Privacy
Effective 16 September 2026. This says what Spryloom stores, why, where, and how to get it removed. It is written to be read, not skimmed past. If something here is unclear, write to hello@spryloom.com.
Spryloom is two things: this website, and the platform that runs the apps people publish. They store different things, so they are described separately.
This website
spryloom.com sets no cookies and runs no analytics. The one thing it keeps in your browser is whether you chose the light or dark theme, stored by the page itself and never sent anywhere.
The site is served by Vercel, which keeps ordinary web server logs (your IP address, browser, and the pages requested) for a short period to run and secure the service. We do not receive or use them.
The platform
When you sign in to Spryloom, publish an app, or open an app somebody shared with you, this is what exists about you.
Your email address
It is your account. There is no password. Sign-in is a link sent to that address, and the workspace you belong to is decided by its domain: everyone at acme.com is in the acme-com workspace. A personal address such as Gmail gets a workspace of its own, keyed on the whole address, never shared with other people at the same provider.
Sign-in tokens and sessions
A sign-in link carries a token that exists in plain text only between the click and its use, and is deleted at whichever comes first: use or expiry. A terminal token stops working after ninety days. A session in the browser is scoped to one app; signing in to one app grants nothing on another.
The audit log
Every sign-in, invitation, role change, publish, and administrative action is written to an audit log with who did it and when. The log is append-only: nothing in the product changes or deletes an entry. It exists so that a coworker can trust an app somebody else built, and so that we can answer the question "who did what" after the fact. It is kept for the life of the workspace.
Your app, and what it stores
When you publish, we receive the folder you publish: the code, the manifest, and whatever else is in it. We build it, run it, and keep each version so you can roll back. If your app declares a database, it is given one of its own, with its own role, that no other app can reach. We do not read inside your app's database. It is your data and your coworkers' data, and the app is the only thing that touches it.
When you invite somebody, we store their email address so that we know they may open the app, and we send them one email saying so.
Secrets
A value you set as a secret is encrypted at rest, bound to the one app it belongs to, injected when the app starts, and never shown back to anyone, including you. There is no command that reads one.
Logs
We keep your app's own output, so you can read it with spry logs and so we can help when something breaks. Secrets never appear in logs; the platform refuses to write an entry containing one.
Where it lives
The platform runs on the following providers, each of which holds only what its part needs.
| Provider | What it holds |
|---|---|
| Fly.io | Your app's running code, in a machine of its own |
| Neon | Your app's database, in a project of its own |
| Postmark | The sign-in and invitation emails it sends, and their delivery records |
| Vercel | This website |
| Cloudflare | DNS for spryloom.com, and its traffic as a proxy |
Nothing is sold, shared for advertising, or given to anyone else. We use these providers to run the service and for no other purpose.
What you can ask for
- A copy of your data. Release 1 has no export command. Ask, and we will give you a dump of your app's database and a copy of every version of the app.
- Deletion. Archive an app and its data is kept so the app can be restored. Ask for deletion and the app, its versions, its database, and its secrets are removed. Your account is removed on request too. Audit log entries that record what you did are kept, because they are the record for the other people in the workspace.
- A correction. If something about you is wrong, tell us and we will fix it.
Write to hello@spryloom.com. Expect a reply within a few days; this is a small team.
Security
The security model is on the homepage, and each claim on it is checked by a script that tries the attack. If you find something that page gets wrong, write to security@spryloom.com. We will answer, and we will not pursue anyone who reports a problem in good faith.
Children
Spryloom is for people at work, and is not directed at anyone under sixteen. We do not knowingly hold data about children.
Changes
If this page changes in a way that matters, everyone with an account is told by email before it takes effect. The date at the top is the date it last changed.