Privacy Policy

Last updated: October 25, 2026

1. About DevSpec

DevSpec is where your team, your knowledge and your agents build software together: shared rooms where people work with Dev, our AI assistant, and with AI agents like Claude Code or Pi running on their own computers, alongside the project's tasks, decisions, documents and connected code.

DevSpec is provided by Panther Business IT Services Ltd, a private limited company registered in England and Wales (company number 10050883), whose registered office is at Suite 1 Windrush Court, Blacklands Way, Abingdon, Oxfordshire, OX14 1SY ("we", "our" or "us").

This Privacy Policy explains how we collect, use, disclose, and protect your personal information, including sensitive personal data, when you use our service.

2. Information We Collect

Account Information

When you create an account, we collect:

• Email address
• First and last name, and a profile picture if you have one
• Your job title in an organization, if you add one
• Language and other preferences
• Authentication data via our identity provider (Clerk), including when you agreed to our Terms of Service and this Privacy Policy

Session Data

During your sessions, we collect and store:

• Your messages and questions
• Replies from Dev and from agents
• Session transcripts
• Files you upload (documents, images)
• Voice recordings (if you use voice input)

Agents You Connect

When you connect an AI agent like Claude Code or Pi running on your computer, we store:

• The computer's name and the folder the agent works in
• The agent, its DevSpec plugin version and the model it reports using
• What it sends to and receives from DevSpec, such as messages, task updates and the progress it reports

Project Records

Each project keeps a shared record that Dev and your agents search when a request needs it. We do not build a profile of you from it. It can include:

• Projects, repositories, databases and deployments you've connected
• Decisions, conventions and other memories recorded by people and agents
• Tasks, plans, goals and documents
• A search index of connected code
• Personal instructions you give Dev in your settings

Service and Operational Information

To provide the service, account for usage and investigate faults or abuse, we process:

• Session dates and duration
• Feature usage (voice, text, file uploads)
• Usage for billing purposes
• Operational and security records, including request metadata, IP addresses where needed for security, technical identifiers and error details

Optional Measurement

Page performance and public website/signup measurement are separate optional purposes. They remain off unless collection is available and you explicitly allow that purpose. Signing in or accepting our terms is not consent. Choose or withdraw permission at Privacy choices, without signing in, or in app settings. A previous decline and your browser's Global Privacy Control or Do Not Track request remain respected.

Page-performance measurements use coarse page categories, not raw project or session URLs. Website/signup measurement uses a temporary browser observation to compare successful public-assistant use and new-account signup, not a permanent visitor-to-account history. Neither purpose includes conversation text, advertising profiles or session replay. Product-update email is a separate choice; these controls never subscribe you or stop essential account messages.

Payment Information

Payment processing is handled by Stripe. We do not store your full credit card details. We retain payment/customer references, amounts and transaction status needed for billing, reconciliation and support, rather than full card numbers.

3. How We Use Your Information

To Provide the Service

• Produce Dev's replies and carry out the work you or your agents ask for
• Search your project's records, code and past sessions when a request needs them
• Transcribe voice input
• Read replies aloud when you ask
• Charge usage to the organization that owns the project

To Improve Our Service

• Debug issues and monitor performance
• Use service records for coarse project adoption and support, without building browser activity profiles
• Use separately permitted optional performance and conversion measurements when those purposes are available

We do NOT use your conversations, context, or personal information to train AI models.

4. AI Provider Data Sharing

DevSpec manages the models used for requested features and background work. The company processing a request depends on that function and our service configuration; a model's creator is not always the company hosting it. Messages, supplied files, relevant history, search queries and project context may contain personal information. We do not treat submitted content as non-personal merely because account-profile fields are not sent separately.

Managed AI Responses and Background Processing

Supported processing includes Anthropic, OpenAI, Google (including Vertex AI), xAI and Moonshot, as well as hosted models from Z.ai. Requests may be processed through OpenRouter and its serving providers, or through Fireworks. Depending on the requested function, processing can include:

• Your name
• Your messages in the current session
• Relevant project records (code, tasks, memories and documents)
• Session transcripts, for summaries and for keeping the project's records up to date
• Any files you upload (images, documents, code)

Anthropic Privacy Policy

Mistral AI - Code Search Embeddings

When your repositories are indexed for semantic search, receives:

• Code and file snippets from repositories you connect (to compute search embeddings)
• Code can itself contain personal information; account-profile details are not sent separately for this embedding request

Mistral AI Privacy Policy

Voyage AI - Search Embeddings for Session Transcripts and Search Re-ranking

So that past sessions can be found by meaning, and so that code and task search return the most relevant results first, receives:

• Text of session transcripts (to compute search embeddings)
• The text of a code search query together with the code snippets it matched, to order them by relevance (re-ranking)
• The text of a task search query together with the titles and descriptions of the tasks it matched, to order them by relevance (re-ranking)
• No account details are sent

Voyage AI Privacy Policy

OpenAI - Responses and Search Embeddings

Alongside the response processing described above, search-related processing can include:

• Text of tasks, memories and uploaded documents you choose to make searchable (to compute search embeddings)
• Search queries and knowledge text may contain personal information; account-profile fields are not needed separately for embedding

OpenAI Privacy Policy

Deepgram - Voice Transcription

If you use voice input, receives:

• Audio recordings of your voice messages only
• Speech can contain personal information. Audio and the technical options needed for transcription are processed, not a separate copy of your account profile

Deepgram Privacy Policy

xAI - Voice Responses

If you use voice responses, receives:

• The AI's response text only (to convert to speech)
• Response text can contain personal information, along with voice and output-format options needed to produce the audio

xAI Privacy Policy

Provider Data Retention

Provider retention varies by service, endpoint, account settings and contract. Some services process prompt and response content without persistent storage, while others retain data for safety, requested features or legal obligations. We do not apply a blanket 30-day deletion claim to every provider, backup or processing path. DevSpec's own work-data and operational-record rules are described below.

5. Other Third-Party Services

Repositories, databases and agents you connect also involve their own service providers. Relevant work is exchanged to perform the action you request; those providers' policies apply to their processing. Lunary no longer receives new model traces from DevSpec. Stopping those transfers does not automatically erase historical copies; contact us about previously processed data.

6. Organizations

DevSpec is built around organizations. Every person has one, and teams create more. An organization owns the work its members do in DevSpec: its projects, its rooms (sessions) and the messages in them, its tasks, memories, artifacts, uploaded files and the search indexes built from its connected repositories.

The organization pays for the work done in its projects. Its Owners and Admins manage members, billing and settings and can see the balance, spend and each member's usage. An Owner can export everything the organization owns and can delete the organization (section 9).

7. Data Security

We implement robust security measures to protect your data:

• Encryption in transit: All data transmitted over TLS/HTTPS
• Encryption at rest: Database and file storage encrypted using AES-256
• Access follows membership: Database policies and application checks limit every read and write to the organizations, projects and rooms the person belongs to
• Authentication: Secure login through an industry-leading provider (Clerk) with optional two-factor authentication
• Stored files and downloads: Files live in private storage and are served only through short-lived signed links issued after an access check
• Access controls: Database access is restricted to essential infrastructure operations. We do not read your rooms in the course of operating the service; they are processed by the AI providers described in section 4

8. Data Retention

• Work data (rooms and messages, tasks, memories, artifacts, uploaded files, code indexes): kept by the organization that owns it until it deletes it or the organization is deleted. Deleting an organization removes its projects, rooms, files and search indexes.
• Agent working notes (the thinking and step-by-step detail behind an agent's replies, shown under Technical details): kept briefly — up to 7 days, oldest removed first to keep storage bounded — so you can follow and revisit recent work. They exist only to operate the product for you: never sold, never used to train AI models. Your rooms, messages, and the record of what changed (tasks, memories, artifacts) are work data and stay until you delete them, as above.
• Account data (sign-in, profile, preferences, notifications, saved connections and tokens): kept while your account is open and removed when you close it. Messages and work you contributed stay with the organizations they belong to, attributed to "Former member".
• Inactive accounts: an account unused for two years is closed after notices 30, 7 and 1 day before. A member of an organization with money in its balance is not closed; they get a reminder after a year instead. If the account is the only owner of an organization, we email instead and leave it open.
• Voice recordings: deleted after 48 hours. The transcribed text stays as your message.
• Search queries: the text of searches made in DevSpec, stored without your name, account or organization, is kept for 45 days to improve search results.
• Payment records: an organization's payment history and ledger are kept after the organization is deleted or an account is closed, for at least seven years, to meet financial record-keeping obligations.
• Exports you request: available to download for 7 days, then removed.
• Security logs (requests that reach our servers, with their time, path, IP address and browser type, and every refused or revoked access, such as an invalid access token or a request without permission): kept for 12 months, so a security incident can still be investigated when it is discovered late.
• Diagnostic logs (errors and technical events we use to find and fix faults): kept for 90 days.
• Other operational records, such as our hosting providers' own system logs and records of administrative changes to an account, are kept only as long as they are needed to run and secure the service. Contact us for the details relevant to a privacy request.
• Public-assistant rate-limit counters: eligible for removal after seven days without activity, with daily cleanup. IP keys in these counters are window-specific keyed identifiers, not permanent marketing identities; they are not treated as anonymous data.
• Privacy choices: remembered for up to one year from an explicit choice, without renewal merely because you read a page.
• Optional conversion measurement: a fixed 30-day observation window, followed by deletion of temporary correlation within 24 hours. Withdrawal removes the still-identifiable observation. Aggregate totals are kept for 24 months; optional collection remains unavailable until its safeguards and approvals are in place.
• AI provider retention: service-specific settings and agreements apply (section 4), rather than a universal 30-day guarantee.

9. Your Rights and Controls

Four controls, in the product:

Export Your Data

Settings → Privacy & data → Request my export. A zip with your profile and preferences, your memberships, every message you wrote with the room it was in, your notifications, your usage and ledger entries in dollars, and the files you uploaded. It is prepared in the background; we tell you when it is ready and the download works for 7 days. Large exports arrive in numbered parts.

Close Your Account

Settings → Privacy & data → Close my account. Your sign-in, saved connections and tokens, preferences and notifications are removed and you cannot sign in again. Messages and work you contributed to your organizations stay, shown as "Former member". A workspace that only you own, with nobody else in it, is deleted with your account, and the confirmation names it. If you are the only owner of an organization that has other members, transfer ownership first.

Export Your Organization's Data

Settings → Organization → Request the organization's export(Owners only). A zip with every project and repository record, tasks with their history, memories, artifacts as markdown, uploaded documents, every room with every participant's messages and attachments, discussion points, plans, polls, goals, features, automations, members and roles, and the ledger. Prepared in the background, ready within minutes, downloadable for 7 days.

Delete Your Organization

Settings → Organization → Delete organization(Owners only). The organization's projects, rooms, files, search indexes and its sign-in group are removed for everyone in it; its payment history is kept. Your only organization cannot be deleted on its own: closing your account is the way to remove it.

GDPR & CCPA Rights

Under applicable privacy laws, you also have the right to:

• Access - Request details about what data we hold
• Rectification - Correct inaccurate data
• Portability - Receive your data in a standard format
• Restriction - Limit how we process your data
• Objection - Object to certain processing activities

For your account data, use the controls above or email us at[email protected] for access, rectification, restriction or objection; we answer within 30 days. For an organization's records, ask an Owner or Admin of that organization: they can export or correct them, and we act on their instruction.

10. Cookies & Analytics

Essential Cookies (Always Active)

We use minimal cookies required for the service to function:

• Authentication cookies - Required to keep you logged in (Clerk)
• Session cookies - Required for security and database access
• Preference cookies - Remember your settings (e.g., sidebar state)

Optional Measurement Requires a Separate Choice

Page performance and website/signup measurement each require an explicit choice and remain off while collection is unavailable. Permitted performance measurements pass through our server to Axiom; bounded conversion records use our database. Declining either does not disable necessary sign-in, security, billing or requested work.

Change or withdraw your choices at Privacy choices without signing in, or in the app's Privacy & data settings. Choices apply to this browser; other devices have their own choices. Older acceptance is not converted into permission for a new purpose.

We do not use advertising cookies, tracking pixels, or sell data to advertisers.

For detailed information about specific cookies we use, see our Cookie Policy.

11. International Data Transfers

Your data may be processed in countries outside your residence, including the United States, where our AI providers are located. We ensure appropriate safeguards are in place for international transfers, including Standard Contractual Clauses where required by GDPR.

12. Age Requirements

DevSpec is intended for adults. You must be at least 18 years old to use this service. We do not knowingly collect personal information from anyone under 18.

13. AI Output Disclaimer

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email and/or through the app. Continued use does not grant optional-measurement consent; a new purpose requires a new explicit choice before collection for that purpose begins.

15. Contact Us

For privacy questions, data requests, or concerns, contact us:

• Email: [email protected]
• Post: Panther Business IT Services Ltd, Suite 1 Windrush Court, Blacklands Way, Abingdon, Oxfordshire, OX14 1SY
• Privacy Settings: Manage your data

By using DevSpec, you acknowledge that you have read and understood this Privacy Policy. Your trust means everything to us - we are committed to protecting your privacy and the sensitive information you share.