SpecShot is built so the sensitive parts stay private and the risky parts simply never happen. Here is exactly how your data is handled.
Principles baked into the product, not bolted on after.
Captured DOM is persisted as structured JSON and never rendered or executed as HTML. SpecShot documents a design. It does not run or reproduce it.
We deliberately skip input values when capturing a section, so passwords, search terms and other field contents are never collected.
Screenshots and exports live in private storage scoped to your workspace. Share links are opt-in, per-capture, and revocable at any time.
BYO AI keys, GitHub and Linear tokens, and webhook secrets are encrypted at rest with a dedicated key. They are never stored or displayed in plaintext.
Billing runs entirely through Stripe. We never see or store your card details.
Authentication is handled by Clerk. Data sits behind row-level security so workspaces can only ever access their own records.
SpecShot captures context to brief your build. It does not clone, copy or host other people's sites.
in a website section
out structured JSON and an AI-ready prompt
never runnable code, form values, or a hosted copy