Last updated: May 25, 2026
01 Introduction
At Spark, operated by Ignite Web Studio ("Spark," "we," "our"), we deeply respect your privacy and take protecting your personal information seriously. This Privacy Policy explains what data we collect, how we use it, who we share it with, and the rights you have regarding your information. It applies to the Spark mobile application (iOS and Android) and the spark.app website. By using Spark, you accept the practices described in this document.
02 Information we collect
We collect three categories of information: (a) Data you provide directly: email address, optional name, preferred language, favorite phrases, saved sounds, notification settings. (b) Data generated automatically through use: anonymous installation identifier, device model and OS version, timezone, technical error reports without personal data, aggregated usage data (e.g., which categories are most popular). (c) Third-party data: subscription status via RevenueCat, basic profile (name, email) if you choose to sign in with Apple ID or Google.
03 How we use your information
We use your information only for legitimate, specific purposes: provide and maintain the service (sync favorites and subscription across devices), process Premium payments through RevenueCat, send notifications you have explicitly enabled, respond to your support requests, improve experience through anonymous and aggregated analytics, prevent fraud and abuse, and comply with applicable legal obligations. We do not use your personal information for third-party personalized advertising, nor do we sell it to data brokers.
04 Legal basis for processing
If you are located in the European Economic Area (EEA), United Kingdom, Switzerland, or jurisdictions with similar laws, we process your personal information based on: (a) your consent, which you can revoke at any time, (b) performance of the contract necessary to provide you the service, (c) our legitimate interests in operating, improving, and protecting the product, provided they do not compromise your fundamental rights, and (d) compliance with applicable legal obligations. You can contact us to learn the specific legal basis that applies to a particular processing activity.
05 How we share your information
We do not sell your personal data under any circumstances. We only share information with: Supabase Inc. (database hosting and authentication, based in the United States), RevenueCat Inc. (premium subscription management), Apple Inc. and Google LLC (payment processing through App Store and Google Play, subject to their own terms), technical service providers such as error monitoring and hosting, all under strict confidentiality and data processing agreements. We may also disclose information when required by a competent legal authority or in the event of a business transfer (merger, acquisition), notifying you in advance.
06 Data retention
We retain your personal information while your account is active and for the reasonable time necessary to fulfill the purposes described in this policy. You may request deletion of your account and all associated data at any time from the app (Settings → Account → Delete account) or by writing to spark@ignite-web-studio.com. We process deletions within a maximum of 30 calendar days, except when we must retain certain data due to legal obligations (tax records, judicial requirements, fraud prevention) for limited and proportional periods.
07 Data security
We implement reasonable and proportional technical and organizational measures to protect your information: encryption in transit (TLS 1.3), encryption at rest in the database, authentication with short-lived JWT tokens, Row Level Security at the Postgres level, permission segmentation by role, and continuous security review processes. However, no system is 100% secure. In the event of a security breach affecting your personal information, we will notify you without undue delay and in accordance with applicable legal deadlines (72 hours under GDPR where applicable).
08 Your rights
Depending on your jurisdiction, you have the following rights regarding your personal information: access (obtain a copy of your data), rectification (correct inaccurate or incomplete data), erasure (right to be forgotten), portability (receive your data in structured, machine-readable format), restriction or objection to processing, withdrawal of consent at any time without affecting the lawfulness of prior processing, and the right to file a complaint with the competent data protection authority. To exercise any of these rights, write to spark@ignite-web-studio.com with the subject "Data Rights Request." We respond within a maximum of 20 business days.
09 Children's privacy
Spark is not directed at children under 13 years of age, and we do not knowingly collect personal information from children of that age. If you are between 13 and 18 years old, you must have verifiable authorization from your parent or legal guardian to use the service. If you discover that a child under 13 has provided us with personal information without parental authorization, contact us immediately at spark@ignite-web-studio.com to delete such information. We comply with the Children's Online Privacy Protection Act (COPPA) of the United States and equivalent regulations in other jurisdictions.
10 International transfers
Our primary servers are located in the United States (Supabase in us-east-1, RevenueCat) and Mexico (Ignite Web Studio offices). If you are located outside these countries, your data will be transferred and processed internationally. We implement standard contractual clauses approved by the European Commission and other legal safeguards to protect your information during these transfers, in accordance with applicable regulations (GDPR Chapter V, Federal Law on Protection of Personal Data Held by Private Parties in Mexico, among others).
11 California residents rights
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA): right to know what personal information we collect and how we use it, right to delete your personal information, right to correct inaccurate information, right to opt out of sharing your information, and right not to receive discriminatory treatment for exercising these rights. We do not sell or share your personal information for cross-context behavioral advertising. To exercise these rights, write to spark@ignite-web-studio.com with subject "California Rights."
12 Cookies and similar technologies
Our spark.app website uses only essential cookies necessary for the site to function correctly: keep your session signed in, remember your preferred language (es / en), and prevent CSRF attacks on the contact form. The mobile application does not use cookies in the strict sense, but does store anonymous local identifiers to maintain your session and preferences. We do not use Google Analytics cookies, Meta Pixel, or any type of behavioral or advertising tracker. For more details, see our Cookie Policy.
13 Changes to this policy
We may update this Privacy Policy occasionally to reflect changes in our practices, new features, or legal or regulatory reasons. When we make significant changes that affect your rights or the processing of your personal information, we will notify you by email (if you have an account) and through a visible notice within the app at least 30 calendar days before the changes take effect. The "Last updated" date in the header will always reflect the current version. Continued use of the service after changes take effect implies acceptance of the new policy.
14 How to contact us
If you have questions, concerns, or requests related to this Privacy Policy or the processing of your personal information, you can contact us by email at spark@ignite-web-studio.com, through our contact form available at /en/contact, or by postal mail to Ignite Web Studio in Mexico. We respond to all privacy requests within a maximum of 48 business hours. The Spark Data Protection Officer is reachable at the same email address.