1. Scope and responsibilities

This policy explains how Specita handles information when you visit specita.com, create an account, use a workspace, connect integrations, or contact us. Specita is operated by Muhammad Taimoor. In this policy, “we” and “our” refer to this service operator. Contact us at support@specita.com about this policy or your information.

We handle account, service, and security information to operate Specita. Your organization chooses the release evidence it provides and the services it connects. If you use an organization-managed workspace, its administrators control membership, integrations, and shared records. Contact your administrator as well as us about information managed by that organization.

2. Information we handle

The information available to Specita depends on how you use it. Optional integrations are not required to create a release record.

Waitlist information: the email address you submit, your consent to launch and early-access updates, and the signup time. The waitlist does not create an account or start a subscription. Stored waitlist email addresses are encrypted; keyed hashes prevent duplicate entries and limit submission abuse.
Account information: your email address, name when supplied, sign-in provider identifier, workspace memberships, roles, invitations, and onboarding answers. Google sign-in requests basic profile and email information, not access to Gmail, Google Drive, or Google Play.
Workspace content: app and platform names, descriptions, versions, environments, delivery reports, commit identities, release notes, response owners, investigation notes, and operational activity.
Connected source evidence: repository metadata, commit messages and authors, pull-request information, file paths, and selected code-change snippets from repositories your workspace connects.
Store and runtime evidence: app identifiers, available store observations, release and environment tags, session and error counts, issue titles, event identifiers, and selected stack-frame file paths, functions, and line numbers. Text supplied by your tools can itself contain personal information; avoid including unnecessary personal or sensitive data.
Integration credentials: OAuth tokens and the API keys or key files you provide. Stored connection credentials are encrypted on the server. They are used to communicate with the connected provider and are not returned as part of workspace evidence.
Slack information, when enabled: workspace, channel, user, event, and thread identifiers; messages that explicitly mention the installed app; and the replies or briefs Specita sends. This is not a general import of all channel messages.
Service and security information: request metadata, browser user-agent information, errors, diagnostic logs, and account activity. Infrastructure providers process network information such as IP addresses; application authentication audit records use a keyed IP hash.
Billing information, where checkout is enabled: customer, checkout, order, and subscription identifiers, plan, billing interval, payment status, and related billing events. Payment details are handled by Polar and its payment providers; Specita does not collect or store full card numbers.
Support information: the contact details and message content you send us. Do not send passwords, access tokens, private keys, or sensitive source code in support requests.

3. How we use information

We use information to authenticate accounts, enforce workspace access, provide release records and comparisons, generate analysis, deliver notifications you configure, process enabled billing, answer support requests, and maintain the security and reliability of the service.

We also use limited onboarding and acquisition information to understand how people find Specita and improve setup. We do not sell personal information or share it for targeted advertising. We do not use customer workspace content to train a Specita-operated AI model.

If you join the waitlist and consent, we use your email for launch and early-access updates. Contact support@specita.com to leave the list or withdraw that consent. Joining does not guarantee an access date.

Where applicable law requires a legal basis, service delivery is based on performing our agreement with you; security, troubleshooting, and service improvement are based on legitimate interests subject to your rights; legally required records are retained to meet legal obligations; and consent is used where required. You can contact us about objections or withdrawal of consent. Withdrawing consent does not undo processing that was lawful before withdrawal.

4. Source analysis and AI

Specita works with AI service providers to generate release-risk analysis. When analysis runs, including automatic briefs for eligible reported deliveries, selected release context is sent to those providers. This can include commit messages, pull-request titles, file paths, and bounded code-change snippets. The generated results and supporting evidence are stored with the release.

We do not intentionally include connection credentials in AI requests. Source snippets and repository text are not guaranteed to be free of secrets or personal information. Only connect repositories and submit content that you are authorized to process in this way. Remove sensitive content from your source and reports before it reaches Specita.

AI service providers may apply their own retention, security, and processing terms. We do not promise zero retention, a blanket exclusion from provider model training, or processing in a particular country. Contact us before connecting content with strict confidentiality or data-residency requirements, or if you need details about the providers involved in your workspace’s processing.

AI output can be incomplete or wrong. It is a review aid, not proof that a change caused an incident or authorization to release software.

5. Sharing and service providers

We share information as needed to operate the features you use, with authorized workspace members, and with the following providers. A provider may also process information independently under its own terms.

Cloudflare hosts the website and API and processes delivery, network, and diagnostic information. Neon hosts the PostgreSQL database. Private GitHub storage can hold encrypted backup files; it is separate from connecting a customer repository.
AI service providers process selected source-analysis context. Resend delivers sign-in links, invitations, and enabled email notifications, including the recipient address and message content.
Google, GitHub, and other enabled identity providers supply the information needed to sign in. Connecting GitHub, App Store Connect, Google Play, Sentry, or Slack authorizes exchanges with that provider for the chosen integration.
If Slack or email delivery is enabled, release information is sent to the destination your workspace configures. People who can read that channel or mailbox can see the delivered content, including copies retained outside Specita.
Polar handles checkout and subscriptions where available. Specita sends identifiers needed to associate billing with the correct workspace and receives billing status and transaction records.
We may disclose information when legally required or reasonably necessary to investigate abuse, protect rights or security, or resolve a dispute. If the service is transferred to a new operator, relevant information may transfer with it, subject to applicable law and appropriate notice.

6. Cookies and browser storage

Specita uses cookies for authenticated sessions and short-lived, browser-bound sign-in challenges. These cookies support account access and protect the sign-in flow. Blocking or deleting them can prevent sign-in or end a session.

On the homepage, sign-in, onboarding, and documentation routes, the current site can store bounded campaign source, medium, campaign name, and referring domain in local storage under specita:first-touch. The application stops using that stored attribution after 30 days; the browser entry can remain until replaced or cleared. Attribution can be attached to your account during onboarding. We do not store the full referring URL in this field.

You can clear cookies and local storage in your browser. Clearing browser storage does not delete account information or records already saved to a workspace. Provider websites, including checkout and sign-in pages, have their own cookie practices.

7. Retention and deletion

We retain account information and workspace evidence while needed to provide the service, maintain release history, meet legal obligations, handle security incidents, or resolve disputes. Retention depends on the type of record and the workspace’s use; we do not currently offer a universal automatic deletion period for all records.

Disconnecting an integration stops that connection from being used for new provider requests. It does not automatically delete imported release history, existing AI results, audit records, or messages already delivered elsewhere. Revoke the underlying key or authorization at the provider too if it should no longer be usable.

Contact support@specita.com to request account or workspace deletion. We will verify your identity and authority over the affected workspace before acting. Some records may need to be retained for legal, security, billing, or other permitted reasons. Already-created backups can retain limited copies until their retention period ends; live-record deletion does not immediately remove every backup copy.

8. Security and international processing

We use HTTPS, server-side access checks, encrypted stored integration credentials, and hashed session tokens to help protect information. No system is completely secure. Specita does not promise a security certification, zero-retention AI processing, a particular data-residency region, or uninterrupted availability.

Our infrastructure and connected providers can process information in countries other than yours. The countries and legal protections can differ by provider and configuration, and applicable law may require additional transfer safeguards. Contact us before submitting information that requires a specific processing location or a separately agreed data-processing contract.

9. Your choices and rights

You can choose which optional integrations to connect. Owners and admins can manage connections and workspace membership. You can sign out, remove browser storage, and revoke provider access from the provider’s settings.

Depending on applicable law, you may have rights to access, correct, export, delete, restrict, or object to the processing of your personal information, and to complain to a relevant data-protection authority. Send a request to support@specita.com. We will assess it under the law that applies and may ask for information needed to verify the request. Requests are handled through support rather than an automated self-service process.

For organization-managed evidence, your organization may need to authorize or handle the request. Requests do not grant access to another person’s account or another organization’s records.

10. Children

Specita is a business software service, not a service directed to children. Do not create an account if you are below the age of legal adulthood in your jurisdiction. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action.

11. Changes and contact

We may update this policy as the service or its data practices change. The effective date identifies the current version. We will provide additional notice of material changes where required by applicable law.

For privacy questions, deletion requests, or information about the service operator, email support@specita.com. Do not include credentials, session links, or sensitive source patches in your message.