Privacy Policy
Last updated: 15 April 2026
This Privacy Policy describes how SpecProof ("SpecProof", "we", "us") collects, uses, and protects information when you use the SpecProof web application, API, and MCP server (collectively, the "Service") available at specproof.ai and mcp.specproof.ai.
1. Information we collect
- Account data: email address, account identifier, and authentication credentials created when you sign up or sign in via OAuth.
- Billing data: subscription tier, payment status, and billing identifiers. Card details are processed by Square and are never stored on SpecProof servers.
- Usage data: query text, tool invocations, timestamps, result counts, and response latency. This is used to operate the Service, enforce quotas, prevent abuse, and improve search quality.
- OAuth tokens: access and refresh tokens issued to MCP clients that you explicitly connect to your account.
- Technical data: IP address, user agent, and request metadata captured in standard server logs.
2. How we use information
- To authenticate users and authorize MCP client requests.
- To deliver search results, retrieve standards content, and operate the features of the Service.
- To meter usage, enforce rate limits, and bill subscribers.
- To detect, investigate, and prevent fraud, abuse, and security incidents.
- To improve retrieval quality and relevance of the indexed corpus.
3. What we do not do
- We do not sell your data.
- We do not use your query content to train third-party foundation models.
- We do not share query content with advertisers.
4. Subprocessors
We share limited data with infrastructure providers strictly to operate the Service:
- Square — payment processing and subscription management.
- Hosting and CDN providers — serving application traffic and static assets.
- Email delivery — transactional email (sign-up confirmations, billing receipts, security notices).
5. Data sources and licensing
The standards content returned by the Service is sourced from publicly available 3GPP, IETF, and Multimedia repositories and is redistributed in accordance with the terms of those organizations. SpecProof does not claim ownership of normative text.
6. Data retention
Account and billing data is retained for the life of your account and for a reasonable period after closure to meet legal and accounting obligations. Query logs are retained for up to 12 months for abuse prevention and operational analytics, then aggregated or deleted.
7. Security
Transport is secured with TLS. Tokens are signed and scoped. Database access is restricted to operational personnel. No system is perfectly secure; if you discover a vulnerability, please contact security@specproof.ai.
8. Your rights
You may request access, correction, export, or deletion of your account data by emailing privacy@specproof.ai. Subject to applicable law (including GDPR and CCPA where relevant), we will respond within 30 days.
9. International transfers
The Service may be operated from, and data may be processed in, jurisdictions other than your own. By using the Service you consent to such transfers, subject to the protections described in this Policy.
10. Children
The Service is not directed to children under 16 and we do not knowingly collect data from them.
11. Changes
We may update this Policy. Material changes will be announced on this page with a revised "Last updated" date.
12. Contact
Questions: privacy@specproof.ai. Security reports: security@specproof.ai.