The short version.
Your account, habits and Circle are stored securely in the EU so they follow you to a new phone. Your journal, mood and settings stay on your iPhone. Your contacts are never uploaded. We don't sell data, don't show ads, and don't track you across apps or websites. You can export or delete everything at any time.
1. Who we are
Spark is developed and offered by Inner Craft B.V., a private limited company (besloten vennootschap) based in the Netherlands ("Spark", "we", "us", "our").
We are the controller of the personal data described in this policy under the EU General Data Protection Regulation (GDPR) and the Dutch GDPR Implementation Act (UAVG).
For all questions about privacy, your data or Spark in general, email info@sparkhabitapp.com.
We have not appointed a Data Protection Officer because we are not required to. The address above handles all privacy matters.
2. What this policy covers
This policy applies to the Spark iPhone app, this website, emails we send you, and any contact you have with our support team. It explains what personal data we collect, why, on which legal basis, how long we keep it, who we share it with, and what rights you have.
3. Data we collect
The table below lists every category of personal data Spark processes. Data marked on your device never leaves your iPhone unless you export it yourself.
| Category | Examples | Where it is stored | Source |
|---|---|---|---|
| Account data | Email address, display name, account ID, sign-in timestamps | Our servers (EU) | You |
| Habit data | Habit names and sentences, type (build or break), schedule, reminder time, rest days, pauses, check-ins, setbacks, streaks, badges reached, colour and icon choices | Our servers (EU) | You |
| Your Circle data | Connections, shared habits, cheers and nudges sent and received, personal invite code, profile badge and name shown to your circle, blocked people, sharing settings | Our servers (EU) | You and the people in your circle |
| Journal and mood | Journal entries, evening questions answered, 1–10 mood scores, pinned entries | On your device | You |
| Meditation and learning | Meditation sessions, lessons read and saved | On your device | You |
| App settings | Appearance, app icon, language, notification choices, haptics, app lock settings | On your device | You |
| App lock passcode | The passcode you choose | On your device, in the iOS secure keychain | You |
| Contacts | Names and phone numbers in your address book, only while you choose people to invite | Read on your device only, never uploaded or stored | Your iPhone, with your permission |
| Subscription status | Whether Spark Pro is active, plan, trial and renewal dates | Our servers (EU); payment data stays with Apple | Apple |
| Email delivery data | Email address, time sent, delivery status | Our email provider | Generated when we email you |
| Support data | Your messages, email address, device model and iOS version if you share them | Our mailbox | You |
| Technical data | IP address and request logs when the app or website contacts our servers | Our providers, short-term | Your device |
We do not collect your location, photos, health data from Apple Health, advertising identifiers or browsing history, and we do not use analytics or advertising SDKs in the app.
Face ID is handled entirely by iOS. Spark only receives a yes or no from iOS and never sees your biometric data.
4. Why we use your data and our legal basis
| Purpose | Data used | Legal basis (Art. 6 GDPR) |
|---|---|---|
| Create your account and let you sign in with an email code | Account data, email delivery data | Performance of a contract (6(1)(b)) |
| Save and sync your habits, streaks and badges | Habit data | Performance of a contract |
| Run Your Circle: invitations, shared habits, cheers and nudges | Circle data, account data | Performance of a contract |
| Show contacts so you can pick people to invite | Contacts, on your device only | Consent (6(1)(a)) via the iOS permission prompt |
| Send reminders and mood or journal prompts | Reminder settings, on your device | Consent via the iOS notification permission |
| Provide Spark Pro and restore purchases | Subscription status | Performance of a contract |
| Send essential emails: sign-in codes, security notices, account deletion confirmation | Account data | Performance of a contract |
| Send product emails such as a welcome email or a trial reminder | Account data | Legitimate interest (6(1)(f)) in helping you use what you signed up for; you can opt out at any time |
| Answer support requests | Support data | Performance of a contract or legitimate interest |
| Keep Spark secure, prevent abuse, enforce limits and fix errors | Technical data, account data | Legitimate interest in a safe and working service |
| Meet legal obligations, such as tax and accounting rules | Subscription and invoice records | Legal obligation (6(1)(c)) |
Where we rely on legitimate interest, we have weighed our interest against your privacy and limited the data to what is needed. You can object at any time (see section 9).
Is providing data required? An email address is required to create an account, because we use it to sign you in. Everything else is optional. Without an account you can still try Spark on your device, but your habits are not backed up.
5. Spark AI
Spark AI is an optional Spark Pro feature. When you send it a message, your message and the habit information needed to answer it are sent to our AI provider, listed in section 7, to generate a reply. Your journal and mood are not sent unless you include them in your message. AI replies are suggestions, not professional advice. We do not use your conversations to train AI models, and we require our provider not to do so either.
6. Automated decisions
Spark does not make decisions about you based solely on automated processing that have legal or similarly significant effects. Badges and streaks are calculated from your own check-ins and only affect what you see in the app.
7. Who we share data with
We never sell your personal data and never share it for advertising. We only share data with the service providers below, who process it on our behalf under a data processing agreement and may not use it for their own purposes:
| Provider | Purpose | Location of data |
|---|---|---|
| Supabase Inc. | Database, sign-in and server functions | EU (Ireland) |
| Resend | Sending sign-in codes and account emails | United States |
| Apple Inc. | App distribution and in-app purchases | Global (Apple acts as an independent controller for App Store purchases) |
| Cloudflare, Inc. | Website hosting and security | Global network |
| Expo (650 Industries, Inc.) | Delivering app updates | United States |
| [AI provider] | Generating Spark AI replies | [Location] |
People in Your Circle see only what you choose to share. We may also disclose data if Dutch or EU law requires it, for example in response to a court order, or to protect the rights and safety of our users.
8. International transfers
Some providers are based in, or may access data from, the United States. Where personal data is transferred outside the European Economic Area, we rely on the EU–US Data Privacy Framework for certified providers or on the European Commission's Standard Contractual Clauses, with additional safeguards where needed. You can request a copy of these safeguards by emailing us.
9. How long we keep data
| Data | Retention |
|---|---|
| Account, habit and Circle data | As long as your account exists. Removed from live systems when you delete your account and from backups within 30 days. |
| Cheers and nudges | Until you or the other person delete the connection or the account |
| Data on your device (journal, mood, settings) | Until you delete it, delete your account or remove the app |
| Email delivery logs | Up to 30 days |
| Support conversations | Up to 2 years after our last contact |
| Server and security logs | Up to 90 days |
| Subscription and invoice records | 7 years, as required by Dutch tax law |
10. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you and receive a copy.
- Rectification of incorrect data. You can change your name and email in Settings.
- Erasure: delete your account in the app or ask us to delete your data.
- Restriction of processing while a request or complaint is handled.
- Data portability: export your data as JSON or CSV in Settings → Your data.
- Object to processing based on legitimate interest, including product emails.
- Withdraw consent at any time, for example by turning off notifications or contacts access in iOS Settings. This does not affect processing before you withdrew it.
To use your rights, email info@sparkhabitapp.com from the address linked to your account. We may ask you to confirm your identity. We reply within one month; if a request is complex we may extend this by two months and will tell you why.
You also have the right to lodge a complaint with a supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens. You can also contact the authority in the EU country where you live. We would appreciate the chance to resolve your concern first.
11. Deleting your account
Open Spark, go to Settings → Your data → Delete account and confirm with the code we email you. Your account and its server data are removed straight away. See Delete your account for details. Deleting your account does not cancel an App Store subscription; cancel it in your Apple ID settings.
12. Security
We use encryption in transit (TLS) and at rest, row-level security so that each account can only access its own data, short-lived sign-in codes instead of passwords, and access controls for the few people who maintain the service. Optional app lock protects Spark on your iPhone with Face ID or a passcode. If a data breach is likely to put your rights at risk, we will notify the Autoriteit Persoonsgegevens within 72 hours and inform you without undue delay.
13. Children and teenagers
Spark is intended for people aged 13 and over. If you are under 16, please use Spark only with the permission of a parent or guardian, who can contact us on your behalf to use your privacy rights. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has created an account, contact info@sparkhabitapp.com and we will delete it.
14. Cookies and this website
This website does not use cookies, analytics, tracking pixels or advertising. Our hosting provider processes your IP address and basic request data to deliver the pages and protect the site against abuse. The website loads fonts from Google Fonts, so your browser connects to Google, which receives your IP address.
15. Changes to this policy
We may update this policy when Spark changes or the law requires it. If changes are significant, we will tell you in the app or by email before they take effect. The date at the top shows the latest version.
16. Contact
Inner Craft B.V.
The Netherlands
info@sparkhabitapp.com