Spark App Studio ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our custom app development platform.
By using our services, you agree to the collection and use of information in accordance with this policy.
2. Information We Collect
2.1 Account Information
When you create an account, we collect:
Email address
First and last name
Password (stored securely using bcrypt hashing)
Account type (client, developer, or admin)
Profile image (optional)
2.2 Contact Information
When you submit inquiries or apply as a developer, we may collect:
Phone number
Company name
Professional URLs (portfolio, LinkedIn, GitHub)
2.3 Project Information
When you use our services to develop an app, we collect:
AI-generated app descriptions and technical recommendations
Communication messages related to your project
Project documents and files
2.4 Payment Information
When you make a payment, we collect:
Payment amount and type (deposit, final payment)
Stripe payment IDs and payment intent IDs
Payment status and timestamps
Note: We use Stripe for payment processing. Credit card information is collected and stored directly by Stripe and never touches our servers. Please review Stripe's Privacy Policy for details on how they handle your payment data.
2.5 Developer Application Data
If you apply to become a developer, we collect:
Skills and experience information
Motivation and application responses
Application status and review history
2.6 Authentication and Security Data
To secure your account, we collect:
Email verification tokens
Two-factor authentication (2FA) secrets (TOTP)
JWT access and refresh tokens
Revoked token lists for logout security
Login activity timestamps
2.7 Audit and System Logs
For security and service improvement, we maintain:
Negotiation audit trails (quote approvals, project status changes)
If you sign up for The Useful Machine weekly email, we collect:
Your email address
Where you signed up (for example, the blog page or a specific post)
When you signed up, confirmed, and unsubscribed, and when we last sent you the email
You don't need an account to subscribe. Links in the email include tags that tell us a visit came from the newsletter, but not who clicked.
3. How We Use Your Information
We use your information for the following purposes:
Service Delivery: To provide, maintain, and improve our custom app development services
Account Management: To create and manage your account, authenticate users, and maintain account security
Project Management: To facilitate communication between clients and developers, manage projects, and deliver completed applications
AI-Powered Features: To generate app descriptions and recommendations using OpenAI's GPT-4 based on your quiz responses
Payment Processing: To process payments, track payment status, and maintain financial records
Developer Matching: To assign inquiries to appropriate developers based on availability and expertise
Communication: To send service-related notifications, project updates, and respond to inquiries
The Useful Machine Newsletter: If you subscribe and confirm, to send you one email a week with recent posts from our blog. We use your newsletter email address only for this. We don't sell it, share it for others' marketing, or add it to other mailing lists
Security: To detect and prevent fraud, unauthorized access, and other security issues
Legal Compliance: To comply with legal obligations and enforce our Terms of Service
Service Improvement: To analyze usage patterns and improve our platform
4. Data Sharing and Disclosure
4.1 Within Our Platform
Clients and Developers: Project details, messages, and documents are shared between clients and their assigned developers
Administrators: Have access to user data, projects, and audit logs for platform management and quality assurance
4.2 Third-Party Service Providers
We share data with trusted third-party providers who assist in operating our platform:
Stripe: Payment processing (see their privacy policy)
OpenAI: AI-powered app description generation (quiz responses are sent to generate recommendations)
Railway: Application hosting, database, and secure file storage
Resend: Delivery of account, project, and newsletter emails
Unsplash: Photos on our blog are loaded from Unsplash's servers, which receive standard request information such as your IP address and browser type (see Unsplash's Privacy Policy)
Sentry: Error monitoring to keep the platform reliable
PostHog: Product analytics about how visitors use our site, as described in Section 8
4.3 Legal Requirements
We may disclose your information if required to do so by law or in response to valid requests by public authorities.
4.4 Business Transfers
If we are involved in a merger, acquisition, or asset sale, your information may be transferred. We will provide notice before your information becomes subject to a different privacy policy.
4.5 With Your Consent
We may share your information for other purposes with your explicit consent.
5. Data Security
We implement industry-standard security measures to protect your data:
Encryption: Passwords are hashed using bcrypt; data is transmitted over HTTPS
Authentication: JWT-based authentication with short-lived access tokens (15 minutes) and secure refresh tokens (7 days)
Token Revocation: Immediate token invalidation upon logout
Two-Factor Authentication: Optional TOTP-based 2FA for enhanced account security
Access Controls: Role-based permissions ensure users only access authorized data
Secure Storage: Database hosted on secure PostgreSQL servers with regular backups
While we strive to protect your information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.
6. Data Retention
We retain your information for as long as necessary to provide our services and comply with legal obligations:
Account Data: Retained while your account is active and for a reasonable period afterward for legal and business purposes
Project Data: Retained for the duration of the project and for record-keeping purposes
Payment Records: Retained for tax and accounting purposes as required by law (typically 7 years)
Audit Logs: Retained for security, compliance, and dispute resolution purposes
Suspended Accounts: Account data is preserved (soft delete) to maintain historical records
Newsletter Subscriptions: Kept while you're subscribed. If you unsubscribe, we keep your email address marked as unsubscribed so we never email you again by mistake. If you sign up but never confirm, we send only the one confirmation email. You can ask us to delete your address entirely at any time
7. Your Rights and Choices
Depending on your jurisdiction, you may have the following rights:
Access: Request a copy of the personal data we hold about you
Correction: Update or correct inaccurate information through your account settings
Deletion: Request deletion of your account and associated data (subject to legal retention requirements)
Objection: Object to certain processing of your data
Data Portability: Request a copy of your data in a structured, machine-readable format
Withdraw Consent: Withdraw consent for data processing where consent was the legal basis
Unsubscribe: Every newsletter email has an unsubscribe link, and most email apps also show a one-click unsubscribe button. Unsubscribing takes effect immediately
To exercise these rights, please contact us at the information provided below.
8. Cookies and Tracking
We use the following technologies:
HTTP-Only Cookies: Used to store refresh tokens securely for authentication (7-day expiration)
Session Storage: Access tokens stored in memory for the duration of your session
Local Storage: May be used for theme preferences and non-sensitive application settings
Analytics (PostHog): We measure how visitors use our site, such as which pages they view and how far they get in the estimate quiz, so we can improve it. These events do not include what you type or your email address. Until you choose in the cookie banner, analytics runs without cookies or stored identifiers. If you accept analytics cookies, an identifier is stored so we can connect visits over time. If you reject them, no analytics data is sent. You can also opt in when you create an account. You can change your choice anytime under Cookie Preferences in the footer.
Share Buttons: The share buttons on our blog posts are plain links. They don't load any code from LinkedIn, X, Facebook, or other networks, and nothing is sent to them unless you click one. If you do, you're taken to that network, and its own privacy policy applies
9. Children's Privacy
Our services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information, please contact us immediately.
10. International Data Transfers
Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that differ from your jurisdiction. We take steps to ensure your data receives adequate protection wherever it is processed.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of our services after changes constitutes acceptance of the updated policy.
12. Contact Us
If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us at:
Spark App Studio Email: privacy@sparkappstudio.com For data protection inquiries: dpo@sparkappstudio.com
13. Data Protection Officer
For users in jurisdictions requiring a Data Protection Officer, you may contact our DPO at dpo@sparkappstudio.com for privacy-related concerns.