Privacy policy
Last updated: 20 May 2026
This privacy policy explains how spooof ("we", "us", "our") collects, uses, stores, and shares personal information. spooof is operated by Marcus Ng, based in Sydney, Australia.
By using spooof, you agree to the practices described in this policy.
1. Who this policy applies to
There are two types of people whose data spooof handles:
Business owners (customers). People who sign up for a spooof account to use the product on their business's website.
Reviewers (end users). People who visit a business's review page powered by spooof and submit feedback or a review.
This policy covers both. Different sections apply depending on your role.
2. What we collect
From business owners
When you sign up for spooof, we collect:
- Your name, email address, business name, business address, and phone number
- Your Google Business Profile information (place ID, business name, address, public review history) — fetched from Google when you connect your account during signup
- Profession, service area, brand colours, logo, and similar configuration details you provide
- If you choose to connect Google Business Profile for reply posting: an OAuth access token and refresh token issued by Google, plus your Google Business Profile account ID and location ID
When you use the spooof dashboard, we collect:
- Login timestamps and session activity
- Actions you take in the dashboard (e.g. viewing a review, posting a reply)
From reviewers
When a reviewer interacts with a business's spooof-powered review page, we collect:
- Their first name (if entered)
- Any feedback or review text they write
- Star rating they select
- Phrases or prompts they tap during the assembly flow
- Browser metadata (IP address, user agent) for security and rate-limiting purposes
- Timestamps of each action (page open, prompt taps, submission, drop-off)
Reviewers are not required to create accounts. We don't collect names, addresses, or other identifying information beyond what they choose to enter.
From Google
When a business owner connects their Google Business Profile, we periodically fetch:
- Public Google reviews left on that business's profile
- Reviewer names as displayed publicly on Google
- Star ratings and review text
- Posted-at timestamps
- Any owner replies already on Google
We do not collect anything from Google that isn't already publicly visible on the business's profile, except the OAuth token which authorises us to post replies on the owner's behalf.
3. Why we collect it
Business owners
- To provide the spooof service (run the review tool, show the dashboard, post replies)
- To send you transactional emails (magic-link sign-ins, owner notifications when a customer submits feedback)
- To improve the product (anonymised aggregated usage patterns)
- To bill you (when paid plans launch)
Reviewers
- To deliver feedback to the business owner you reviewed
- To populate the business's Google review (if you choose to copy the assembled text and post on Google)
- To help the business owner understand patterns across their reviews
- For security and abuse prevention (rate limiting, spam detection)
4. How we use Google data
spooof requests the following Google OAuth scope:
https://www.googleapis.com/auth/business.manage — allows spooof to read your Google Business Profile information and post replies to reviews on your behalf.
We use this scope exclusively to:
- Fetch your public reviews to display in your spooof dashboard
- Post replies you write and approve in spooof's Reply Workspace back to your Google Business Profile
We do not use this scope to:
- Modify your business profile information
- Post anything other than reply text you have authored and explicitly clicked "Post" on
- Share your Google data with third parties
- Train any machine learning model on your Google data
Token storage
When you connect Google Business Profile, your OAuth tokens will be encrypted at rest using AES-GCM encryption with a key held as a Cloudflare Worker secret (not stored in our database or source code).
Token deletion
You can revoke spooof's access to your Google account at any time by visiting your Google Account permissions page. On revocation, we delete the encrypted tokens from our database within 24 hours. You can also delete tokens directly by disconnecting Google from your spooof dashboard settings.
5. How we use AI
spooof uses Anthropic's Claude API to help business owners write replies to reviews. Specifically:
- When you open the Reply Workspace for a Google review, the review text is sent to Anthropic's API
- The API returns a structured analysis identifying phrases an owner could safely acknowledge
- The analysis is cached in our database, keyed to the review, so we don't re-send the same review text
We do not send your personal data, account details, or any data about reviewers (beyond what they wrote publicly on Google) to Anthropic. Anthropic processes the data under their commercial terms and does not train models on commercial API traffic.
6. Who we share data with
We share data only with:
- Cloudflare — our hosting and database provider. Data is stored in Cloudflare D1 and processed by Cloudflare Workers. Cloudflare acts as a data processor on our behalf.
- Anthropic — our LLM provider for the Reply Workspace feature, as described above.
- Resend — our transactional email provider for sign-in links and owner notifications.
- A third-party Google review scraping service — used to fetch public review data from Google when our direct Google API connection is not available.
- Google — when posting replies on your behalf via the Business Profile API.
We do not sell personal data. We do not share data with advertising networks or data brokers.
7. Where data is stored
spooof's database (Cloudflare D1) is hosted by Cloudflare in their global edge network. Data may be stored or processed in countries outside Australia, including the United States and Europe. We rely on Cloudflare's data processing agreements and standard contractual clauses to protect data transferred outside Australia.
8. How long we keep data
- Business owner accounts: while your account is active, plus 30 days after deletion to handle billing reversals and accidental deletions.
- Reviewer submissions: retained as part of the business owner's data layer for as long as the business's account remains active. Business owners can configure retention limits in their account settings and can request deletion of specific submissions at any time.
- Google OAuth tokens: until you disconnect Google or close your spooof account. Deleted within 24 hours of revocation.
- Cached LLM extractions: retained while the underlying review remains on Google, unless the business owner requests re-extraction.
- Email logs and session records: 90 days.
9. Your rights
Under the Australian Privacy Act 1988 and Australian Privacy Principles, you have the right to:
- Request access to the personal information we hold about you
- Request correction of inaccurate information
- Request deletion of your personal information
- Withdraw consent for processing (which may mean we can no longer provide the service)
- Lodge a complaint with the Office of the Australian Information Commissioner (OAIC)
To exercise any of these rights, email privacy@spooof.com. We respond within 30 days.
10. Security
We protect personal information with:
- HTTPS encryption on all data in transit
- AES-GCM encryption on sensitive at-rest data (OAuth tokens, once connected)
- Cloudflare-managed access controls on the database
- Magic-link authentication (no passwords stored)
- Regular review of access logs
No system is perfectly secure. We take reasonable steps but cannot guarantee absolute security.
11. Children
spooof is not intended for use by anyone under 18. We do not knowingly collect data from minors. If we discover we have, we delete it.
12. Changes to this policy
We may update this policy. Material changes will be communicated by email to business owners and posted on this page with an updated "last updated" date. Continued use of spooof after changes constitutes acceptance.
13. Contact
For privacy questions, requests, or complaints:
Email: privacy@spooof.com
Operator: Marcus Ng
Location: Sydney, Australia
← Back to spooof