Privacy Policy

How ScopeShock Studio collects, uses, and protects your data.

Last updated: May 2026 · Effective for all users of ScopeShock Studio.

Information We Collect

Account Data

When you register, we collect your name, email address, and a hashed password (bcrypt, never stored in plain text). Your account also tracks a role (user or admin) and a credit balance.

Project Content

When you submit an analysis, we store your requirement briefs, analysis titles, and configuration preferences (output language, detail level). This content is processed to detect ambiguity and scope risks.

Analysis Results & ML Predictions

The system generates ambiguity labels, scope risk scores, requirement type classifications (Functional / Non-Functional), AI-generated clarification questions, and cleaned requirement summaries. These are stored alongside your analysis.

Guest Usage Data

If you use the service without an account, we store a SHA-256 hashed version of your IP address (not the raw IP) and a count of guest analyses performed. This data automatically expires after 30 days.

How We Use Your Information

To provide the requirements analysis service you requested.
To classify requirements via local machine learning models (runs on our servers, no external sharing).
To generate AI-powered summaries, clarification questions, and scope risk reports.
To enforce guest usage limits (3 analyses per 30 days for unauthenticated users).
To administer your account and credit balance.
Admin users may view all data for service management and moderation purposes.

Third-Party Data Sharing

OpenRouter AI

Your submitted requirement textis sent to OpenRouter's API to generate clarification questions, scope risk assessments, cleaned summaries, and mitigation suggestions using an AI language model. No personal data (email, name, password) is sent to OpenRouter — only the text of your requirements. OpenRouter's own privacy policy applies to data they process.

Local ML Service

Ambiguity and requirement-type classification runs on a local Python service within our infrastructure. No data leaves our servers for this processing.

We do not use Google Analytics, tracking pixels, advertising networks, or any other third-party analytics tools.

Cookies

We use two HTTP-only cookies: auth_token (7-day session authentication) and guest_quota (30-day guest usage tracking). Both are essential for the service to function. See our Cookie Policy for full details.

Data Retention

Account data is retained until you request deletion.
Analyses and requirements are retained for the lifetime of your account.
ML predictions and AI reports are stored alongside their parent analysis and deleted when the analysis is deleted.
Guest quota records automatically expire after 30 days.
Credit transaction logs are retained for your account lifetime.

Your Rights

You have the right to:

Access your data via your profile and dashboard.
Request deletion of your account and all associated data by contacting us.
Export your analyses and results through the application.

To exercise any of these rights, email us at contact@scopeshock.studio.

Data Security

Passwords are hashed using bcrypt with 12 salt rounds.
Authentication tokens are stored in HTTP-only cookies (not accessible via JavaScript).
All API communication uses HTTPS in production environments.
Content Security Policy (CSP) headers restrict external connections.
Input validation via Zod schemas on all API endpoints.

Changes & Contact

We may update this policy from time to time. The “Last updated” date at the top of this page reflects the most recent revision.

For privacy inquiries, contact us at contact@scopeshock.studio.

Information We Collect

Account Data

Project Content

Analysis Results & ML Predictions

Guest Usage Data

How We Use Your Information

To provide the requirements analysis service you requested.

To classify requirements via local machine learning models (runs on our servers, no external sharing).

To generate AI-powered summaries, clarification questions, and scope risk reports.

To enforce guest usage limits (3 analyses per 30 days for unauthenticated users).

To administer your account and credit balance.

Admin users may view all data for service management and moderation purposes.

Third-Party Data Sharing

OpenRouter AI

Local ML Service

Ambiguity and requirement-type classification runs on a local Python service within our infrastructure. No data leaves our servers for this processing.

We do not use Google Analytics, tracking pixels, advertising networks, or any other third-party analytics tools.

Data Retention

Account data is retained until you request deletion.

Analyses and requirements are retained for the lifetime of your account.

ML predictions and AI reports are stored alongside their parent analysis and deleted when the analysis is deleted.

Guest quota records automatically expire after 30 days.

Credit transaction logs are retained for your account lifetime.

Data Security

Passwords are hashed using bcrypt with 12 salt rounds.

Authentication tokens are stored in HTTP-only cookies (not accessible via JavaScript).

All API communication uses HTTPS in production environments.

Content Security Policy (CSP) headers restrict external connections.

Input validation via Zod schemas on all API endpoints.