Privacy Policy

1. Introduction

This Privacy Policy describes how Spark ("we," "us," or "our") collects, uses, and discloses your personal information when you use our mobile application (the "App" or "Service").

We are committed to protecting your personal information and your right to privacy. Please read this Privacy Policy carefully as it will help you understand what information we collect, how we use it, and what rights you have.

This Privacy Policy applies to all information collected through the Spark mobile application. By using the App, you agree to the collection and use of information in accordance with this policy.

2. Definitions

For the purposes of this Privacy Policy:

• App: the Spark mobile application available on iOS.
• Company: when this policy mentions "Company," "we," "us," or "our," it refers to Spark.
• Country: United States, where Spark is based.
• Personal Data: any information that directly, indirectly, or in connection with other information allows for the identification of a natural person.
• Service: the Spark mobile application and all related features.
• Service Providers: third-party companies or individuals employed to facilitate our Service, provide the Service on our behalf, or assist us in analyzing how our Service is used.
• User / You: a person registered with Spark to use the Services.

3. Information We Collect

3.1 Information You Provide Directly

When you register and use the App, we collect the following information:

• Email address (used for account authentication)
• First name / display name (used to personalize your experience)
• Focus type and goal description (the personal goal or habit you are working on)
• Win logs (text entries you type when logging a small win or accomplishment)
• Photos (if you choose to attach images to wins via the Memories Vault feature)
• Notification preferences (your chosen reminder times and settings)

3.2 Information Generated Through Your Use of the App

As you use Spark, we also collect or generate the following:

• Streak and momentum data (consecutive days of activity, milestone achievements)
• Badge and achievement records
• Pattern analysis data (derived from your win logs over time)
• AI coaching responses (generated responses to your win logs)
• Kindling plan data (AI-generated step-by-step plans linked to your goals)
• Thread conversations (back-and-forth exchanges between you and Spark AI)
• Monthly letter content (AI-generated personal reflections based on your activity)

3.3 Technical and Usage Data

We may also collect standard technical information including:

• Device type and operating system version
• App version and usage patterns
• Push notification token (to send reminders you have requested)
• IP address and approximate location (country-level only, via Supabase infrastructure)

4. How We Use Your Information

Spark uses the information we collect for the following purposes:

• To create and manage your account and authenticate your identity
• To deliver personalized AI coaching responses to your win logs
• To generate weekly pattern analyses, monthly letters, and Kindling plans based on your activity
• To calculate and display your streaks, badges, milestones, and progress history
• To send push notifications and reminders you have opted into
• To improve the App's features, performance, and user experience
• To respond to your support requests or inquiries
• To comply with legal obligations

5. Legal Basis for Processing (GDPR — EU/UK Users)

If you are located in the European Union or United Kingdom, we process your personal data under the following legal bases:

• Contractual necessity: processing required to provide the Service you signed up for (account management, win logging, AI responses, streak tracking).
• Legitimate interests: improving our App, ensuring security, and preventing fraud — where these interests are not overridden by your privacy rights.
• Consent: for push notifications and any optional features you explicitly opt into. You may withdraw consent at any time.
• Legal obligation: where we are required to process data to comply with applicable law.

6. Retention of Your Personal Data

Spark retains your Personal Data for as long as your account is active or as needed to provide the Service. Specifically:

• Account data (email, display name): retained until you delete your account.
• Win logs, photos, streaks, badges, and milestones: retained until you delete your account or delete specific entries within the App.
• AI-generated content (responses, pattern analyses, monthly letters): retained until account deletion.
• Technical and usage data: retained for up to 12 months for internal analysis and security purposes.
• Push notification tokens: retained while you have notifications enabled; deleted upon notification opt-out or account deletion.

When you delete your account through the in-app account deletion feature, we permanently delete all personal data from our systems and instruct our Service Providers to do the same within 30 days.

7. Transfer of Your Personal Data

Your information, including Personal Data, may be transferred to and maintained on servers located outside your state, province, country, or other governmental jurisdiction where data protection laws may differ from those of your jurisdiction.

Spark's primary infrastructure is hosted in the United States. By using the App, you consent to this transfer. We take all steps reasonably necessary to ensure your data is treated securely and in accordance with this Privacy Policy.

For EU/UK users, where data is transferred outside the European Economic Area, we ensure appropriate safeguards are in place in accordance with applicable data protection law.

8. Disclosure of Your Personal Data

8.1 Business Transactions

If Spark is involved in a merger, acquisition, or asset sale, your Personal Data may be transferred. We will provide notice before your Personal Data is transferred and becomes subject to a different Privacy Policy.

8.2 Legal Requirements

Spark may disclose your Personal Data in the good faith belief that such action is necessary to:

• Comply with a legal obligation
• Protect and defend the rights or property of Spark
• Prevent or investigate possible wrongdoing in connection with the Service
• Protect the personal safety of users of the Service or the public
• Protect against legal liability

8.3 No Sale of Personal Data

We do not sell, rent, or trade your personal information to third parties for advertising or marketing purposes. We do not use your data for targeted advertising. Spark is a subscription-based application with no advertising model.

9. Third-Party Service Providers

Spark uses the following third-party services to operate the App. Each has access to your data only to perform their specific functions and is obligated not to disclose or use it for any other purpose.

10. Security of Your Personal Data

The security of your Personal Data is important to us. We implement commercially reasonable technical and organizational measures to protect your data, including:

• Encrypted data transmission (HTTPS/TLS) for all API communications
• Secure authentication via Supabase Auth with hashed passwords
• Row-level security policies on our database to ensure users can only access their own data
• Scoped storage permissions for photo uploads

However, no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security.

11. Children's Privacy

Our Service does not address anyone under the age of 13. We do not knowingly collect personally identifiable information from anyone under the age of 13. If you are a parent or guardian and you are aware that your child has provided us with Personal Data, please contact us immediately.

If we become aware that we have collected Personal Data from anyone under the age of 13 without verification of parental consent, we take steps to remove that information from our servers.

12. Your Data Protection Rights

12.1 General Rights (All Users)

Regardless of your location, you have the following rights regarding your personal data:

• Access: request a copy of the personal information we hold about you.
• Correction: request that we correct inaccurate or incomplete data.
• Deletion: request that we delete your personal data. You can also delete your account directly within the App at any time via Profile > Delete Account.
• Restriction: request that we restrict processing of your data in certain circumstances.

To submit a request, contact us using the information in Section 16. We will respond within 30 days and may need to verify your identity before processing the request.

12.2 GDPR Rights (EU/UK Users)

If you are located in the European Union or United Kingdom, you additionally have the right to:

• Data portability: receive your data in a structured, machine-readable format.
• Object to processing: object to processing based on legitimate interests.
• Withdraw consent: withdraw consent for any processing based on consent, at any time.
• Lodge a complaint: with your local data protection authority.

12.3 CCPA Rights (California Residents)

If you are a California resident, you are entitled to:

• Know what personal information we collect, use, disclose, and sell about you.
• Delete your personal information (subject to certain exceptions).
• Opt-out of the sale of your personal information. Note: Spark does not sell personal information.
• Non-discrimination for exercising your CCPA rights.

To exercise your California rights, contact us at the email address in Section 16. We will respond to verified requests within 45 days as required by the CCPA.

13. AI Coaching Disclaimer

14. Links to Other Sites

Our Service may contain links to other sites that are not operated by us. If you click on a third-party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Policy of every site you visit. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

15. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the Effective Date above. For significant changes, we will provide notice within the App or via email.

You are advised to review this Privacy Policy periodically. Changes are effective when posted.

16. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us:

• By email: [email protected]
• By visiting: sparkmomentum.app

We will make every reasonable effort to respond to your inquiry within 30 days.