privacy policy

Sparks ("Sparks," "we," "us," or "our") respects your privacy. This Privacy Policy explains how we collect, use, store, disclose, and otherwise process information when you use the Sparks mobile application, website, and related services (collectively, the "Service").

Sparks is currently operated by Ilo Shire, operating as Sparks.

By using Sparks, you acknowledge the practices described in this Privacy Policy.

1. Information We Collect

The information we collect depends on how you use Sparks and the features you choose to use.

A. Account Information

When you create or use a Sparks account, we may collect:

• email address;
• account identifier;
• authentication information;
• username;
• display name;
• account creation and update timestamps; and
• onboarding status.

Sparks currently uses email and password authentication. We do not currently collect a phone number, legal name, postal address, gender, or date of birth as part of account creation.

Passwords are handled through our authentication provider rather than stored by Sparks as readable passwords.

2. Profile Information

You may choose to provide information for your Sparks profile, including:

• username;
• display name;
• bio;
• profile photo;
• banner photo;
• vibes;
• theme preferences;
• privacy settings;
• Ready to Spark preferences;
• session visibility preferences;
• app preferences; and
• other profile information you choose to provide.

Your profile may also display information generated through your use of Sparks, such as:

• friends;
• followers;
• following;
• Sparks;
• rank;
• featured-contributor status; and
• activity or session information where applicable.

The current profile database contains these categories along with settings and preferences.

Public profile information

Some profile information is intended to be visible to other Sparks users.

Your profile photo and banner are currently stored using publicly accessible URLs.

Pre-launch implementation note: the current database allows broader access to profile rows than the intended public-profile experience and may expose preference/internal fields through direct API queries. We intend to correct this before public launch.

3. Location Information

Location is an important part of Sparks, so we want to be clear about how it works.

Your device location

With your permission, Sparks may access your device's location to:

• show Spots near you;
• calculate your distance from Spots;
• help display Spots on maps; and
• allow you to create a Spot using your current location.

The current version of Sparks requests foreground location permission only. We did not identify background location tracking in the current implementation.

Your current device location is generally used on your device for distance calculations.

Sparks does not currently maintain a database containing a continuous history of your device's location.

When your location becomes Spot information

If you choose your current location when creating a Spot, your coordinates may become the stored coordinates of that Spot and be transmitted to our backend.

Spot locations

Spots may contain:

• latitude;
• longitude;
• formatted address;
• place name;
• city;
• region;
• postcode;
• country; and
• information about how the location was selected.

Spot coordinates are currently stored as precise latitude and longitude values without intentional coordinate rounding. Users authorized to view a Spot may therefore be able to access its precise location.

You should avoid creating Spots that expose sensitive private locations where doing so could create a privacy or safety risk.

4. Spots, Reviews, and Community Content

When you contribute to Sparks, we collect the information necessary to store and display your contribution.

This may include:

Spots

• Spot name;
• description;
• category;
• precise coordinates and address information;
• visibility setting;
• smoke-friendly response;
• photographs;
• creation and update information; and
• saves and other aggregate information.

Reviews

Reviews may include:

• rating;
• written review;
• visit time or day;
• crowd information;
• vibes;
• recommendation;
• smoke-friendly response;
• photographs; and
• helpful votes.

Who can view this information depends on the content's visibility rules and other account controls.

5. Photos and Media

Sparks may collect photographs you choose to upload, including:

• profile photos;
• banner photos;
• Spot photos;
• review photos;
• session photos; and
• report evidence where that functionality is available.

Profile avatars and banners are currently stored in a public storage bucket.

Spot, session, and report-evidence media use private storage with access rules tied to the relevant content or report. Private media may be delivered through temporary signed URLs.

Sparks does not currently perform server-side facial recognition or automated image analysis.

The current implementation does not demonstrate a verified process for removing EXIF or other embedded metadata from uploaded photographs.

6. Social Information

When you interact socially on Sparks, we may collect information about those interactions.

This may include:

• users you follow;
• followers;
• friends;
• follow requests;
• blocked users;
• muted users;
• saved Spots;
• likes;
• comments;
• helpful votes; and
• related timestamps.

This information is used to operate Sparks' social features, determine content visibility, provide relevant activity, and support safety controls.

Some social information is visible to other users, while other information (such as your block list or saved Spots) is intended to remain private.

7. Ready to Spark

If you use Ready to Spark, Sparks may collect:

• whether your status is active;
• optional status text;
• who you choose to make it visible to; and
• expiration information.

Your Ready to Spark status is displayed according to the audience setting you select.

You can deactivate or update this status, and statuses may automatically expire.

8. Invites and Sessions

When you participate in an invite or session, we may collect information including:

• host;
• invited users;
• associated Spot;
• date and time;
• optional invite note;
• responses;
• attendance;
• session caption;
• session photographs;
• visibility;
• likes;
• comments; and
• related timestamps.

Invites and sessions use a linked Spot rather than storing a separate copy of your current device location.

Depending on your settings and the relevant feature, friends may also be able to see that you are currently participating in a session and potentially the name of the associated Spot.

9. Messages

Sparks currently provides messaging associated with invites rather than general-purpose direct messages.

We may collect:

• message sender;
• message text;
• timestamps;
• reactions; and
• read-state information.

Invite messages are currently limited to text in the implemented backend and may contain up to 2,000 characters.

Messages are stored to provide the invite conversation.

The current implementation does not allow users to individually delete invite messages.

Do not send information through Sparks messages that you would not want stored as part of the relevant invite conversation.

10. Sparks and Reputation Information

Sparks maintains reputation information associated with accounts.

This may include:

• your number of Sparks;
• rank;
• activities that resulted in Sparks being awarded;
• related users or content;
• timestamps; and
• information used to prevent duplicate or improper awards.

This information is used to operate Sparks' reputation and rank systems and prevent manipulation or abuse.

The underlying implementation currently stores reputation-award history and derived user totals.

11. Reports, Safety, and Moderation

When you report another user or content, we may collect:

• your user ID;
• the user or content being reported;
• report reason;
• subreason;
• details you provide;
• related Spot information where relevant;
• report status;
• timestamps;
• resolution information; and
• evidence you submit where evidence upload is available.

Reports are intended to be visible to the person who submitted them and authorized moderators, rather than other ordinary users.

We may also maintain moderation records including actions, notes, and audit information.

We use this information to investigate reports, enforce our Terms and Community Guidelines, protect users, prevent abuse, and maintain the integrity of Sparks.

12. Notifications and Device Information

If you enable notifications, Sparks may collect:

• Expo push token;
• platform;
• optional device identifier;
• notification preferences;
• token status; and
• timestamps associated with notification registration.

Notifications may contain information such as another user's display name or username, invite or session context, and potentially user-generated invite-message text.

You can control notification categories and push delivery through Sparks and your device settings where available.

Signing out currently disables the cached push token rather than deleting its database record.

13. App Preferences and Local Information

Sparks stores certain information locally on your device to operate and personalize the Service.

This may include:

• authentication session information;
• profile cache;
• map and location preferences;
• navigation preferences;
• hidden content;
• notification filters;
• interface preferences;
• theme or highlight choices; and
• certain development or diagnostic information.

Some of this information may use device-local storage rather than being transmitted to Sparks' servers.

14. How We Use Information

We may use information described in this Policy to:

• create and maintain accounts;
• authenticate users;
• provide and personalize Sparks;
• display profiles and User Content;
• provide Spot discovery and maps;
• calculate distances from Spots;
• operate social features;
• manage follows and friendships;
• provide Ready to Spark;
• operate invites, sessions, and messaging;
• provide Sparks and ranks;
• send notifications;
• process reports;
• provide blocking and other safety functionality;
• prevent spam, fraud, abuse, and manipulation;
• secure and maintain the Service;
• diagnose technical problems;
• comply with legal obligations;
• enforce our Terms and Community Guidelines; and
• develop and improve Sparks.

We do not currently use third-party advertising or advertising SDKs, and the audited implementation did not identify third-party analytics, attribution, payment, or cannabis-commerce SDKs.

15. How Information Is Shared

We do not sell your personal information.

We may disclose information in the following circumstances.

A. With other Sparks users

Information is shared with other users when necessary to provide the social features you choose to use.

For example:

• profile information may appear on your profile;
• public Spots can be viewed by other users;
• content restricted to friends is shared with eligible friends;
• invite information is shared with participants;
• session content is shared according to its visibility;
• Ready to Spark is displayed according to your selected audience.

B. Service providers

We use service providers to operate Sparks.

Based on the current implementation, these include technologies provided by companies such as:

• Supabase;
• Expo;
• Mapbox;
• native mapping and geocoding providers;
• Apple Maps;
• Google Maps; and
• Waze when you choose external navigation.

The type of information sent depends on the feature being used.

These providers may process information according to their own terms and privacy policies.

C. Legal and safety reasons

We may disclose information when reasonably necessary to:

• comply with applicable law or valid legal process;
• respond to lawful government requests;
• investigate fraud or security issues;
• protect the rights or safety of users or others;
• enforce our Terms; or
• establish, exercise, or defend legal claims.

D. Business transfers

If Sparks is involved in a merger, acquisition, financing, restructuring, sale of assets, or similar business transaction, information may be transferred as part of that transaction, subject to applicable law.

16. Third-Party Services

Some Sparks features interact with third-party services.

For example:

• Supabase provides authentication, database, backend, realtime, and file-storage infrastructure.
• Mapbox Search may receive location search queries and related search-session information.
• Native operating-system geocoding may process addresses or coordinates.
• Map providers may process map-related information when displaying maps.
• Expo Push Service may process push tokens and notification content.
• If you choose to open a Spot in an external navigation app, the relevant coordinates or address may be provided to that service.

The current implementation's third-party interactions are summarized in the code audit.

Your use of third-party services may also be subject to those providers' privacy policies.

17. Data Retention

We retain information for as long as reasonably necessary to provide Sparks and for purposes such as security, fraud prevention, dispute resolution, moderation, and compliance with legal obligations.

Different categories of information may be retained for different periods.

Currently:

• deleted Spots are generally soft-deleted, meaning their database records may remain;
• deleted reviews are generally soft-deleted;
• cancelled/completed/expired invites and their messages may remain;
• Sparks award history may remain;
• reports and moderation records may remain;
• session deletion is not currently implemented;
• some Storage files are removed on a best-effort basis; and
• some information stored locally on a device may remain after sign-out.

The current implementation does not yet define final retention periods for all categories of information.

We intend to establish appropriate retention practices before public launch and will update this Policy where necessary to reflect them accurately.

18. Account and Data Deletion

You may be entitled to request deletion of your account and personal information, subject to information we may retain where necessary or permitted for purposes such as:

• security;
• fraud and abuse prevention;
• legal compliance;
• resolving disputes;
• enforcing agreements; or
• maintaining appropriate moderation and safety records.

Certain content involving other users may also require special treatment. For example, a shared session or conversation may contain information belonging to multiple participants.

Current pre-launch status: Sparks' account-deletion interface is not yet connected to a functioning account-deletion backend. The current screen states that deletion is unavailable.

A functional deletion mechanism must be implemented before we represent account deletion as available to users.

19. Your Privacy Choices

Depending on the feature, Sparks provides controls that may allow you to:

• edit profile information;
• make your account private;
• control certain activity visibility;
• control Ready to Spark visibility;
• manage notification preferences;
• follow or unfollow users;
• block users;
• mute users;
• hide certain content;
• remove or edit certain User Content; and
• clear notifications.

Available controls may change as Sparks evolves.

20. Privacy Rights

Depending on where you live, privacy laws may provide rights concerning your personal information.

These may include rights to:

• know what personal information we process;
• request access to your information;
• request correction of inaccurate information;
• request deletion;
• object to or restrict certain processing;
• receive certain information in a portable format; and
• withdraw consent where processing is based on consent.

These rights are not absolute and may be subject to legal exceptions.

To exercise a privacy right, contact us using the details at the end of this Policy.

We may need to verify your identity before completing certain requests.

21. UK and European Users

If UK or European data-protection law applies to our processing, Sparks will process personal information only where there is an appropriate legal basis.

Depending on the circumstances, this may include:

Contract: where processing is necessary to provide Sparks and features you request.

Legitimate interests: where reasonably necessary to operate, secure, improve, and protect Sparks and its community, provided those interests are not overridden by your rights.

Consent: where we ask for your permission, such as certain device permissions or other processing requiring consent.

Legal obligations: where processing is necessary to comply with applicable law.

UK privacy guidance requires privacy information to explain matters including the purposes and lawful bases for processing, retention, recipients, applicable international transfers, and individual rights.

Where applicable, users may also have rights to complain to the relevant data-protection authority.

Before launch, this section should be reviewed once we determine the legal establishment and jurisdiction of Sparks, because that affects which UK/EU obligations and representative requirements may apply.

22. U.S. State Privacy Rights

Residents of certain U.S. states may have additional privacy rights under applicable state law.

Depending on the law and circumstances, these may include rights to request access, correction, deletion, or information about how personal information is collected and disclosed.

Sparks does not currently sell personal information or use the audited app implementation for targeted advertising.

If Sparks' business practices or legal obligations change, we will update this Policy and provide any controls required by applicable law.

23. International Data Transfers

Sparks and its service providers may process information in countries other than the country where you live.

Those countries may have different data-protection laws.

Where applicable law requires safeguards for international transfers, we will use appropriate mechanisms to protect personal information.

The exact international-transfer structure should be finalized before launch after confirming the production Supabase infrastructure, other production providers, and the legal entity/location operating Sparks.

24. Security

We use technical and organizational measures intended to protect information from unauthorized access, loss, misuse, alteration, or disclosure.

Current technical measures include authentication, database access controls, Row Level Security policies, private Storage buckets for certain content, and access controls around reports and other sensitive information.

However, no system is completely secure, and we cannot guarantee absolute security.

If you believe your Sparks account or information has been compromised, contact us.

25. Children and Age Restrictions

Sparks is for adults aged 18 and older.

The Service is not intended for anyone under 18, and people under 18 may not create or use a Sparks account.

We do not knowingly intend to collect personal information from people under 18.

If we learn that someone under 18 has created an account or provided personal information through Sparks, we may take steps to restrict or remove the account and delete or otherwise appropriately handle the associated information, subject to applicable legal obligations.

If you believe someone under 18 is using Sparks, please contact us.

Pre-launch implementation note: the current application does not yet contain an age gate or minimum-age confirmation.

26. Changes to This Privacy Policy

We may update this Privacy Policy as Sparks changes.

When we make changes, we will update the "Last Updated" date above.

If changes are material, we may provide additional notice through the Service, website, email, or another appropriate method.

Where applicable law requires consent for a change, we will request it.

27. Contact Us

If you have questions about this Privacy Policy, want to exercise a privacy right, or have a privacy-related complaint, contact:

Sparks