a problem, an admin tool can run queries against usage data and pass the results to a model. Those results can include your email address.
Everyone we share your data with
The complete list. Not "partners" or "service providers" — names.
We do not sell your data. We do not share it for advertising. We have no advertising partners, no analytics provider and no data brokers.
| Who | What they do for you | What they see | Where |
|---|---|---|---|
| Running the product | |||
| DigitalOcean | Hosts the server and the database — everything you create lives here first. | Everything: your account, designs, chats, brand kit. | United States |
| Cloudflare R2 | Stores your files: photos and video you upload, images the AI makes, and the finished posts we render. | Your media files. | United States / global edge |
| ⚠ NOT YET NAMED — set EMAIL_PROVIDER_NAME | Delivers your sign-in codes and workspace invitations. | Your email address and the one-time link. Never your content. | See provider |
| Stripe | Takes the payment. Card details go straight to Stripe and never touch our servers. | Your email, workspace name, and what you bought. | United States / Ireland |
| AI features — only when you use one | |||
| When you ask the AI to write, design, edit an image, generate music or look at your canvas, the thing you asked about has to go to the model that does the work. That means your prompt, and usually the design or image itself. Which provider depends on the feature. | |||
| Z.ai (Zhipu AI) — GLM | The assistant's brain and eyes: it runs the conversation, decides what to build, looks at what it made, and searches the web when you ask it to. | Your chat history, your brand kit, your designs, pictures of your canvas, and anything the assistant remembered about you. | 🇨🇳 China — please read “Where your data goes” below |
| OpenAI | Generating images from a description, and the automated safety screen every post passes before it publishes. | Your prompt. For image editing, the image. For the safety screen, the caption and images of the post being published. | United States |
| Fal.ai | Cutting subjects out of photos, erasing objects, generating image fills, and generating music. | The image you're working on and your prompt. | United States |
| Publishing — only for accounts you connect | |||
| Meta (Instagram / Facebook) | Publishing the posts you tell us to publish, and reading your username and profile picture. | Your caption and the links to your finished images/video, which Meta then downloads. | United States / global |
| TikTok | Publishing the posts you tell us to publish. | Your caption and the links to your finished media, which TikTok then downloads. | United States / Singapore |
| Stock search — your search words, nothing else | |||
| These see what you typed into the search box. They never see your designs, your account, or who you are. | |||
| Pexels | Searching for stock photos and video. | Your search words. | Germany / United States |
| Pixabay | Searching for stock photos and video. | Your search words. | Germany |
| Assets your browser fetches | |||
| Not data we send — files your browser downloads to show the page. Neither sets a cookie. | |||
| Google Fonts | The typefaces available in the design editor. | Your IP address and browser, as with any file your browser fetches. | United States / global |
If we add a provider that receives your content, we'll update this table and, where the change is significant, tell you before it takes effect.
Why we're allowed to do this
Under US law we don't need to justify each use the way European law asks us to — but the reasoning is the same either way, and if you're in the EU or the UK these are the lawful bases we rely on:
- To give you what you signed up for (performance of a contract) — your account, your workspace, storing your designs, running the AI features you ask for, publishing what you tell us to publish, and taking payment.
- Because it's reasonable and you'd expect it (legitimate interests) — keeping the service secure, rate-limiting sign-ins, blocking abuse, keeping logs and backups, and fixing bugs.
- Because you asked us to (consent) — connecting your Instagram or TikTok account. You can withdraw at any time in Settings: disconnecting also tells the platform to revoke our access.
- Because the law requires it (legal obligation) — Stripe keeps invoice records for tax purposes, as it must.
We do not send marketing emails. If we ever do, it'll be opt-in and you can leave in one click.
How long we keep it
- Your content: until you delete it, or until your account is deleted. We don't keep it "just in case".
- Sign-in codes: 10 minutes.
- Sessions: 14 days, or until you sign out.
- Server logs: a short period, then rotated away automatically.
- Backups: we back the database up so a hardware failure doesn't erase your work. That means for a short period after you delete something, a copy can still exist in a backup. Backups are overwritten on a rolling schedule and are never used to bring deleted accounts back.
- Invoices: Stripe keeps these for as long as tax law requires, even after you leave. That's their obligation and it's not ours to override.
Your rights
You have the right to get a copy of your data, correct it, delete it, restrict or object to how we use it, and complain about us. Spaxle is in a closed beta and the self-serve export/delete buttons aren't built yet, so right now a human does it for you: email markmciver83@gmail.com and we'll act on any of these within 30 days — usually much faster, because we're small and the requests are rare.
- Get a copy of everything — your designs, media, brand kit, chats, prompts and usage history, as files you can keep.
- Delete your account — really deletes: your designs, your media files, your chats, your prompts, your connected-account tokens (which we also revoke with the platform), and your subscription (which we cancel). Ask for a copy first — it cannot be undone.
- Correct your details — Settings → Account.
- Disconnect a social account — Settings → Accounts. We revoke our access with the platform, not just our copy of the token.
If you're in the United States
Several states — California, Virginia, Colorado, Connecticut, Texas and others — give residents rights over their personal information. Most of these laws only bind companies far bigger than we are, so we probably aren't legally required to follow them yet. We give you the rights anyway: know what we have, delete it, correct it — and there's no "Do Not Sell My Info" link here because we do not sell your personal information and never have. Using any of these rights won't change your price or your service.
If you're in the EU or the UK
You additionally have the right to restrict or object to how we use your data, and to complain to a regulator: in the UK that's the Information Commissioner's Office; in the EU it's your national data protection authority. Please tell us first if you can — we'd rather fix it.
Where your data goes
Our servers are in the United States. Our providers are listed above with their regions — most are in the US or the EU, and the assistant's model provider is in China (see the AI section). If you're in the UK or the EU, that means your data is transferred outside your country. Where a provider isn't in a country with a UK/EU adequacy decision, we rely on Standard Contractual Clauses or the equivalent in that provider's terms.
Security — what we actually do
We'd rather tell you what's true than what sounds good.
What we do:
- Everything travels over HTTPS.
- We have no passwords to lose. Sign-in is a one-time emailed code, so there's no password of yours in our database to steal or reuse elsewhere.
- Session and sign-in tokens are stored only as hashes — the token in your browser or inbox is the only copy of the actual key.
- Instagram and TikTok access tokens are encrypted before they're written to the database.
- API keys are stored only as hashes; we couldn't show you one again if we wanted to.
- Every query is scoped to your workspace.
- Sign-in attempts and AI requests are rate-limited.
- Payment card data never reaches our servers. Stripe webhooks are signature-verified.
- Admin access for support is read-only and logged — we cannot change anything in your workspace while looking at it.
- The server is hardened (key-only SSH) and the database is backed up.
What we don't do — the honest list:
- Your media files sit at public, unguessable URLs. They have to: Instagram and TikTok download your images and video from those links when you publish, so the links can't require a login. Anyone who has the exact URL can view that file. The URLs are long and random and we never publish them — but they are not access-controlled, and you should treat them as "unlisted", not "private".
- We don't add our own encryption on top of the rest of the database. Your designs, chats and prompts are stored as ordinary data, protected by access controls and the host's disk encryption — not by application-level encryption. Credentials are the exception, as above.
- We are a small operation. We have no 24/7 security team and no SOC 2 or ISO 27001 certification.
If something goes wrong: if there's a breach that puts you at risk, we'll tell the relevant regulator within 72 hours of becoming aware of it, and we'll tell you promptly and plainly — what happened, what was exposed, and what to do about it.
Children
Spaxle is a business tool and isn't meant for children. You must be at least 13 to use it (that's the US line, under COPPA), and at least 16 if you're in the UK or the EEA; if you're under 18 you need a parent's or guardian's permission. We don't knowingly collect data from children — if you believe a child has an account, email us and we'll delete it.
Cookies
We use one cookie to keep you signed in, and that's it. No analytics, no advertising, no tracking. Details on the cookies page.
Changes
If we change this policy in a way that matters, we'll email you before it takes effect. Minor clarifications we'll just make, and update the date at the top.