Spac2 Privacy Policy
This Global Privacy Policy explains how Spac2 (spac2.com) collects, processes, and protects your personal data worldwide. Spac2 is global by design, privacy-first by architecture, and subject to applicable law.
Our Privacy & Security Commitment
Spac2 is continuously evolving — and protecting our users evolves with it.
At Spac2, protecting our users and their data is a core responsibility of the platform. We continuously improve the privacy, security, reliability, and resilience of the Spac2 ecosystem as our products, infrastructure, and technology evolve. Privacy and security considerations are incorporated into the ongoing development and maintenance of our services.
Spac2 is continuously being upgraded. As new features, applications, infrastructure, and security improvements are introduced, we regularly review and update our systems, privacy practices, and safeguards to reflect current architecture and applicable legal requirements.
Our goal is to continuously improve Spac2 while maintaining a privacy-first approach and honoring the trust users place in the platform.
Your content is private by default and is not publicly accessible.
Resource access is strictly isolated by authenticated account ownership.
We do not sell your personal data or provide it to data brokers.
1. About Spac2 & Data Controller
Spac2 (spac2.com) is an integrated digital ecosystem providing productivity tools, workspace utilities, real-time messaging, creative design modules, education utilities, mini-games, and progressive web applications worldwide.
Spac2 generally acts as the data controller for personal data we collect and process to operate the Spac2 services. Certain third-party service providers or advertising partners may independently process technical data under their own respective privacy policies and legal responsibilities. You may contact our privacy team at privacy@spac2.com.
2. Scope & Global Applicability
This Privacy Policy applies globally, subject to mandatory privacy and data-protection rights that may apply in your jurisdiction. It governs all websites, web applications, services, APIs, and subdomains across the ecosystem (including spac2.com, service.spac2.com, cdn1.spac2.com, and cdn2.spac2.com).
3. User Types, App Types & Data Sync Eligibility
To maintain strict transparency, Spac2 categorizes user accounts and application modules into distinct tiers, establishing clear rules for data transmission, cloud storage, and feature eligibility:
User Categories Account Requirements & Permitted Capabilities
3.1 Level 1 User (Guest)
No Account- Requirements to Use: None. Zero registration, no email, no password, and no credentials required.
- Permitted Capabilities: Free access to all Level 1 client-side tools and offline workspace utilities.
- Data Storage Rule: User Content Remains Local. All generated content is saved directly to your browser (
IndexedDB/localStorage) and is not transmitted to or stored on Spac2 cloud servers. Standard network and security metadata may still be processed by infrastructure providers as described in this Policy.
3.2 Level 2 User (Resident)
Registered Account- Account Requirements: Verified email address, unique username/display name, and cryptographically hashed password (Salted PBKDF2-HMAC-SHA256).
- Unlocked Capabilities: Multi-device Cloud Sync across 7 workspace apps, Web Push alerts, profile management, account recovery, and access to Spac2 Chat.
- Cloud Storage Eligibility: Authorized delta synchronization to the Spac2 PostgreSQL cloud database with strict
user_idisolation.
Application Types Data Flow & Cloud Storage Conditions
3.3 Level 1 Apps (Client-Side)
Zero Cloud UploadStandalone utilities (e.g., Image Converter, Image Compressor, Color Checker, Calculator, Unit Converter, QR Generator, offline client games).
Processing Model: 100% in-browser processing (HTML5, Canvas, WebAssembly, Web Workers). Your input files and images are never uploaded, processed on, or stored on Spac2 cloud servers.
3.4 Level 2 Apps (Cloud-Synced)
Conditional SyncConnected productivity suites (Documents, Notes, Tasks/Kanban, Calendar, Countday, Mindmaps, Spreadsheets/Tables).
Operating Condition: If you are a Guest, data remains strictly local in your browser. If you are logged in as an Authenticated Resident, structured revisions are securely synced to the cloud over HTTPS/TLS.
4. Privacy-First Architecture
4.1 Private by Default
Spac2 is built on a Private-by-Default principle. Your personal workspace content, notes, tasks, documents, spreadsheets, diagrams, and direct messages created within the ecosystem are private by default and are not publicly accessible. Spac2 does not currently provide public sharing for personal workspace content.
4.2 Strict Owner-Only Access
In our backend database and API architecture, workspace resources are strictly bound to your authenticated account ID (user_id). All read, update, and synchronization queries verify ownership against your authenticated session token. Data belonging to other accounts is isolated and inaccessible.
4.3 Resource IDs Are Not Access Credentials
A resource identifier, URL, or internal application route does not grant access to the underlying resource. Access is determined by authentication and ownership controls. Even if an identifier is known, our servers reject any request unless it is accompanied by a valid, authenticated session belonging to the resource's verified owner.
5. Information We Collect
Under the data minimization principle, we collect only information necessary to provide, secure, and operate the platform:
5.1 Level 1 / Guest Data
For Level 1 Apps, the content you create or process with these client-side utilities remains in your browser and is not transmitted to Spac2 application servers for storage. Standard network and security metadata, such as IP address and user-agent information, may still be processed by our infrastructure providers as described in this Policy.
5.2 Account Information (Level 2 Users)
When you register a Spac2 Account, we collect:
- Email Address: Used as your unique account identifier, for authentication, and for recovery.
- Username & Display Name: To identify you within the ecosystem and in Spac2 Chat.
- Password: Protected using salted PBKDF2-HMAC-SHA256 one-way cryptographic hashing (passwords are never stored in plain text).
- Profile Information: Optional biography, online presence status, and avatar image URL.
5.3 Synced Workspace Data (Cloud Sync V2)
When authenticated, the following workspace items are stored in our database to enable multi-device synchronization:
- Documents: Document titles, Markdown body content, tab configurations, edit revisions, and word count.
- Notes: Note titles, body content, color metadata, and timestamps.
- Tasks & Projects: Kanban project names, task descriptions, subtasks, priority levels, due dates, and completion status.
- Calendar Events: Event titles, descriptions, dates, times, recurrence rules, and locations.
- Countday Milestones: Event labels, target dates, and display orders.
- Mindmaps: Visual node hierarchies, layout structures, and graph data.
- Tables: Spreadsheet structures, column/row definitions, and cell data.
5.4 Technical & Security Logs
Standard server and edge network logs record IP addresses, user-agent strings, request paths, and timestamps. This technical information is used strictly for edge routing, anti-brute-force rate limiting, DDoS mitigation, and server diagnostic stability.
5.5 Analytics & Usage Metrics
Spac2 / Umami Analytics: We collect privacy-focused, aggregated usage and performance metrics to evaluate application performance and optimize system stability without tracking individuals across distinct websites.
Third-Party Analytics & Advertising: Where third-party analytics (such as Google Analytics) or advertising partners are enabled and permitted by applicable law, those third parties may process online identifiers, device and browser information, cookie identifiers, and usage data according to their own privacy policies and applicable user settings or consent.
6. Spac2 Chat Dedicated Privacy Policy
Specialized privacy disclosures for real-time messaging, group channels, and WebRTC calls
6.1 Eligibility & Access Requirements
Spac2 Chat is exclusively available to authenticated Level 2 Users (Residents). Unauthenticated guests cannot create, participate in, or read messages in chat channels. To access Spac2 Chat, a user must have an active Spac2 Account with authenticated session credentials.
6.2 Real-Time Messaging & Channel Data
When you communicate via Spac2 Chat, our servers store the data necessary to deliver and synchronize conversations across your devices:
- Direct & Group Messages: Message text payload, sender ID, recipient/channel ID, timestamps, edit history flags, and delete status.
- Interactive Elements: Emoji reactions, message replies/threads, pinned messages, and forwarded message references.
- Presence & Read Status: Online/offline presence indicators, typing indicators (transient memory only), and per-message read receipts.
6.3 Media, Files & Avatar Storage (Cloudflare R2)
Files, images, documents, and user avatar images shared within Spac2 Chat are stored securely in dedicated cloud object storage (Cloudflare R2) and distributed via our secure content edge (cdn2.spac2.com). File keys are cryptographically generated to prevent unauthorized directory traversal.
6.4 WebSockets & WebRTC Peer-to-Peer Voice/Video Calls
Spac2 Chat incorporates two distinct real-time transport mechanisms:
Text messages and channel state updates are transmitted via encrypted WebSockets over TLS.
Call audio/video streams are transmitted peer-to-peer (P2P) directly between participant devices using DTLS-SRTP encryption. Spac2 servers only facilitate signaling metadata. Spac2 does NOT record, listen to, or store call audio/video.
6.5 Web Push Notifications for Chat
When enabled by the user, Spac2 stores browser push subscription endpoints and VAPID public keys (p256dh, auth) to send incoming message notifications when the browser tab or app is in the background.
6.6 Privacy Controls, Channel Isolation & Deletion
Chat rooms are non-discoverable by the public. Access is strictly restricted to verified members. When you delete a message or remove your account, active production records are deleted from the Spac2 chat database. Residual backup copies are retained solely within encrypted disaster-recovery snapshots until automatically overwritten according to our scheduled backup lifecycle.
7. Legal Bases for Processing (Where Applicable)
Where applicable under data protection laws (such as the EU/UK GDPR and similar frameworks), Spac2 relies on the following lawful bases to process personal data:
Contractual Necessity
Processing your account information, workspace sync, and chat messaging to deliver the core services you registered for.
Legitimate Interests
Maintaining platform security, mitigating DDoS and brute-force attacks, diagnosing technical bugs, and optimizing performance.
Consent
Where you provide explicit consent (e.g., enabling optional Web Push notifications or non-essential cookies).
Legal Obligation
Complying with applicable statutory legal duties and binding lawful government or court orders.
8. How We Use Information
We use collected information for the purposes described in this Policy, including providing, securing, maintaining, improving, and supporting the Spac2 services, as well as complying with applicable legal obligations:
- Service Provisioning: Authenticating your identity, maintaining your active session, synchronizing your workspace data across devices, and delivering chat messages.
- Security & Abuse Prevention: Enforcing rate limiting on login attempts, detecting malicious traffic patterns, preventing spam, and protecting platform infrastructure.
- System Optimization: Monitoring application stability, troubleshooting server errors, and improving loading speeds.
- Communication: Responding to user support inquiries and delivering essential service notifications.
No Data Selling: We do not sell your personal data or provide it to data brokers.
9. Local Storage & Cloud Sync
Spac2 utilities utilize modern browser storage technologies (including localStorage, IndexedDB, and CacheStorage) to enable offline capabilities and fast Progressive Web App (PWA) loading.
For Level 1 Users, user-generated content processed by the client-side application remains in your browser storage and is not stored on Spac2 cloud servers. For Level 2 Users, local state is synchronized with our database through revision-based delta sync engines to keep your workspace updated across your devices.
11. How We Protect Your Data
We employ industry-standard technical and organizational security safeguards:
Encryption in Transit
Data transmitted between your device and Spac2 is protected using secure HTTPS/TLS transport encryption.
Cryptographic Password Hashing
Passwords are protected with salted PBKDF2-HMAC-SHA256 one-way hashing with high iteration counts.
P2P Media Encryption
WebRTC voice and video call streams utilize DTLS-SRTP end-to-end transport between communicating peers.
Access Control & Rate Limiting
APIs enforce strict owner-only database access controls and automated anti-brute-force rate limiting.
13. International Data Transfers & Safeguards
As a global platform, Spac2 utilizes distributed cloud edge infrastructure. Your personal data may be transferred to, routed through, and processed in countries outside your jurisdiction.
Where required by applicable law, we use appropriate safeguards for international transfers, which may include contractual safeguards, recognized transfer mechanisms, and technical measures such as encryption.
14. Data Retention & Lifecycle
We retain personal data and synced workspace items only for the duration of your active Spac2 Account. When you delete content or terminate your account, active production records are deleted promptly. Encrypted disaster-recovery backup snapshots retain residual copies solely until automatically overwritten according to our scheduled backup lifecycle.
15. Global & Regional Privacy Rights
We respect fundamental privacy rights granted under applicable international data protection frameworks:
15.1 Rights Under EU GDPR & UK GDPR
Where the EU GDPR or UK GDPR applies to our processing, eligible users possess the following statutory rights:
- • Right of Access (Art. 15): Request confirmation and copies of your personal data.
- • Right to Rectification (Art. 16): Correct inaccurate or incomplete records.
- • Right to Erasure (Art. 17): Request deletion of your personal data ("Right to be Forgotten").
- • Right to Restriction (Art. 18): Restrict processing of your data under specific conditions.
- • Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format.
- • Right to Object (Art. 21): Object to processing based on legitimate interests.
Eligible users also have the right to lodge a complaint with their local Data Protection Authority (DPA) or the UK Information Commissioner's Office (ICO).
15.2 California Privacy Disclosures (CCPA / CPRA)
To the extent California privacy laws apply, residents are provided with the following disclosures:
- Right to Know & Access: You may request the categories and specific pieces of personal information collected about you.
- Right to Delete: You may request the deletion of your personal information.
- Right to Correct: You may request the correction of inaccurate personal information.
- Do Not Sell or Share My Personal Information: Spac2 does not sell personal information or share personal information for cross-context behavioral advertising.
- Non-Discrimination: We will never discriminate against you (in pricing or service quality) for exercising any statutory privacy rights.
15.3 Other International Jurisdictions
Users in other jurisdictions (such as Brazil under LGPD, Canada under PIPEDA, Australia, or Asia-Pacific regions) may possess additional privacy rights under their respective local laws. Spac2 will address and respect those rights where the relevant legislation applies to our processing activities.
15.4 How to Exercise Your Rights
You can export your workspace content directly via application tools (Markdown/JSON/CSV), update your profile in settings, or submit a verified privacy request by emailing privacy@spac2.com. We respond to privacy requests without undue delay and within the time period required by applicable law. Where permitted by law, we may extend the response period for complex or multiple requests and will notify you when an extension is required.
16. Account & Data Deletion
You have the right to permanently delete your Spac2 Account and associated cloud data. Upon processing an account deletion request, your user credentials, synced notes, documents, tasks, messages, and uploaded files are purged from active production systems.
To request account deletion, use the deletion option within your account settings or email our privacy desk at privacy@spac2.com. We will process your verified request in accordance with applicable legal timeframes.
17. Children's Privacy
Spac2 services are not directed to children. Where applicable law imposes age-related or parental-consent requirements for processing children's personal data, including requirements that apply when relying on consent, Spac2 will apply those requirements to the extent applicable to our services and processing activities.
If we discover that personal data of a child has been collected without required parental consent where such consent is mandatory under applicable law, we will take prompt steps to delete that information from our systems.
18. Copyright & Intellectual Property Rights
You retain ownership of the intellectual property rights in content you create or upload to Spac2. You grant Spac2 only the limited rights necessary to host, store, transmit, synchronize, back up, and display that content solely for operating and providing the services.
19. Automated Decision-Making & Profiling
Spac2 does not use automated decision-making or algorithmic profiling systems that produce legal effects or similarly significant impacts on users.
20. Continuous Evolution & Policy Updates
Spac2 is a continuously evolving platform. We regularly improve and update our services, infrastructure, privacy practices, and security safeguards.
This Global Privacy Policy may therefore be reviewed and updated periodically to accurately reflect changes to the Spac2 ecosystem, our data-processing practices, security measures, product functionality, or applicable laws and regulations.
We will maintain the current version of this Policy on this page and update the "Last Updated" date whenever a revision is published. Where a change is material, we will provide appropriate notice through the Spac2 ecosystem where reasonably appropriate.
By continuing to use Spac2 after an updated Policy becomes effective, you acknowledge the updated Policy to the extent permitted by applicable law.
21. Contact & Privacy Inquiries
If you have questions, feedback, or wish to exercise your statutory data protection rights under applicable privacy laws, please contact our Data Controller team:
"Seeing you use Spac2's products is the absolute greatest and happiest thing for us."