Privacy Policy

Effective date: 2026-05-13

Controller: Spicule LTD ("Spicule", "we", "us"), a company registered in England and Wales.
Registered office: 122 High Road, Needham, Harleston, England, IP20 9LG
Contact: legal@spicule.co.uk
Service: PodCopilot — desktop application for podcast publishing automation.

1. Who this applies to

This policy describes how Spicule processes personal data when you use PodCopilot or this website. It is intended to meet our obligations under the UK GDPR and the Data Protection Act 2018.

2. Data we process

Category	Examples	Lawful basis	Purpose
Account data	Email, display name, hashed password (Google OAuth optional)	Contract	Authenticate access
Usage / licence	Episode-publish count, subscription tier, last-active	Contract	Enforce free-tier limits and bill Pro
Episode content	Transcripts, MP4/MP3, generated metadata — stored locally; transcript text sent to Anthropic for AI processing	Contract	Generate titles, chapters, show notes, social posts
API keys	Anthropic, Transistor, Late, Buffer — stored on your device, encrypted via OS keystore	Contract	Call those services on your behalf. Never sent to Spicule.
Crash reports	Stack traces, app version, OS — anonymised, scrubbed of API keys / paths / transcript content	Legitimate interests	Identify and fix bugs. Opt-out in Settings.
Billing	Card brand and last 4, billing country (processed by Stripe)	Contract / Legal	Subscriptions and invoices
Waitlist email	Email address you supply on podcopilot.ai	Consent	Notify you of launch

We do not sell personal data, run advertising, or use third-party analytics trackers on the website.

3. Retention

We retain personal data for 12 months after your last activity, unless a longer period is required by law (e.g. UK tax records: 6 years). Crash reports follow Sentry's default 90-day window. You may request earlier deletion at any time.

4. Subprocessors

Subprocessor	Purpose	Location
Anthropic, PBC	LLM inference	United States
Google (Firebase Authentication, Firestore, Cloud Storage, Cloud Functions)	Auth, storage, backend	EU and US (SCCs)
Transistor.fm	Podcast hosting	United States
Late / Buffer	Social media scheduling	United States
Stripe Payments UK Ltd	Payments	United Kingdom / United States
Sentry	Crash reporting	United States

Transfers to the United States rely on the EU–US Data Privacy Framework, the UK Extension, or Standard Contractual Clauses.

5. Where data is stored

Episode content, API keys, and the local SQLite database: on your device.
API keys are encrypted at rest using Keychain (macOS), DPAPI (Windows), or libsecret (Linux).
Account, licence, and waitlist data: Firebase (Google Cloud) with EU primary storage where available.

6. Your rights under UK GDPR

You have the right to access, rectify, erase, restrict, port, or object to processing of your personal data. You may withdraw consent at any time. You may lodge a complaint with the UK Information Commissioner's Office (ico.org.uk).

To exercise these rights, email legal@spicule.co.uk. We respond within 30 days.

7. Cookies

The PodCopilot desktop application does not use cookies. This website uses Firebase Authentication session cookies (strictly necessary) when you sign in; no advertising or analytics cookies are set.

8. Children

PodCopilot is not directed to children under 16. We do not knowingly collect personal data from children.

9. Security

TLS 1.2+ for all network traffic.
OS-level encrypted secret storage for API keys.
Code-signed and notarised release builds.
Crash-report scrubbing — API keys, paths, and content over 500 characters redacted before sending.
Firebase Security Rules restricting access to authenticated owners.

10. Changes

We may update this policy. Material changes will be announced via in-app notification and on this page.

11. Contact

Spicule LTD — legal@spicule.co.uk
Registered office: 122 High Road, Needham, Harleston, England, IP20 9LG
Company number: 09954122