Privacy Policy

Effective & last updated: July 4, 2026. This policy covers the Spacebase Studio website at spacebasestudio.com and the Spacebase Studio service, both operated by AlwaysOverScope LLC ("we," "us").

The short version

No tracking cookies, no cross-site profiling, no selling your data — ever. We collect what we need to run the service: your account details, the photos you upload (they stay yours — we only host them for you), and payments handled by our payment processor. Website analytics are cookieless and aggregate. You can ask for a copy of your data, or ask us to delete it, anytime.

Who we are

AlwaysOverScope LLC, a New Jersey (U.S.) limited liability company, operates Spacebase Studio and is the data controller for the personal information described in this policy. You can reach us anytime at legal@alwaysoverscope.com.

What we collect

Account information

When you create an account or request early access: your email address, a name if you provide one, and login credentials (passwords are stored hashed, never in plain text). Studio accounts may also include the names and emails of seat holders you add.

Your photos & content

The photos, files, galleries, and metadata you upload to or create in the service. We host and process them only to provide the service to you and the people you share with — exactly as described in our Terms. We don't use your photos for advertising, and we never sell them.

Payment information

Subscription payments are handled by our payment processor. We receive confirmation of payment, your plan, and billing contact details — we never see or store your full card number.

Usage analytics (cookieless)

We use PostHog to measure aggregate usage — page views and basic interactions (clicks, navigation). It runs in a cookieless, session-scoped mode: a temporary identifier is held in your browser's sessionStorage and is cleared when you close the tab. We do not set advertising or cross-site tracking cookies, and we don't build advertising profiles. Anonymous visitors are not given a persistent profile.

Marketing attribution

When you arrive from an ad or campaign link, we record a small "first-touch" record in sessionStorage — a short, fixed list of values: campaign code, UTM parameters (utm_source/medium/campaign/term/content), ad-click IDs (gclid, fbclid), the referring page, and the landing path. It's cleared when you close the tab, and it's attached to your early-access request only if you choose to submit one — so we can credit the campaign that referred you.

Technical data

Like any website, our hosting/CDN and analytics process standard request data (such as IP address and browser user-agent) to deliver and secure the site and to count visits. We don't use this to identify you personally.

Anything you send us

If you email us or contact support, we keep the conversation so we can respond and follow up.

Cookies & storage

We do not use tracking, advertising, or analytics cookies — which is why you won't see a cookie-consent banner. The only browser storage the website uses is first-party sessionStorage for the analytics identifier and attribution record above, both cleared when you close the tab. A small localStorage value may store your light/dark theme preference; it contains no personal data. If you sign in to the service, we use strictly necessary session storage to keep you signed in — never for tracking or advertising.

How we use it

To provide the service — storing, organizing, and sharing your photos as you direct.
To manage your account, seats, and billing.
To run, secure, and improve the website and the service.
To measure which pages and campaigns are effective (in aggregate).
To contact you about your account, or about early access if you asked us to.
To meet our legal obligations (like tax records).

We do not sell your personal data, and we don't share it for cross-context behavioral advertising.

Legal bases (EU/UK)

Where the GDPR or UK GDPR applies, we process your data on these bases: contract (providing the service you signed up for), legitimate interests (securing and improving the service; aggregate analytics), consent (where required — for example, marketing emails, which you can withdraw anytime), and legal obligation (tax and accounting records).

Who we share it with

Only the service providers (processors) who help us run Spacebase Studio, and only what they need:

Hosting / CDN provider — serves and secures the website and stores service data.
PostHog — cookieless product analytics, processed on PostHog Cloud in the United States.
Payment processor — handles subscription payments.
Email / signup service — delivers account and early-access emails.
Google Fonts — delivers the site's typeface; Google may receive your IP address when fonts load.

Beyond processors: platforms you explicitly connect (like Instagram) receive only the content you choose to publish there; we may disclose data if the law genuinely requires it; and if we're ever part of a merger or acquisition, your data may transfer with the business — we'd tell you first. We do not sell your personal data.

International transfers

We're based in the United States, and our processors handle data there. If you're in the EU, UK, or elsewhere, your data will be transferred to and processed in the US. Where required, we rely on appropriate safeguards with our processors.

Retention

We keep data only as long as we need it:

Account data — while your account is active, then deleted within a reasonable period after closure.
Your photos — until you delete them or your account closes; after cancellation there's an export window, then deletion, as described in our Terms.
Analytics — session-scoped and short-lived by design.
Early-access emails — until launch and a reasonable period after, or until you ask us to delete them — whichever comes first.
Billing records — as long as tax and accounting law requires.

Security

We protect your data with industry-standard safeguards: encrypted connections (HTTPS/TLS), hashed passwords, and access limited to what's needed to run the service. No online service can promise perfect security, but if a breach ever affects your personal data, we'll notify you as the law requires.

Your rights

Wherever you live, you can ask us to access, correct, delete, or export the personal information we hold about you — just email us.

EU/UK (GDPR): you can also restrict or object to certain processing, withdraw consent at any time, and lodge a complaint with your local supervisory authority.

California (CCPA/CPRA): you have the rights to know, correct, and delete, and to opt out of the "sale" or "sharing" of personal information — we don't sell or share it in the first place. We will never discriminate against you for exercising your rights.

We'll verify requests before acting on them and respond within the time the law allows. You can also block analytics with your browser's privacy settings or an ad-blocker — the site works fully either way.

Children

Spacebase Studio isn't directed at children under 13 (or the equivalent age in your region), and we don't knowingly collect their personal information. If you believe a child has given us data, contact us and we'll delete it promptly.

Do Not Track & Global Privacy Control

We don't track you across other websites, and we don't sell or share your data for advertising — so there's nothing for a Do Not Track or Global Privacy Control signal to switch off. Every visitor gets the same privacy-protective treatment by default.

Changes

We may update this policy as the product evolves. If we make a material change, we'll give you notice — by email if you have an account, or with a notice on this site — and we'll revise the date above.

Contact

Questions or requests: legal@alwaysoverscope.com. See also our Terms of Service.