Privacy
SpecBox app privacy
What data the app for iOS and Android handles, why, who it is shared with, how long it is kept and how to delete it.
Updated on
The policy
What the app handles, why and how to delete it
In short
- You sign in with the same account as the SpecBox Cloud panel: with GitHub or, if your account has them, with email and password.
- Notifications carry type, project and identifier; never the text of your specs or your clients’ data.
- You remove a phone at once and delete your account from the app whenever you want.
Who is responsible for your data and how to reach them
Jesús Pérez Sánchez, owner of SpecBox, tax ID 31712786H, Calle Playa del Palmar 13, 11406 Jerez de la Frontera (Cádiz), Spain. The app is published on the App Store with the developer account of VA360 LABS S.L., which does not process your data.
For anything about your data: [email protected].
The app handles your account, your phones and your notifications; never the text of your specs
- Your account
- Through GitHub, via the panel: username, display name, email and avatar; your organization and your role in each project. Your panel account is created the first time you sign in with GitHub. If your account has an email and password, you can also sign in with them: Supabase Auth stores the password encrypted and the app does not keep it.
- The phones that receive notifications
- The token Apple or Google issue to deliver notifications, the platform (iOS or Android), the name you choose («Jesús’s iPhone»), when it was added and when it got its last notification.
- Your notifications and what you choose to receive
- For each notification: type, project and identifier (for example, «UC ready to accept · Specbox Manager · UC-9203»), the time, and whether you read it and opened it from the notification or from the list. And your preferences: which notification types you want and which projects you mute.
- What you do in the project
- When you accept a UC from the app, who, when and that it was from a phone are recorded. Never the phone model or your location.
- Technical logs
- Like any internet service, the panel server and the sign-in service (Supabase Auth) log the IP address of each request, to work and to stay secure.
Only what the app needs to work stays on the phone
Your session, your account, the last snapshot of your projects (to see it offline) and the notification registration, in the system’s secure storage. And the theme and whether you ask for Face ID, fingerprint or passcode. Signing out deletes the session, the account, the snapshot and the notification registration.
Your data makes the app work; it is never sold or used for advertising
To sign in with the same account as the panel, show you your projects, send you the notifications you choose, accept a UC with your identity and know, in aggregate figures, whether the app is used.
Legal basis: performance of the SpecBox Cloud contract (art. 6(1)(b) GDPR) to sign in, see your projects, receive the notifications you choose and accept UCs; legitimate interest (art. 6(1)(f)) for security, technical logs and aggregate usage figures.
Notifications, the phones you remove and technical logs are deleted after 30 days
| Notifications (and whether they were read or opened) | 30 days |
| A phone you remove | 30 days |
| A registered phone | while it stays registered |
| Your notification preferences | while you keep your account |
| Your account | until you ask to delete it |
| Your acceptances and decisions in a project | while the project exists |
| Technical logs with the IP | 30 days |
Only Supabase, Contabo, Apple, Google and GitHub receive data, each for its own job
Supabase stores the database and handles sign-in (region eu-west-3, Paris). The panel server runs on Contabo GmbH, in a data centre in France. Apple and Google receive only what they need to deliver each notification. GitHub, to sign in.
Outside the European Economic Area: GitHub, Apple and Google may process what they receive in the United States, under the safeguards of the EU-U.S. Data Privacy Framework or the European Commission’s standard contractual clauses. The database and the panel server stay in the European Union.
You remove a phone at once; your account, whenever you want
Remove a phone in Settings › Notifications in the app or in your panel Profile: it stops receiving notifications within a minute. Signing out removes it too.
To delete your account: in the app, Perfil › Eliminar cuenta (Profile › Delete account), and it is deleted at once; or write to [email protected]. Your account, your phones, your notifications and your preferences are deleted. What you accepted or resolved in a project stays in its history, because it is the evidence of the work, but without your name: it shows as «Deleted account».
You can ask to see, correct or delete your data, and complain
You can request access, rectification, erasure, objection, restriction and portability of your data at the same email, and file a complaint with the Spanish Data Protection Agency (aepd.es).