Privacy Policy

Last updated 10 June 2026

This policy explains what Spiderbrain collects, why, and how you stay in control. Spiderbrain is a product of Perform Digital Private Limited. Plain language, no dark patterns. Questions: support@spiderbrain.ai.

1. Who we are (data controller)

Spiderbrain is a product of Perform Digital Private Limited, a company registered in India (CIN U72900UP2019PTC121932). Perform Digital Private Limited is the data controller responsible for your personal data and decides how and why it is processed. You can reach us at support@spiderbrain.ai. For data protection questions, to exercise your rights, or to request a detailed disclosure of the specific providers we use, you can contact our Data Protection Officer at SBDPO@spiderbrain.ai.

2. What this policy covers

This covers the Spiderbrain desktop app, the command line tool, the MCP server, the spiderbrain.ai website, the Webby assistant, account sign in, and the cloud and team features. It does not cover the third-party tools you connect Spiderbrain to (your AI client, your code host, your editor), which have their own privacy policies.

3. AI services and diagnostics

AI services. Spiderbrain uses AI services to generate responses and insights. Depending on the features you use, portions of your prompts may be processed by our AI providers as described in this Privacy Policy. Your workspace data may be stored securely in cloud infrastructure to enable synchronization across devices.

Crash and error diagnostics. If enabled, Spiderbrain collects crash reports and error diagnostics tied to your account, never including the contents of your files or projects. These reports help us improve stability and security. You can turn diagnostics off in the app.

4. Local first: your code never leaves your device

Spiderbrain parses your project on your own machine. Your source code and file contents never leave your device. To rank your brain, the app uploads a source-free graph for scoring on our servers: your repo-relative file paths and names, the dependency edges, a SHA-256 fingerprint of each file (never its contents), and privacy-safe git signals (commit timestamps, a fix or revert flag, a salted author-identity hash, and changed file paths). Your code, file contents, commit messages and author emails never leave your device. We also receive your sign-in identity and, if you turn it on, content-free usage counts. Saving a brain to the cloud or sharing it with a team stores the brain on our servers only when you choose those features.

This source-free handling is the same on every plan (Free, Pro and Cortex). Every plan parses your code on your device, uploads the same source-free graph to score it, and stores the resulting brain in the European Union. Plans differ only in quotas and features (how many brains, team sharing, and how many nodes the local map draws), never in what we collect.

5. What we collect and why

• Account data and consent. When you sign in we store your email, name, plan, and your consent record (which version of the Terms of Service and Privacy Policy you accepted, and when) through Supabase. There is no password to store. Your consent IP address is captured server-side during account creation. If you sign in with Google, we receive your name, email address and profile picture from your Google account and use them only to create and secure your account and personalize the app. We never use Google user data for advertising, and we never sell it.
• Project graph (for scoring). To build and rank your brain, we process a source-free upload of your project: file paths and names, dependency edges, a SHA-256 hash of each file, and privacy-safe git signals (timestamps, a fix or revert flag, a salted author-identity hash, and changed paths). This never includes your source code, file contents, commit messages or author emails. It is stored on our servers only if you save a brain to the cloud (Pro) or share it with a team.
• Usage analytics. Pages viewed, which call to action you click, referrer and campaign tags, country and device type. Collected first-party (our own Cloudflare Worker) and, with your consent, through Google Analytics 4. A first-party identifier kept in your browser counts visits and is not a third-party cookie.
• Product telemetry (opt-in). If you allow it in the app, we collect content-free counts of actions (for example, a brain was built, a query ran). This never includes your code or file contents, and you can switch it off at any time.
• Webby assistant. The messages you send to Webby, any contact details you share, and support tickets you raise. We use these to answer you, follow up, and improve the assistant. Webby is powered by a third-party AI provider (Anthropic); your messages are sent to that provider to generate replies and are not used to train its models. Please do not paste passwords or source code into Webby.
• Referrals. If you arrive through a referral link, we record the referral code so credit is applied correctly.
• Payments. When you buy a paid plan, payment is handled by Razorpay, including for international payments. We receive confirmation and limited billing details (such as the plan, amount, and a token or the last digits of the instrument). We do not see or store your full card number.

Spiderbrain's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

6. Legal bases (for EEA and UK users)

• Contract: to provide your account, the app, and the features you ask for.
• Consent: analytics, optional telemetry, and any marketing. You can withdraw consent at any time.
• Legitimate interests: keeping the service secure, preventing abuse, and improving the product.

7. Who we share data with

We do not sell your personal data. We share it with service providers who process it on our behalf, under contract:

• Supabase: identity, account and analytics storage (EU region).
• Cloudflare: website hosting and edge delivery.
• Google Analytics 4: aggregate website analytics, only with your consent.
• Anthropic: powers the Webby assistant by processing your chat messages to generate replies.
• Resend: transactional email, such as support ticket confirmations.
• Razorpay: payment processing, including international payments.

8. International data transfers

Account and analytics data tied to your account are stored in the European Union (Supabase). Spiderbrain is operated from India by Perform Digital Private Limited, and some of our providers are outside the European Economic Area. In particular, payments are processed by Razorpay in India, and some providers (such as Cloudflare and Anthropic) operate in the United States.

India does not currently have an EU adequacy decision. Where we transfer the personal data of EEA or UK users outside the EEA or UK (including to India for payments), we rely on Standard Contractual Clauses (and the equivalent UK safeguards) with those providers to protect your data.

9. How long we keep it

• Purely anonymous analytics events are pruned after 30 days.
• Account, subscription and account-linked data (including Webby conversations and tickets tied to your account) are kept while your account exists, and for a limited period afterwards where needed for legal, tax and accounting reasons.
• Payment records are retained as required by Indian tax and financial law.
• Ask us to delete your account and we remove your personal data, except where we are required to keep records by law.

10. Your rights

Depending on where you live, you can ask us to give you access to your data, correct it, delete it, export it, restrict or object to its processing, and withdraw consent. EEA and UK users have these rights under the GDPR; users in India have rights under the Digital Personal Data Protection Act, 2023; California residents have rights under the CCPA and CPRA. To exercise any of these, email support@spiderbrain.ai and we will action it within the time the law allows. You may also lodge a complaint with your local data protection authority.

11. Cookies and local storage

We use four categories. You choose which to allow, and you can change your mind any time via Cookie settings.

• Strictly necessary: sign-in, security and remembering your consent. Always on.
• Functional: remembers small choices so we do not repeat prompts.
• Analytics: first-party analytics and Google Analytics 4, in aggregate.
• Marketing: reserved for future attribution tags. Nothing loads here today.

Until you grant Analytics, Google Analytics runs in Google's cookieless consent mode and our first-party analytics does not record.

12. Data security

Sign-in is handled by Google or one-time email codes, so there is no password for us to store. Data in transit is encrypted over HTTPS. Account data sits in Supabase behind access controls. Your source code and file contents never leave your device.

13. Children

Spiderbrain is not directed at children. We do not knowingly collect data from anyone under 18, or the minimum age in your country. If you believe a child has given us personal data, contact us and we will delete it.

14. Changes to this policy

We will update this policy as the product evolves. We will post the new version here and update the date above; significant changes will be notified in the app or by email.

15. Contact

Perform Digital Private Limited. Email support@spiderbrain.ai. Spiderbrain is a product of Perform Digital. See also our Terms of Service.

This policy describes our current practices and will evolve as the product does. It is provided in good faith.