SpecShot is built so the sensitive parts stay private and the risky parts simply never happen. Here's exactly how your data is handled.
Principles baked into the product, not bolted on after.
Captured DOM is persisted as structured JSON and never rendered or executed as HTML. SpecShot documents a design. It doesn't run or reproduce it.
We deliberately skip input values when capturing a section, so passwords, search terms and other field contents are never collected.
Screenshots and exports live in private storage scoped to your workspace. Share links are opt-in, per-capture, and revocable at any time.
BYO AI keys, GitHub and Linear tokens, and webhook secrets are encrypted at rest with a dedicated key. They are never stored or displayed in plaintext.
Billing runs entirely through Stripe. We never see or store your card details.
Authentication is handled by Clerk; data sits behind row-level security so workspaces can only ever access their own records.
SpecShot captures context to brief your build. It doesn't clone, copy or host other people's sites.