Privacy Policy

1. Introduction

Spynra Launch ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our viral waitlist builder platform at spynra.com.

This policy applies to two groups of people: account holders (founders and product teams who create waitlist campaigns) and waitlist subscribers (individuals who sign up via a Spynra Launch-powered widget on a third-party site). We've tried to make this clear throughout.

2. Information We Collect

Category	Data Points	Who It Applies To
Account data	Email address, hashed password, subscription tier, billing history	Account holders
Waitlist signups	Email address, referral code used, signup timestamp, position in queue	Waitlist subscribers
Analytics	Page views, referrer URL, UTM parameters, visitor ID (pseudonymous), event type, timestamp	All visitors
Network data	Hashed IP address (one-way SHA-256 hash), user agent string, browser locale	All visitors
Payment data	Billing email (via Stripe); we never see or store full card numbers	Account holders (paid plans)

We do not collect phone numbers, physical addresses, social security numbers, or government-issued IDs.

3. How We Use Your Information

We use the information we collect to:

Provide the Service — authenticate accounts, serve campaign pages and widgets, process payments, and deliver subscriber lists to campaign owners
Operate referral tracking — attribute signups to referrers and update leaderboard positions
Analyze usage — understand how visitors interact with the platform and improve features
Communicate with you — send transactional emails (billing receipts, password resets, product updates)
Detect fraud and abuse — identify bot signups and policy violations using hashed IP addresses and behavioral signals
Comply with legal obligations — retain data as required by applicable law

We do not use your data to train AI models, sell to data brokers, or serve behavioral advertising.

4. IP Address Hashing

When you visit any page powered by Spynra Launch — including embedded widgets — we receive your IP address from your browser request. We do not store your raw IP address.

Instead, we apply a one-way SHA-256 cryptographic hash with a rotating daily salt to your IP address. The resulting hash is stored for fraud detection and deduplication purposes (e.g., to prevent a single person from signing up multiple times).

A hashed IP address cannot be reversed to recover the original IP address. The daily salt rotation means hashes from different days cannot be correlated.

5. Referral Tracking

Spynra Launch's core feature is a referral system. When someone signs up via a referral link (e.g., spynra.com/r/abc123), we record:

The referrer's unique code
The new subscriber's email and signup timestamp
The referring subscriber's updated referral count and queue position

Referral data is shared with the campaign owner (the account holder who created the waitlist) as part of their subscriber analytics. Subscribers' emails are never shared with other subscribers.

6. Analytics and Event Tracking

We run first-party analytics on our platform. When you visit any Spynra Launch page, our analytics beacon collects:

Page path — which URL was visited
Referrer — the URL of the page that linked to this page (from document.referrer)
UTM parameters — campaign, source, medium, term, and content values from the URL query string
Visitor ID — a randomly generated UUID stored in your browser's localStorage. This is pseudonymous (no name or email linked) and is used to count unique visitors without tracking you across unrelated sites.
Event type — actions like "waitlist_signup", "referral_copied", "pricing_viewed"

We do not use Google Analytics, Facebook Pixel, or other third-party tracking scripts. All analytics data stays within our own database.

7. Cookies and Local Storage

We use a small number of cookies and browser storage mechanisms. See our Cookie Policy for full details. In brief:

Session cookie — keeps you logged in to your Spynra Launch account
Visitor ID (localStorage) — pseudonymous analytics identifier (not a cookie, not synced to any server profile)
We do not use advertising cookies or third-party tracking cookies

8. Payment Processing (Stripe)

Subscription payments are processed by Stripe, Inc. When you subscribe to a paid plan, your payment card details are entered directly into Stripe's secure payment form. We never see, receive, or store your full card number, CVV, or billing address beyond what Stripe provides to us (such as your billing email and last 4 card digits for display purposes).

Stripe is PCI DSS Level 1 certified. Their privacy practices are described in the Stripe Privacy Policy.

9. Sharing Your Information

We do not sell, rent, or trade your personal information. We share data only in the following limited circumstances:

Campaign owners and their subscribers: Campaign owners can see their subscriber lists (emails, signup times, referral counts). Subscribers cannot see other subscribers' data.
Stripe: We share your email with Stripe to process payments and manage subscriptions.
Legal requirements: We may disclose information if required by law, subpoena, or court order, or to protect the safety of our users or the integrity of the platform.
Business transfers: In the event of a merger, acquisition, or sale of assets, your data may transfer as part of that transaction, with notice provided to you.

10. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. Specifically:

Account data: Retained until account deletion, plus 30 days for safety margin
Subscriber emails: Retained as long as the campaign exists; deleted when you delete the campaign or your account
Analytics data: Retained for 2 years in aggregate; raw event data retained for 12 months
Hashed IP addresses: Retained for 90 days for fraud detection, then purged
Payment records: Retained for 7 years as required by US tax law

11. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

Access — Request a copy of the data we hold about you
Correction — Request correction of inaccurate data
Deletion — Request deletion of your account and associated data
Portability — Export your subscriber data in CSV format at any time
Objection — Object to certain processing activities

To exercise any of these rights, email us at spynra@polsia.app. We will respond within 30 days. We may need to verify your identity before processing requests.

California residents: Under the CCPA, you have additional rights including the right to know what categories of personal information are collected and the right to opt out of the sale of personal information (we do not sell personal information).

EEA/UK residents: Under GDPR, our legal basis for processing is contractual necessity (to provide the Service), legitimate interest (fraud prevention, analytics), and consent (where explicitly obtained).

12. Children's Privacy

The Service is not directed to individuals under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, contact us immediately and we will delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on the platform. The updated policy will have a new "Last updated" date at the top. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

14. Contact

For privacy-related questions, data requests, or concerns, contact us at spynra@polsia.app. We will respond within 30 days for general inquiries and within the legally required timeframes for rights requests.

Contents