Privacy Policy
Preview draft · 2026-09-13-draft. Owner identity, contact details, and launch policies are still being finalized.
Scope and draft status
This policy describes Spark's current preview and planned paid features. Spark operates from California, United States. The operator's legal identity and privacy contact have not yet been finalized. This document must be completed before public launch; it is not a claim that every legal compliance requirement has been met.
Information processed
Spark stores your email, a salted password hash rather than a readable password, account identifiers, session records, and the date and document version you accepted. It stores project names, descriptions, prompts, generated replies, and request status. Security controls process request information, including IP-derived rate-limit identifiers. Hosting providers may process IP addresses, browser/device information, and operational logs to deliver and secure the service.
Why we use information
Information is used to create and authenticate accounts, save projects and conversations, provide AI assistance, record acceptance, enforce limits, investigate failures and abuse, and meet applicable obligations. When payments are enabled, payment providers will process checkout information and Spark will need subscription and credit records. No payment card details are collected by the current preview.
AI and service providers
When AI is enabled, relevant prompts, conversation history, and project details are sent to OpenAI to generate replies. Spark requests that Responses API application state not be stored, but this does not eliminate provider security or abuse-monitoring retention. OpenAI API data is not used for model training by default; provider processing is subject to its policies and account settings. Spark's hosting and database infrastructure, including Sites and Cloudflare, processes data to operate the website. Official Roblox gallery images load from Roblox's CDN, which receives ordinary network request information. Following external links is subject to the destination's policies.
Cookies and browser storage
Spark uses an essential session cookie to keep you logged in. Tab-local storage temporarily carries a starting idea from signup into a project, with a 24-hour validity window. This preview does not include advertising trackers or a marketing analytics integration. Third-party hosting and linked sites may have their own practices.
Sharing and security
The current application has no feature for selling personal information or sharing it for targeted advertising. Data may be processed by service providers, disclosed when legally required, or used to protect the service. Authorized operators may access records for support, security, and maintenance. Spark uses access checks and password hashing, but no system can promise absolute security. Do not submit content you cannot safely share with the service and its AI provider.
Retention and deletion
Project conversations remain in Spark's database until the project is deleted. Project deletion removes its associated messages and requests from the active application database; provider logs or backups may follow separate retention schedules. Account records currently have no automated deletion schedule, and no self-service account deletion or export feature is implemented. A retention schedule and working channel for access, correction, export, and deletion requests must be established before launch. Session cookies expire after seven days. Browser-local drafts are only read within their validity window and can be removed by clearing site storage.
Your privacy choices
Depending on your location and applicable law, you may have rights to access, correct, delete, or obtain your information, and other choices regarding its use. California privacy rights apply where the relevant law covers the service; this draft does not assume Spark meets CCPA business thresholds. You may clear cookies and browser storage, though doing so can log you out. Request handling and verification procedures will be provided with the operator's contact details before launch.
Young users and international processing
Spark is not intended for children under 13 or below any higher applicable minimum age. Users below the age of legal majority need a parent's or guardian's approval. If child data is identified, the operator must address it under applicable law. Data may be processed in the United States and other countries where service providers operate. Applicable protections and any required transfer arrangements must be assessed before serving additional markets.
Updates and contact
Material changes will be communicated as required, with an updated version date. A working privacy/support address and operator identity are pending and must be added before launch. This preview currently cannot receive privacy requests through a dedicated contact channel.