Privacy Policy

Who we are

SiteSpin is an iOS app and web service that helps people create and publish websites by chatting with an AI. This policy explains what information we collect and how we use it. "We" and "us" refer to SiteSpin and the company that operates it, which is established in Sweden. Because of that, the European rules described below shape how we handle your data wherever in the world you are reading this.

What this policy covers

This policy applies to the SiteSpin iOS app, the SiteSpin web app and website at sitespin.app, and websites that SiteSpin generates and hosts on *.sitespin.app subdomains. It does not cover websites that SiteSpin users connect to their own custom domains after publishing. Once a site is hosted on a custom domain, the visitor relationship is between the site owner and their visitors.

Three of those behave differently and it is worth separating them up front. Our marketing site and our web app carry advertising and analytics code, described under Cookies and tracking. The websites we publish for our customers carry none of it, described under Analytics and visitor data. The iOS app carries neither, and measures installs the way What we collect describes.

What we collect

• Name and email. When you sign in with Apple, Google, or a one-time code sent to your email, we receive your email address (and your name when the provider supplies it). Apple only shares your name on your first sign-in.
• Business contact details. When you describe your business in the chat, you may type details like your phone number or business address. We store whatever you share so the AI can include it in your generated website.
• User content. The photos you upload, the business details you share, and the website code SiteSpin generates from your inputs. All of this is yours.
• User identifier. A random user ID created when you first open the app, used to keep your projects associated with you.
• Purchase history. When you subscribe, we receive a confirmation of the purchase. For subscriptions bought in the iPhone or iPad app, Apple is the merchant of record and we never see your card details. For subscriptions bought on the web, payment is processed by our web payment provider (RevenueCat Web Billing, using Stripe); we never see your full card number.
• Notification token. If you turn on notifications, we store a device token from Apple so we can send you alerts about your own account: when your site finishes building, when an edit or a republish finishes or fails, when a visitor submits your contact form, when a domain or a forwarding address needs attention, and when a subscription ends or a site is about to go offline. The token is used only to deliver these notifications.
• Website and advertising measurement. On our marketing site and our web app, code from Meta and Google records the pages you view, your IP address, and the ad click that brought you here if there was one. When you create an account, a hashed form of your email address is sent to both, and a hashed form of your SiteSpin account identifier to Meta, so the signup can be matched to the ad that led to it. Some of these events are also sent from our servers rather than from your browser, which changes who transmits them but not what they contain. Cookies and tracking sets out exactly what is stored, for how long, and how to refuse it.
• App install attribution. To know which ads bring people to SiteSpin, the iOS app asks Apple for an attribution token the first time it launches and sends that token to our own servers, together with a random install ID the app generates for itself. We exchange the token with Apple, which tells us which Apple Ads campaign, ad group, keyword and ad the install came from, and the country it happened in. When you sign in, that install ID is linked to your account, so we can tell which campaigns lead to real signups rather than just downloads. The app separately reports a number between 0 and 10 to Apple describing how far you have got, from installed through signed up to subscribed; that goes to Apple rather than to us and carries no identifier. Our servers also tell Meta that an install happened, naming nobody: that message carries no account, no device identifier and no IP address. Our subscription provider, RevenueCat, independently collects the same Apple attribution token and an Apple identifier scoped to our app alone (the vendor identifier, IDFV), which cannot be used to recognise you inside another company's app. None of this uses a cross-app advertising identifier, and we never ask for App Tracking Transparency permission, because the iOS app does not follow you into other companies' apps or websites. Our two websites are a different matter, and are covered under Cookies and tracking.
• Crash reports and diagnostics. When SiteSpin hits a fault, meaning the app or the website crashes, freezes, or runs into an error it has to handle, we receive a technical report so we can find and fix it. That report contains the fault itself, the place in our code where it happened, your device model, operating system version, app version, device language and time zone, the internal reference number of your account, and a random identifier for this installation of the app, so we can tell whether a fault affected one person or a thousand and whether a new version of SiteSpin made things better or worse. The same tool records how long requests to our own servers take and whether they succeed, so we can find what is slow. It contains none of your content: not your chat messages, business details, photos, name, email address, or anything on your site. We do not collect screenshots, screen recordings, or a record of the screens you visited.

What we do not collect

• Your precise location
• A cross-app advertising identifier (IDFA), or any identifier that would let us follow you into another company's app
• Your contacts
• Health, financial, or sensitive information
• Product analytics inside the SiteSpin iOS app, such as which screens you visit or how you move through the product, beyond the install and campaign measurement and the crash reporting described above. The SiteSpin web app is different: Google Analytics runs there, under Cookies and tracking
• Any data sold to a data broker. US state law treats the advertising measurement described below as a "share", and California privacy rights explains how to stop it

How we use Anthropic Claude

SiteSpin uses Anthropic's Claude API to read your messages and generate your website. When you send a chat message, we transmit the message text, any photos you attach, and the relevant business details from your profile to Anthropic. Anthropic processes the data to produce the AI response (a follow-up question, a generated site layout, an edit, and so on) and returns it to us.

Anthropic retains commercial API data for up to seven days for abuse monitoring, then deletes it. Anthropic does not use commercial API data to train its models. See Anthropic's commercial terms for details.

Sending your inputs to Anthropic is how we build the website you asked us to make, so our legal basis is performance of our contract with you (and, before you have an account, steps we take at your request). The App Store also requires us to get your permission in the app before anything goes to Anthropic the first time, and you can turn that off any time in Settings → Privacy → AI processing. With it off, you can browse the app but cannot build or edit a site.

Content moderation

To keep SiteSpin safe, we run an automated check (using Claude) over the content you submit, to enforce our Acceptable Use Policy. We record the outcome of every check, not only the ones that flag something, because a decision is only reviewable against the ones around it. Each record holds the decision and the reason for it, the model that made it, the opening 200 characters of what you submitted, and a short piece of surrounding context such as the question you were answering. We keep these so we can act on abuse, detect repeat violations, and reverse a call we got wrong. Sites that violate our rules may be unpublished and the accounts suspended. These records are deleted when you delete your account.

Third parties

SiteSpin uses the following third-party services to run. Each one only receives the data described.

• Anthropic (Claude API). See the dedicated section above. Anthropic receives the chat messages, photos, and business details you share so the AI can generate your website.
• Supabase. Hosts our database, our file storage, and the sign-in system. Photos you upload live there, and they are served from there when they appear on a site we publish for you, so a visitor's IP address reaches Supabase the way it reaches the host of any image on any website.
• Render. Runs the SiteSpin servers, in Frankfurt, Germany. Every request to SiteSpin reaches them, so in handling it they process whatever that request carries.
• Cloudflare. Sits in front of those servers as their network edge, absorbing attacks and passing legitimate traffic through. Receives the IP address and the request details of everyone who reaches our API.
• Google (sign-in). If you choose "Continue with Google," Google verifies your identity and shares your name and email with us. We never receive your Google password. This is separate from the advertising products below.
• Google Ads and Google Analytics. Measure how our advertising performs and how people move through our marketing site and our web app. Receive the pages you view on those two sites, your IP address, the identifier attached to a Google ad click if you arrived from one, and, once you create an account, a hashed form of your email address so that signup can be matched to the ad. From August 2026 Google also uses IP addresses for advertising measurement and personalisation in the European Economic Area, the United Kingdom and Switzerland. Google's tag stays on the page even when you refuse, and reports the refusal: that report sets nothing on your device and reads nothing from it. Neither product runs on the websites SiteSpin publishes for you.
• Meta. Measures how our advertising on Facebook and Instagram performs. From your browser, Meta receives the pages you view on our marketing site and our web app, your IP address, and, once you create an account, a hashed form of your email address and of your SiteSpin account identifier, so that signup can be matched to the ad. Where the law requires us to ask first, Meta's code is not loaded at all until you have agreed, so nothing reaches Meta including your IP address. Elsewhere it loads unless you tell us not to. Meta also receives some events from our servers rather than from your browser: that an app install happened, which names nobody at all, and that a subscription or trial started, which carries a hashed form of your email address and account identifier, the amount paid, and Meta's own click and browser identifiers where your browser has them. Meta does not run on the websites SiteSpin publishes for you.
• Vercel. Hosts the websites that SiteSpin publishes for users, the SiteSpin web app, and the marketing site at sitespin.app. Vercel is also our domain registrar: if you claim a domain, the registrant details described under Domain registrant details go to Vercel, who passes them to the registry.
• Pirsch. Provides the cookieless visitor analytics on the websites SiteSpin publishes for you (see "Analytics and visitor data" below). Receives a salted, non-reversible hash used to count unique visitors; no personal data, no cookies.
• RevenueCat. Manages your subscription state and, for subscriptions bought on the web, processes the checkout (RevenueCat Web Billing). Receives your user ID, your email address, subscription and receipt data, and, for web purchases, the billing details needed to take payment. Inside the iOS app RevenueCat also collects Apple's attribution token and an Apple identifier scoped to our app alone (IDFV), so that a subscription can be attributed to the campaign that produced the install. Neither can be used to recognise you in another company's app.
• Stripe. Processes card payments for subscriptions bought on the web (via RevenueCat Web Billing) and provides the billing-management portal. Receives the payment details you enter at checkout. We never see your full card number.
• Apple. Processes payments for purchases made in the iPhone or iPad app (we never see card data) and delivers push notifications through the Apple Push Notification service. Apple also runs the install measurement described under "App install attribution": we send it the attribution token your device produced and it tells us which campaign that install came from, and the number the app reports about how far you have got goes to Apple and no further. Separately we read our own advertising spend from Apple, which is a report about our campaigns and contains nothing about you.
• Resend. Delivers our email. That means the messages you send us through the help page or the contact form, the messages a visitor submits through a form on a site we publish for you, forwarded to the address you nominated, and email about your own account such as a trial ending, a payment that failed, or a site about to go offline. Receives the recipient address and the contents of the message.
• Sentry. Records technical faults so we can find and fix them: on our own servers, inside the SiteSpin iOS app, and inside the SiteSpin web app. Receives the error, the place in our code where it happened, and the internal reference numbers of the account, project, and task involved, so we can tell how many people a fault affected. From the app it also receives your device model, operating system version, and app version. Sentry processes this data in the European Union. It never receives your chat messages, business details, photos, name, email address, or the content of your site.

Cookies and tracking

This section is about the two sites we run for ourselves: the marketing site at sitespin.app and the SiteSpin web app at app.sitespin.app. It is not about the websites SiteSpin publishes for you, which work differently and are covered in the next section.

We advertise on Google and on Meta, and we measure whether that advertising works. Doing so means those two companies store the following on your device and read it back on later visits. None of it is needed to deliver the site, and refusing it changes nothing about what you can do here.

Who we ask, and when. In the European Economic Area, the United Kingdom and Switzerland, we ask before any of it loads, and nothing is stored or read until you agree. Our legal basis there is your consent, and nothing else. Everywhere else these load by default and you can turn them off whenever you like. Google also uses your IP address for advertising measurement and personalisation, which is part of what you are being asked about.

How to change your mind. Every page carries a "Cookie settings" control and a "Your Privacy Choices" control in the footer, and both open the same chooser. Refusing deletes the cookies in the table above and reloads the page, so nothing carries on running in the background. Withdrawing is meant to be exactly as easy as agreeing was. If your browser sends a Global Privacy Control signal, we treat that as a refusal and do not ask.

What a refusal still sends. Google's tag stays on the page and tells Google that you refused. That request sets no cookies, reads nothing from your device, and carries no identifier that would let anyone recognise you on a later visit. Like any request to any website, it reaches Google with your IP address and the page you were on. Meta's code is a different case: where we are required to ask, it is not loaded at all before you agree, so Meta receives nothing whatsoever, and where you have opted out it is not loaded either.

Analytics and visitor data

Websites that SiteSpin publishes on your behalf include private visitor analytics powered by Pirsch. Pirsch is cookieless and uses a salted 24-hour hash of IP address, user agent, and date to count unique visitors. No personal data is stored. Visitors to SiteSpin-generated websites do not need a cookie banner. Pirsch does not run inside the SiteSpin iOS app or the SiteSpin web app.

Nothing described under "Cookies and tracking" runs on your site. We chose a cookieless tool for the sites we publish for you precisely so your visitors would never meet a consent banner, and we then made the opposite choice on our own two sites, because we buy advertising and have to measure it. Both decisions are deliberate, and they are separate. Your visitors are not tracked by Meta or Google on our account.

Besides Pirsch, the only company a visitor's browser reaches is Supabase, which serves the photos on your site, and Vercel, which serves the site itself. Both receive the visitor's IP address in the ordinary course of sending them a file. Typefaces are served from your own site rather than from a font network, so no third party learns who is reading your pages that way.

When a visitor submits a contact or inquiry form on a website SiteSpin hosts for you, we store the form contents along with the visitor's IP address (kept for up to 90 days, then removed) and browser user-agent, so we can deliver the submission to you and prevent spam.

Domain registrant details

If you claim the domain included with your subscription, ICANN rules require us to collect and pass a full registrant record to the domain registry: your name, email address, phone number, and postal address, plus an optional organisation name. This is the one place in SiteSpin where a postal address is required, and it is required by the registry rather than by us. We send it to our registrar, Vercel, who passes it to the registry operating the extension you chose.

We keep that record for as long as the registration is live, because a renewal, a transfer, or a registry re-verification needs it. Registrations are covered by WHOIS privacy, so the record is not published: the extensions we offer all permit redaction, which is why we offer those and not others.

Deleting a project that holds a domain erases the registrant details we stored for it: your name, address, and phone number.

Deleting your whole SiteSpin account is different, and this is the one place where deletion does not remove everything. A registration outlives the account: it stays yours, it runs to its expiry date, and you can transfer it away. The registry requires an accurate registrant record for as long as a name is registered, and that record is also how we reach you if you later ask us for a transfer code, so we keep it rather than breaking the registration we sold you. Everything else tying it to you is removed. If you would rather we erased the registrant record too, tell us: we will remove it once the registration has expired or moved to another registrar, and in the meantime we will not use it for anything but the registration itself.

Where your data goes

Most of the companies listed under "Third parties" are based in the United States, including Meta and Google. Where personal data reaches them from the European Economic Area, the United Kingdom or Switzerland, the transfer relies on the EU-US Data Privacy Framework and its UK and Swiss extensions, and on the European Commission's standard contractual clauses where the framework does not apply.

Our own servers run in Frankfurt, Germany. Sentry processes our data in the European Union. Anthropic processes data in the United States under the same mechanisms as above.

Your rights

You can:

• Access the data we hold about you by emailing us.
• Export the messages your forms have collected and your visitor statistics from inside SiteSpin, on either the web or the app: both download as a spreadsheet file. There is no self-serve download of a site's own files yet; until there is, ask us and we will send you a copy.
• Delete your account in SiteSpin: in the app under Settings → Account → Delete account, and on the web under Settings, in the section headed Danger zone. Deletion begins at once and normally finishes within seconds. Your account, your sites, your chat history, your uploaded photos, the messages your forms collected and your visitor statistics are removed, and your published sites are taken down. If a step fails, it is retried until it goes through rather than left half done. A few records of how the product was used are kept with everything identifying you stripped out of them first, so they can no longer be traced back to you. Domain registrant details covers the one thing that is deliberately kept. Active subscriptions continue to renew unless cancelled separately. If you subscribed via the iPhone or iPad app, cancel in your device's Settings → Apple ID → Subscriptions. If you subscribed on the web, open your SiteSpin account settings and manage the subscription from there.
• Withdraw consent to advertising and analytics cookies, using either control in the footer of any page. See Cookies and tracking.

EU residents have additional rights under GDPR, including the right to object to processing and to lodge a complaint with a supervisory authority. Because we are established in Sweden, ours is the Swedish Authority for Privacy Protection (IMY), and you can also complain to the authority in the country where you live. Withdrawing consent is free, and is as easy as giving it was.

California privacy rights

California law, and comparable laws in other US states, treat the advertising measurement described under "Cookies and tracking" as a "sale" or a "share" of personal information, even though no money changes hands for it. What is shared is the identifiers in that table and, once you have an account, a hashed form of your email address. We share nothing else for advertising, and we do not knowingly sell or share the personal information of anyone under 16.

To opt out, use the "Your Privacy Choices" control in the footer of any page. We also honour the Global Privacy Control browser signal automatically, so you do not have to ask us twice. Opting out stops the sharing and deletes the identifiers that were already set.

Depending on the state you live in, you may also have the right to know what we hold, to receive a copy of it, to correct it, and to have it deleted. "Your rights" above explains how, and the same process applies.

We will not deny you service, charge you a different price, or give you a lower standard of service because you exercised any of these rights.

Children

SiteSpin is rated 4+ but is not intended for users under 13. We do not knowingly collect personal information from children under 13.

Changes to this policy

We may update this policy from time to time. The "last updated" date at the top will reflect the most recent change. Material changes will be announced in SiteSpin (web or app).

Contact

Privacy questions, or a request to see, correct, or delete what we hold about you? Visit our help page, or write to support@sitespin.app. We try to respond within one business day.