01What we collect
- Account info — email and the Clerk user ID we associate with you. Passwords are stored by Clerk, not by Contspot.
- Your graphics — the image files you upload, their titles, tags, bookmark state, file size, and upload date.
- Billing info — if you upgrade to Pro, Stripe stores your card details. We store a Stripe customer ID and your current plan.
- Operational logs — IP address, user-agent, and timestamps for requests, retained briefly for abuse prevention and debugging.
02What we don't collect
We don't track your browsing on x.com or anywhere else. The Chrome extension only talks to contspot.com's API. There is no third-party ad network, no session replay, no fingerprinting.
03The Chrome extension
- Access token — when you paste a Contspot token into the extension, it's stored in Chrome's local extension storage on your device. It's sent only to Contspot's API, over HTTPS, to authenticate requests to your own library (loading, searching, and bookmarking your graphics). We store only a hash of it on our servers, and you can revoke it any time from the extension-auth page.
- On x.com — the extension runs on x.com and twitter.com solely to add the attach button to the compose toolbar and place your chosen image into the composer. It doesn't read your tweets, messages, or browsing activity, and it sends nothing from those pages to us.
- No analytics — the extension itself contains no analytics, telemetry, or trackers of any kind.
04Where data lives
- Account records: MongoDB Atlas (database hosting).
- Image files: Cloudinary (image CDN), under a private folder scoped to your user ID.
- Auth: Clerk.
- Payments: Stripe (we never see your card number).
- Email: Resend for transactional emails.
- Errors via Sentry, product analytics via PostHog.
05Your rights
You can access and edit your graphics from the dashboard. You can delete your account at any time from the profile menu — this wipes your graphics from Cloudinary and MongoDB, cancels any active Pro subscription, and removes your Clerk record. EU/UK residents can request a copy or full deletion under GDPR by emailing hi@contspot.com. We respond within 30 days.
06Cookies
We use the bare minimum: Clerk's session cookie keeps you signed in, and Stripe sets a session cookie during checkout. No analytics or advertising cookies. PostHog runs in cookieless mode.
07Children
Contspot is not directed at users under 13. If we learn we've collected data from a child under 13, we'll delete it.
08Changes
We'll email you before any material change to this policy takes effect.
09Contact
Privacy questions or data requests: hi@contspot.com.