Privacy Policy

Here is what happens when you upload an image or video:

• Your file is saved in the form you sent it. We do not resize it, re-encode it, or lower its quality.
• We do not remove EXIF data from photos. A photo can carry location, device and timestamp info. If you do not want that stored, strip it before you upload. Your phone or photo app can do this.
• Some platforms need a set format. Instagram and TikTok need JPEG, for example. When that happens we make a converted copy for that post. Your file stays as it is, and the copy is deleted at the same time as the file.
• Your files are reached through signed links our app controls. They are not public and they are not listed anywhere.
• To have a file deleted sooner, email privacy@sprkly.app.

Files are stored in Cloudflare R2 object storage.

Your files are kept according to your plan:

Expired files are deleted daily by an automated cleanup job. To have a file deleted sooner, email privacy@sprkly.app.

We store the following account information to operate the service:

• Email address and display name, from the sign-up form, or from Google when you sign in with Google
• Profile picture URL (served from your OAuth provider's CDN)
• Connected social platform handles and OAuth access tokens and refresh tokens, encrypted at rest before storage
• Bluesky sign-in tokens, encrypted the same way. You sign in on Bluesky, so we never see your Bluesky password
• Scheduled post captions and target platforms
• Referral codes and reward history
• How you found sprkly, the country you signed up from, and which features you use

We do not sell or rent your personal data. We do not give your name, your email or your posts to anyone for advertising. The Meta Pixel can tell Meta that an account was created, but not whose. See section 9.

If you connect Instagram messaging, we receive some data from Meta so you can read and answer people from sprkly.

• What we receive: direct messages sent to your account, comments on your posts, button taps inside messages, and the sender's Instagram id and handle.
• Why: to show them in your inbox, to send the replies you set up, and so you can reply by hand.
• What we send: only the DMs and comment replies you set up, and the replies you type yourself, from your account.
• How long: message and comment text is kept for 30 days. The sender and time details are kept for 13 months. An automatic job deletes them after that.
• Email addresses: if an automation asks for an email and someone replies with one, we store that address and the time they sent it, so you can follow up. It is deleted with the sender details, after 13 months.
• Unsent messages: if someone unsends a message, we delete its text as soon as Instagram tells us.
• Hidden and deleted comments: if you hide or delete a comment in sprkly, we do it on Instagram and mark our copy.
• Automated replies only go to people who commented on or messaged your account first. Anyone can reply STOP to end them. After STOP, that person gets no automatic reply unless they ask again with your keyword. sprkly never messages anyone on its own.
• We do not sell this data. We do not use it to train AI. Disconnecting the Instagram account or deleting your sprkly account removes these records.

This data is used only for the features above, under Meta's Platform Terms.

We use administrative, technical, and organizational safeguards designed to protect personal information and sensitive data used to provide sprkly.

• Encryption in transit: sprkly is served over HTTPS/TLS to protect data transmitted between your browser and our service.
• Encryption at rest: OAuth access tokens and refresh tokens for connected platforms, including Google/YouTube, are encrypted before storage using AES-256-GCM. Tokens are decrypted only when needed to connect, refresh, publish, delete, or verify content on your behalf.
• Secret management: API keys, OAuth client secrets, signing secrets, and token-encryption keys are stored separately from application code in protected environment secrets and are not shipped in client-side application bundles.
• Least-privilege access: Access to production systems and stored user data is restricted to authorized personnel and service processes that need access to operate, secure, debug, or support the service.
• Media protections: Your files are stored in Cloudflare R2 and reached only through signed links our app controls. Those links are time limited and are not listed anywhere public. Note that we do not strip EXIF data from photos. See section 1.
• Monitoring and incident response: We monitor service health and errors, investigate suspected unauthorized access, and will notify affected users or authorities when legally required.

If you connect a YouTube channel, sprkly requests only the Google OAuth scopes needed for YouTube scheduling and publishing, such as YouTube upload and YouTube read-only channel scopes. We use this data to authenticate your channel, display connected-channel information, upload scheduled videos or Shorts, refresh expired access tokens, and record publishing results.

We do not sell Google user data, use it for advertising, or transfer it except as needed to provide sprkly's user-facing features, comply with law, prevent abuse, or protect the service. You can disconnect your YouTube account or delete your sprkly account to revoke sprkly's stored access, and you can also revoke access from your Google Account permissions page.

sprkly's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• Cloudflare R2 and D1: file storage and database.
• Stripe: payment processing. We only store the Stripe Payment Intent ID; your card details are never on our servers.
• OAuth providers (Google and others): used for sign-in. We receive only the scopes you explicitly grant.
• The social platforms you connect(Instagram, Facebook, Threads, TikTok, YouTube, Bluesky and X): we send them the posts you schedule. Each one handles your post under its own privacy policy.
• Google Analytics: counts visits to our site. See section 9.
• Meta Pixel: measures our ads. See section 9.
• Whop: to see which visits turn into sales on Whop. See section 9.

You can delete your account at any time from Settings → Account. This permanently removes:

• Your account record and all associated data
• All media files (optimised versions and thumbnails) from Cloudflare R2
• All scheduled posts, referral records, and credit purchase history

Deletion is irreversible and is completed within 48 hours. Stripe records are subject to Stripe's own retention policies for financial compliance purposes.

To export a copy of your data before deleting, email privacy@sprkly.app.

• We use a session cookie to keep you signed in.
• We use Google Analytics to count visits. It is a third-party analytics tool and it sets cookies. In the EU, the UK and Switzerland it runs only if you accept analytics cookies. Elsewhere it runs unless you decline them in the cookie banner.
• We save how you first found us: the site you came from, the first page you saw, and any campaign tag. This is kept in a cookie called sprkly_ft for 90 days. In the EU, the UK and Switzerland it is set only if you accept analytics cookies. Elsewhere it is set when you first visit. It is not set if you decline analytics cookies. If it is already there, we delete it.
• We use the Meta Pixel to see if our ads work. It is an advertising tool from Meta and it sets cookies.
• It runs on our public pages and on the plans page. It tells Meta which of those pages you opened, that an account was created, and that a plan was started or bought, with its price. It does not send your name, your email, or anything you post.
• It does not run on the password reset page, on the pages that connect an AI tool, or on any page whose link carries a sign-in or connect request.
• In the EU, the UK and Switzerland it runs only if you accept advertising cookies. Elsewhere it runs unless you decline them in the cookie banner.
• We use the Whop pixel to see which visits turn into sales on Whop. It sets cookies and keeps an id for your browser. It runs on the same pages as the Meta Pixel, and by the same advertising cookie rules. It does not read what you type into forms.
• When you are signed in, we record which screens you open and which features you use. This is tied to your account. We use it to fix problems and decide what to build.
• On the plans page, Stripe sets its own cookies (__stripe_mid and __stripe_sid). They help stop fraud and are needed to take payment.
• Our host, Cloudflare, may count page views with Cloudflare Web Analytics. It does not set cookies.
• We do not sell this data.
• What you post, schedule and see inside the app is not sent to Meta.

• Who is responsible: sprkly is run by WILLOW TECH PTE. LTD., a company in Singapore. It is the data controller for your account data.
• Your followers' data: Messages and comments from your followers belong to your account. You decide what happens to them. We handle them for you.

Why we may use your data:

• To run your account and publish your posts. This is our contract with you.
• To keep the service safe and fix problems. This is our legitimate interest.
• To count visits and measure ads with cookies. Only with your consent.
• To meet legal duties, such as tax records.

Your rights:

• See the data we hold about you.
• Fix data that is wrong.
• Delete your data.
• Get a copy of your data to take elsewhere.
• Ask us to stop or limit a use of your data.
• Withdraw your consent at any time. Use the "Cookie settings" link at the bottom of the page.

How to use them:

• Email privacy@sprkly.app. We reply within 5 business days, and we finish your request within one month.
• You can also complain to the data protection authority in your country.

Where your data goes:

• Our providers (Cloudflare, Google, Meta, Stripe) may handle data outside your country, including in the United States.
• Where the law asks for it, the transfer is covered by standard contractual clauses or a similar safeguard.

Automated decisions:

• We do not make decisions about you by automated means that have a legal effect on you.

Questions about this policy or your data? Email privacy@sprkly.app. For legal and privacy requests, we respond within 5 business days. A request to use your rights in section 10 is finished within one month.