Privacy Policy

Spook (“we”, “our”, or “us”) is committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have. It applies to the Spook website, services, and applications (collectively, the “Service”).

By accessing or using the Service you agree to the collection and use of information as described in this Policy. If you do not agree, please stop using the Service.

Information We Collect

We collect information you provide directly, information generated automatically when you use the Service, and information from third parties where applicable.

• Account information — When you register, we collect your chosen username, email address, and any optional profile details you add (display name, description, profile picture, and links).
• Discord information — If you sign up or authenticate through Discord, we receive your Discord user ID, Discord username, and the email address associated with your Discord account, as permitted by the scopes you authorise.
• Profile content — Any text, images, or links you add to your public Spook profile.
• Usage and log data — IP address, browser type and version, device information, pages visited, referring URLs, timestamps, and other standard server log data collected automatically when you interact with the Service.
• Location data — Approximate geographic location (city and region) derived from your IP address at login, used solely to send you login-notification emails.
• Cookies and session tokens — A secure, HTTP-only session cookie (.SPOOKSECURITY) to keep you authenticated. See the Cookies section below.

How We Use Your Information

We use the information we collect to:

• Create and manage your account and authenticate your identity.
• Display your public profile to other users.
• Send transactional emails, including verification codes, login alerts, and account notifications.
• Detect, investigate, and prevent fraud, abuse, spam, and security incidents.
• Operate, maintain, and improve the Service, including debugging and performance monitoring.
• Comply with applicable laws and respond to valid legal requests.

We do not sell your personal information to third parties. We do not use your data for interest-based advertising.

Information Sharing and Disclosure

We share your information only in the following limited circumstances:

• Public profile — Your username, display name, profile picture, description, and links are publicly visible to anyone who visits your profile URL.
• Service providers — We use trusted third-party services to operate the platform (for example, database hosting, email delivery, image hosting, and IP geolocation). These providers are contractually restricted to processing data only as necessary to perform services on our behalf.
• Discord — If you connect your Discord account, certain profile data (such as username) may be shared back with Discord in accordance with their API terms to support role connections and server membership.
• Legal obligations — We may disclose information if required by law, court order, or other legal process, or when we believe disclosure is necessary to protect rights, property, or the safety of Spook, our users, or the public.
• Business transfers — In the event of a merger, acquisition, or sale of all or a portion of our assets, user information may be transferred as part of that transaction. We will notify affected users via the email on file or a prominent notice on the Service before information is transferred and becomes subject to a different privacy policy.

Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. If you delete your account, we permanently remove your personal data and profile content from active systems. A short-term retention period may apply to backup copies and system logs for security, integrity, or legal compliance purposes, after which they are automatically purged.

Certain data may be retained longer where required by law or to resolve disputes, enforce agreements, or prevent fraud.

Your Privacy Rights

Depending on your location, you may have rights relating to your personal data, including the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete personal data.
• Request deletion of your personal data (“right to erasure”).
• Object to or restrict certain processing of your data.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with a supervisory authority in your jurisdiction.

To exercise any of these rights, contact us at privacy@spook.bio. We will respond within a reasonable timeframe and in accordance with applicable law. We may need to verify your identity before fulfilling your request.

Cookies and Tracking Technologies

We use a single essential session cookie (.SPOOKSECURITY) to keep you logged in. This cookie is set as HTTP-only and Secure, meaning it cannot be accessed by client-side JavaScript and is only transmitted over encrypted connections. We do not use advertising cookies, third-party tracking pixels, or analytics cookies.

You can configure your browser to refuse or delete cookies, but doing so will prevent you from staying logged in to the Service.

Third-Party Services

The Service integrates with third-party platforms whose own privacy policies govern their data practices:

• Discord — Used for authentication and account creation. See Discord’s Privacy Policy.
• IPinfo — Used to determine approximate login location for security notifications. See IPinfo’s Privacy Policy.

Your profile may contain links to external websites. We are not responsible for the privacy practices or content of those sites.

Security

We implement reasonable technical and organisational measures to protect your information against unauthorised access, alteration, disclosure, or destruction. These measures include encrypted connections (HTTPS), HTTP-only session cookies, server-side input sanitisation, and SQL injection protections.

No method of transmission over the Internet or electronic storage is completely secure. We cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately at privacy@spook.bio.

Children’s Privacy

The Service is not directed to children under 13 years of age (or a higher age threshold where required by applicable law). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information without parental consent, contact us at privacy@spook.bio and we will take steps to delete that information.

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last Updated” date at the bottom of this page. If changes are material, we will make reasonable efforts to notify you via email or a prominent notice on the Service. Your continued use of the Service after changes are posted constitutes your acceptance of the updated Policy.

Contact

Privacy questions or requests: privacy@spook.bio

General support: support@spook.bio

Law enforcement and legal requests: enforcement@spook.bio