Privacy Policy

1. Who is responsible

The controller of your personal data is the publisher of Sparkwizz:

Email: privacy@sparkwizz.app

Write to this address about anything in this policy or to use your rights. For help with the app, write to support@sparkwizz.app.

In this policy, “we” and “us” mean the publisher, and “Sparkwizz” or “the app” means the Sparkwizz app for iPhone and Android.

2. What this policy covers

This policy covers the Sparkwizz app, the website sparkwizz.app, and emails you send to our addresses. It does not cover the App Store, Google Play or other services you reach from Sparkwizz, which have their own privacy policies.

3. What stays on your phone

The following is stored only in the app’s own storage on your phone:

• your ideas: their text, titles and tags, the transcripts of voice ideas, and archived ideas. Ideas you delete stay in Recently deleted for 30 days and are then deleted for good;
• your Sharpen answers and Whoosh reports, with any corrections and test results you add to them;
• what you tell Whoosh about yourself (whether you code, and how many hours a week you have);
• your streak, weekly reviews, daily sparks and settings;
• reminders, which are scheduled on the phone as local notifications. We don’t send push notifications.

We have no access to this data. None of it is sent to us unless you use a cloud feature, as described in section 4.

Voice

On iPhone, Sparkwizz uses speech recognition on the phone only: your voice is turned into text on the phone, and the audio never leaves it. On Android, voice uses your phone’s speech recognition service. If it can’t work offline (for example on Android versions before 12, or without the offline language pack), Android may send the audio to Google to turn it into text, under Google’s privacy policy. Sparkwizz does not save recordings.

Exports and backups

You can export your ideas in a readable form, or make a backup encrypted with a passphrase you choose. Both are created on your phone and leave it only if you save or share them somewhere yourself, for example to Files, a cloud drive or a message. We never receive them. We can’t open an encrypted backup or recover its passphrase.

Your phone’s own backup

Your phone’s backup (iCloud Backup on iPhone, Google’s backup on Android) may include Sparkwizz’s data, depending on your phone’s settings. Apple or Google handle those backups under their own terms.

4. What our server processes, and why

Our server runs on Supabase in the European Union (Frankfurt, Germany). It is used only when you use something that needs it: cloud reactions, Sharpen, Whoosh, purchases and paywalls, or reporting an AI answer. Showing a paywall, including the one at the end of the first-run setup, uses it even if you buy nothing: it creates your anonymous ID and contacts RevenueCat and our server. The content of your ideas goes only to the cloud features you choose. Each card below says what we process, why, on which legal basis under the EU General Data Protection Regulation (GDPR), and how long we keep it.

Please don’t put other people’s personal details, or sensitive information about yourself, into ideas you send to cloud features.

5. How the AI features work

• We use AI models through OpenRouter, a service that routes each request to a model provider. Our requests require zero data retention and deny data collection, so only providers that don’t store your text or use it for training may answer.
• Today the model is Claude by Anthropic. We may switch to another model offered with zero data retention, such as OpenAI’s GPT models, under the same commitments. The models run in their providers’ data centres, which may be outside the EU (section 13).
• We don’t train AI models on your ideas.
• The “crowd” in a Whoosh report is a set of made-up customers that the AI writes from the evidence. They are not real people.
• AI output is not used to make decisions about you. A Whoosh verdict is an opinion for you to weigh, with no legal or similarly significant effect on you.

6. Searches for Whoosh

• App Store. During a whoosh, your phone searches Apple’s public App Store directory directly, with search terms built from your idea, and reads competitors’ public reviews. Apple receives these searches and your phone’s IP address, under Apple’s privacy policy. They don’t pass through our server.
• The web. Our server sends search queries built from your idea, with the App Store country, to the Brave Search API, which returns results and text from the pages it finds. Brave receives the queries, but not your anonymous ID or your IP address. We don’t store the queries.

7. Purchases

• Sparkwizz Pro and whoosh packs are bought through the App Store or Google Play. Apple or Google take the payment and handle your payment details as separate controllers, under their own terms and privacy policies.
• RevenueCat processes purchases for us. It receives the store’s transaction data, your anonymous ID, and technical details such as the app version, the device and the country, to check your purchases and tell our server about them. When you delete your data in the app, our server also asks RevenueCat to delete its record for your anonymous ID.
• To analyse paywall tests, GrowthBook reads only the paywall views and purchases described in section 4 (anonymous ID, time, paywall version, value), through read-only access to our database.

8. Usage statistics and crash reports

Both are optional and stay off until you agree, in onboarding or in Settings → Privacy. Nothing is collected before you agree.

You can withdraw your consent at any time in Settings → Privacy. Withdrawing doesn’t affect what was collected before.

9. Reporting an AI answer

If an AI answer is wrong, offensive or harmful, you can report it in the app. The report sends us the AI text you chose to report, the reason, and your comment if you write one, with your anonymous ID. Our server adds the models and instruction versions in use when you send the report. Your idea itself is not sent.

• Why: to review harmful or wrong output and improve the service.
• Legal basis: our legitimate interests in keeping AI output safe and correct (Art. 6(1)(f) GDPR).
• Kept: as long as your anonymous ID exists, and deleted with it [To be confirmed: any shorter retention for reviewed reports].

Please don’t include personal details in your comment.

10. When you email us

When you write to support@, privacy@ or ads@sparkwizz.app, we receive your email address, your name if you give it, and your message with any attachments. Our email is hosted by Google Workspace.

• Why: to answer you and keep a record of what was agreed.
• Legal basis: our legitimate interests in answering messages (Art. 6(1)(f) GDPR), steps you ask for before or under a contract (Art. 6(1)(b)), and, for privacy requests, our legal obligation to handle them (Art. 6(1)(c)).
• Kept: [To be confirmed: for example, up to 2 years after the conversation ends].

11. This website

sparkwizz.app is a static website hosted on GitHub Pages. It uses no cookies, no analytics, no scripts and no third-party fonts. As the host, GitHub processes your IP address to deliver the pages and protect its service, under GitHub’s privacy statement. Our legal basis is our legitimate interest in running the website (Art. 6(1)(f) GDPR).

12. Who receives data

We use these service providers. They process data on our behalf (as processors), under data processing agreements, unless the table says otherwise.

Separate controllers. Apple and Google run the app stores, take payments, and receive App Store searches (Apple) or, on some Android phones, voice audio (Google), under their own privacy policies.

We may also disclose data where the law requires it, or to establish, exercise or defend legal claims. We never sell your data.

13. Transfers outside the EU

Some providers above are based in, or process data in, countries outside the European Economic Area, mainly the United States. For these transfers we rely on the European Commission’s adequacy decision for the EU–US Data Privacy Framework, where the provider is certified under it, or on the Standard Contractual Clauses approved by the European Commission, with additional safeguards where needed. [To be confirmed: the transfer mechanism in each provider’s data processing agreement] You can ask us for a copy of the relevant safeguards at privacy@sparkwizz.app.

14. Your rights

Under the GDPR you have the right to:

• access your personal data and get a copy of it;
• have it corrected;
• have it deleted;
• restrict its processing;
• receive it in a portable format;
• object to processing based on our legitimate interests;
• withdraw your consent at any time, without affecting what was done before.

How to use them. Most of your data is only on your phone: you can read, edit, export and delete it in the app. To delete what our server holds, use Settings → Data → Delete all my data. For anything else, write to privacy@sparkwizz.app.

Because there are no accounts, our server doesn’t know who you are, and the app doesn’t show your anonymous ID. If you bought something, we can find your data from the order number of a Sparkwizz purchase. If you never bought anything, we usually can’t tell which server data is yours. In that case, as Art. 11(2) GDPR allows, we will tell you so, and we can act on a request to access, correct, restrict or port your data only if you give us details that let us find it. Delete all my data works for everyone, because the app itself proves the ID is yours. We will never ask for more than we need. We answer within one month; for complex requests we may extend this by two more months and will tell you why. Using your rights is free.

Objecting. To object to the processing of your paywall views, or to any other processing based on our legitimate interests, write to privacy@sparkwizz.app; if we can find your data, we stop and delete it. Delete all my data also deletes the paywall views recorded so far.

Do you have to give us data? No law requires you to. The cloud features can’t work without the text they process, and paywalls and purchases need the anonymous ID. Turning down usage statistics or crash reports has no consequences for you.

Complaints. You can complain to a data protection authority, in particular in the EU country where you live, work or where you think the law was broken. For example:

• Poland: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl;
• Ukraine: the Ukrainian Parliament Commissioner for Human Rights, ombudsman.gov.ua. Users in Ukraine also have the rights given by the Law of Ukraine “On Personal Data Protection”.

We’d appreciate the chance to sort out your concern first, so please consider writing to us before you complain.

15. Children

Sparkwizz is made for adults: it is not directed at anyone under 18, and we don’t knowingly process children’s personal data. The app has no accounts and doesn’t ask for your age. Its store content rating, which describes the app’s content rather than who it is for, is [To be confirmed: App Store and Google Play age ratings]. If you believe a child has sent us personal data, write to privacy@sparkwizz.app and we will delete it.

16. Security

• All connections between the app and our server are encrypted (HTTPS).
• The app can only call specific server functions; it has no direct access to database tables.
• The keys for AI, search and purchases stay on the server and are never in the app.
• Our database and logs don’t contain the text of your ideas.
• Encrypted backups are locked with your passphrase, which we never see.

No system is perfectly secure. If a breach affects your data, we will notify the supervisory authority and, where the law requires, you.

17. Changes to this policy

We’ll update this policy when the app or the law changes, and change the date at the top. If a change is significant, we will tell you in the app before it takes effect.

18. Contact

Privacy questions and requests: privacy@sparkwizz.app

Help with the app: support@sparkwizz.app · Help and support