Privacy & consent
How Graph Illustrate collects, uses, protects, and deletes data. Effective August 9, 2026.
Who controls what
Graph Illustrate is operated by SpecFocus. Responsibility is layered: SpecFocus operates the service; you control the content and accounts you connect.
Data controller (SpecFocus)
Controller for your platform account, authentication, and the content you author in the workspace. Your content is never sold or used for advertising.
You
Controller of the documents you create and the GitHub repositories and organizations you choose to connect. You decide what to connect and can disconnect at any time.
Your rights
Access, correction, deletion, portability, and objection. Write to privacy@specfocus.com; requests are logged and answered within applicable legal deadlines (Costa Rica Law 8968 / GDPR where it applies).
What we process and why
Only what running the service requires. No third-party advertising.
Account & identity
Name and email for sign-in, roles, and support, resolved through the SpecFocus Authorize identity service. Third-party sign-in shares only the identity you approve at consent.
GitHub data you connect
When you connect a GitHub account we access the repositories and organizations you authorize, to render and illustrate them. OAuth access tokens are stored sealed; we never post to your repositories without your action.
Content you author
The datum streams, diagrams, and uploads you create are stored to operate your workspace. They are yours; export or delete them at any time.
How we protect it and who processes it
Security by design and a short, honest processor list.
Secrets
GitHub tokens and other credentials are sealed (AES-256-GCM) or hashed; secrets are shown masked or once and never echoed back.
Least privilege
GitHub connections request the minimum scopes needed to read what you illustrate. Revoke them anytime in the app or at GitHub.
Processors
Infrastructure: Vercel and DigitalOcean. Identity: SpecFocus Authorize. Provider APIs (GitHub) only when you connect them. All under data-processing terms.
Consent, changes & contact
Creating an account accepts this processing to operate the service. Material changes are announced here with a visible effective date. Questions: privacy@specfocus.com.