Privacy Policy

Last updated: 25 July 2026

OnSpec ("OnSpec", "we", "us", "our") is a product of Synthetixis, Inc., a Delaware corporation. This policy explains the limited data we handle when you use OnSpec at onspec.synthetixis.com. OnSpec is built on a simple principle: your photo is processed on your device, and we hold as little of your data as technically possible.

The short version

• Your photo is processed in your browser. On the upload and this-device-camera paths, your photo is never uploaded to, received by, or stored on our servers.
• If you use the optional phone-to-computer handoff, your photo is encrypted on your phone and only ever reaches us as an unreadable encrypted blob, which is deleted the moment your computer collects it (and in any case automatically within a few minutes).
• We have no user accounts and build no profile of you.
• Payments are handled by Stripe — we never see or store your card details.
• We use privacy-friendly, cookieless analytics, never send any photo data to it, and respect Do Not Track and Global Privacy Control. Because we don't store tracking cookies on your device, we don't show a cookie banner.

Who we are

The data controller is Synthetixis, Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, US. Contact for any privacy question or request: [email protected].

Your photo

• Upload / this-device camera: all cropping, resizing, background removal, and file export run locally in your browser. Your photo is not transmitted to us at any point.
• Phone-to-computer handoff (optional): if you choose to capture on your phone and send the result to your computer, the photo is encrypted on your phone using a key that travels only inside the QR code and never reaches our server. Our relay stores only the encrypted, unreadable blob and deletes it as soon as your computer retrieves it, or automatically within a few minutes if it is never retrieved. We cannot read it. To protect the relay from abuse, our server briefly processes the sender's IP address for rate-limiting; it is not stored beyond what that protection needs and is never linked to your photo.
• We never store your photo, never use it to train any model, and never share it.

Payment data

Payments are processed by Stripe, Inc. We do not receive or store your card number. From Stripe we receive a payment/session identifier, the payment status and amount, and which document you purchased. Stripe's handling of your data is governed by its own privacy policy (https://stripe.com/privacy).

Analytics

We use PostHog to understand, in aggregate, which pages people visit and how the tool is used, so we can improve it. We configure PostHog to run without cookies or persistent identifiers stored on your device, we never send any photo or image data, session recording is disabled, and we honour Do Not Track and Global Privacy Control signals — if either is set, analytics does not run. Because we store nothing on your device for analytics, no cookie-consent banner is required. Analytics data is shared across Synthetixis products for aggregate product understanding and may be processed on PostHog infrastructure in the US.

Cookies

We use no analytics or tracking cookies. The only cookies OnSpec uses are Stripe's strictly-necessary payment cookies (__stripe_mid and __stripe_sid), which our payment processor sets when you open the checkout, solely for fraud prevention and payment security. They are not used to track you and are not set unless you begin a purchase. Because they are strictly necessary to provide the payment you requested, they are exempt from cookie-consent requirements — which is why OnSpec shows no cookie banner.

Your rights (UK & EEA visitors)

If you are in the UK or the EEA, UK GDPR / EU GDPR give you rights over your personal data, including access, correction, deletion, and objection. Because we hold almost no personal data about you — no account, no stored photo — there is usually little to act on, but you may contact us at [email protected] to exercise any right, and you may complain to your local data protection authority (in the UK, the ICO). Our lawful basis for the limited operational and aggregate analytics data is our legitimate interest in running and improving the service.

Data retention

• Photos: not retained. On-device paths store nothing; handoff blobs are deleted on delivery or auto-expire within minutes.
• Payment records: held by Stripe, and by us as needed for tax and accounting for 6–7 years.
• Analytics: aggregate only, retained per PostHog's configured retention.

Children

OnSpec is intended for use by adults (18+). A parent or guardian may format a child's document photo; that processing still happens on your device and we do not store it. We do not knowingly collect personal data from children.

International users

OnSpec is operated by a US company and used worldwide. Where we process limited data, it may be handled in the US or other regions via our processors (Stripe, PostHog).

Changes

We may update this policy; we'll change the "Last updated" date and, for material changes, note it in the app. Continued use after an update means you accept the revised policy.

Contact

[email protected] · Synthetixis, Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, US.