Privacy Policy

Last updated: 31 October 2026

This Privacy Policy explains how Sparkl ("Sparkl", "we", "us", or "our") collects, uses, shares, and protects information when you use the Sparkl mobile application and the website at sparkl.gg (together, the "Service"). We built Sparkl to treat your collection — and your data — with care.

1. Who we are

Sparkl is a premium iPhone application for trading-card-game collectors. It lets you scan and identify cards, organize your collection, track its estimated market value, build decks and binders, and set price alerts. The Service is operated by Sparkl. If you have any questions about this policy or your data, contact us at contact@sparkl.gg.

2. Information we collect

2.1 Account information

You can create an account using Sign in with Apple or Continue with Google. When you do, we receive a limited set of details from that provider — your name (if shared), your email address (or a provider-relayed/private email), and a stable account identifier — which we use to create and secure your account and to sync your collection across your devices. We never receive your Apple or Google password.

2.2 Collection & usage content you create

To provide the Service, we store the data you add to your collection — for example the cards you scan or add, finishes and conditions, quantities, binders, decks, wishlist and price-alert targets, and notes. We also store app preferences such as language and display settings.

2.3 Card scanning (camera)

When you scan a card, the app uses your device camera to capture an image solely to recognize the card. Scan images are used only for card identification, are not used to identify you, and are not retained longer than necessary to process the recognition. We do not access your camera for any other purpose, and we do not access your photo library unless you explicitly choose to import an image.

Card recognition, in the app and on our website, is processed on our behalf by Google Cloud. The free scanner on sparkl.gg needs no account: the photo you choose is used only to recognize the card and is not stored. Scans are protected from abuse by Cloudflare Turnstile and limited per visitor.

2.4 Purchases

Card scanning is free and unlimited. Sparkl also offers an optional paid "Pro" subscription. Payments are processed by the Apple App Store. Sparkl uses RevenueCat, Inc. as a service provider to present Pro products, manage in-app purchases and restores, and receive subscription-lifecycle information. After Sparkl freshly verifies your signed-in account, the app gives RevenueCat your stable internal Sparkl account UUID. RevenueCat also processes Apple purchase history and subscription or transaction state, together with limited device technical information needed to operate its service. Sparkl does not configure RevenueCat customer attributes with your name or email address, and neither Sparkl nor RevenueCat receives your full payment-card details.

Deleting your Sparkl account or the related RevenueCat customer record does not cancel an Apple subscription, stop Apple billing, or issue a refund. You must manage or cancel the subscription separately through Apple.

2.5 Device & diagnostic data

Like most apps and websites, we automatically receive limited technical data such as device type and operating-system version, app version, language, approximate region, and basic interaction or crash/diagnostic events. This helps us keep the Service reliable and improve it.

Protection against automated access (website). When the web app starts, your browser runs a short check that tells people from automated programs: Cloudflare Turnstile, and a few technical properties of the browser, such as its graphics renderer, window size, time zone, whether it has received any input yet, and the public IP address it reports through WebRTC, compared with the address of the request. They are sent to our servers once and used only for this check: the raw values, the WebRTC address included, are compared and discarded at once, and we keep only anonymous counts of the check's results. They are never used for advertising or to build a profile of you.

2.6 Website analytics & cookies

The sparkl.gg website and the web app (app.sparkl.gg) use Cloudflare Web Analytics, a privacy-first, cookieless measurement tool that reports aggregate metrics (such as page views, loading speed and referring sources) without tracking you across other sites and without using advertising cookies.

We also record anonymous product events on our own infrastructure (Cloudflare Workers Analytics Engine), for example "web app opened", "card added to a collection", "App Store button clicked" or "account created", together with the page type, referring website, campaign tag, traffic source, approximate country and device class. The traffic source is a short label: the campaign's utm_source, or the advertising platform an ad click came from (for example "bing", "google" or "meta"), never the ad click identifier itself. So that a visit that moves from one of our pages to another keeps its label, the website and the web app keep this label in your browser’s session storage (sparkl_src), and the web app also keeps the campaign and ad group labels (sparkl_cmp) and the page of the web app you arrived on with the time (sparkl_entry); session storage is deleted when you close the tab. These records contain no cookies, no account, user or device identifier and no IP address, and are used only as aggregate statistics to understand and improve the Service, including how many visits and sign-ups our campaigns bring. We also count visits from search-engine and AI crawlers (for example Googlebot or Bingbot). Our legal basis is our legitimate interest in measuring and improving the Service.

The web app also keeps a random identifier in your browser’s local storage, used only to count unique visitors. It is not linked to your account, is replaced after 13 months, and is removed if you decline analytics.

We also use Google Analytics (GA4) to understand how visitors use the site (for example, pages viewed, approximate location, device and browser type, and referring source). Google Analytics sets cookies and processes a pseudonymous identifier for this purpose. We use Basic Consent Mode: our pages do not request or configure the Google tag, and send no Google Analytics measurement, until you accept analytics cookies in the banner. Accepting analytics grants only analytics storage; the advertising storage, advertising user-data, and advertising-personalization signals follow your separate advertising choice (section 2.7) and remain denied unless you allow advertising. Our legal basis is your consent. To honor your choices on later page loads, Sparkl stores a small consent record under sparkl_consent (its format version, your analytics answer, your advertising answer or "not asked", the advertising partners the banner named when you answered, and the date of your choice), in first-party browser local storage and in a first-party cookie on sparkl.gg (so the web app at app.sparkl.gg applies the same choices), for up to 13 months or until you change the choice or clear site data; after 13 months we ask again. For compatibility with earlier versions of our pages, your analytics answer alone (granted or denied) is also kept in a sparkl_consent_v1 cookie for the same period. You can withdraw as easily as you opt in by using the control below, which withdraws both analytics and advertising consent; the "Analytics choices" (or "Cookie choices") link at the bottom of every page reopens the banner so you can change either choice. Withdrawal immediately records a denied choice, tells Google Analytics that analytics storage is denied, removes our existing Google Analytics and DataFast cookies, and keeps the Google tag and DataFast’s cookie mode blocked on later page loads unless you opt in again. You may separately clear or block analytics cookies in your browser settings. Information collected via Google Analytics is subject to Google's Privacy Policy; you can also install Google's opt-out browser add-on. We do not use Google Analytics data for advertising or sell it.

We also use DataFast (datafa.st) to understand how visitors reach and use sparkl.gg and the web app (for example pages viewed, referring source and campaign, approximate location, device and browser type). If you accept analytics cookies, DataFast sets first-party cookies on sparkl.gg (a random visitor identifier kept for up to 12 months and a short session identifier) so a visit can be followed from the website to the web app; our legal basis is your consent. If you decline, or have not made a choice yet, DataFast runs in cookie-less mode: it sets no cookies and keeps only a random session identifier in your browser’s session storage, which is deleted when you close the tab; our legal basis is our legitimate interest in aggregate audience measurement. We do not send DataFast your account details, and we do not use DataFast data for advertising or sell it.

Withdraw analytics and advertising consent

2.7 Advertising measurement (Microsoft Advertising, Google Ads, Meta)

Sparkl may advertise on Microsoft Advertising (Bing), Google Ads and Meta (Facebook and Instagram). To learn which of our ads bring people to Sparkl, the website (sparkl.gg, including its card-list pages) and the web app (app.sparkl.gg) can use the Microsoft Advertising Universal Event Tracking (UET) tag, the Google Ads tag and the Meta Pixel. These tags run only if you allow advertising cookies in the cookie banner ("Accept all", or "Choose" and then "Advertising"). If you decline, or have not made a choice yet, the tags are not loaded: nothing is sent to Microsoft, Google or Meta for advertising and no advertising cookie is set. We use Google Consent Mode v2 and Microsoft UET consent mode in their basic form: every advertising signal (ad_storage, ad_user_data, ad_personalization) is denied by default, and is switched to granted, and the tags loaded, only after you opt in. The banner offers this choice only while we run such campaigns, and names the advertising partners it covers. Your answer covers only the partners named when you gave it: when we add a partner, we ask again those who said yes, and the new partner stays off until they answer; a "no" stays a no.

What they collect and store. If you allow advertising and arrive from one of our ads, the click identifier the ad platform added to the link (msclkid for Microsoft; gclid, gbraid or wbraid for Google) is read and kept in first-party cookies on sparkl.gg: Microsoft’s _uetmsclkid (up to 90 days), _uetsid (1 day) and _uetvid (up to 13 months), and Google’s _gcl_au and _gcl_aw (up to 90 days). The tags send Microsoft and Google the pages you view on sparkl.gg and app.sparkl.gg, the conversions we measure, technical information about your browser and device, and your IP address, which they use to approximate your location and to detect fraud. The conversions we measure are: opening the web app from our website, clicking a link to the App Store, and creating a Sparkl account. We never send them your name, email address, account identifier or collection data.

Meta. If you allow advertising, the Meta Pixel runs on sparkl.gg and app.sparkl.gg. It sets first-party cookies on sparkl.gg: _fbp (a random browser identifier, up to 90 days) and, if you arrived from a Meta ad, _fbc (holding the click identifier fbclid that Meta added to the link, up to 90 days). It sends Meta the address of the page you view and of the page you came from, these identifiers, technical information about your browser and device, and your IP address, with three events: viewing a page, creating a Sparkl account, and starting a Sparkl Pro checkout. Its automatic event detection is turned off, and nothing is sent from a page whose address holds private information (for example an invite code or a link to one of your binders). When you start a Sparkl Pro checkout on the web, the web app sends our servers the Meta ad details of your visit (campaign, ad set, ad and creative identifiers, placement), the _fbp and _fbc values and the date of your advertising consent. Our servers keep these details with your account. If it is your first Sparkl Pro purchase (you never had Sparkl Pro through the App Store or the web before), our servers report it to Meta (Meta Conversions API) once Stripe confirms the payment, to measure our ads. The report contains:

• the amount paid excluding tax and its currency;
• the time of the payment and an identifier for this purchase;
• the address of the checkout page;
• the _fbp and _fbc values;
• the IP address and browser information of your checkout;
• your email address and your Sparkl account identifier, each in hashed form (SHA-256).

This happens only if your advertising consent allowed Meta when you started the checkout, and only within 7 days of the payment. If you withdraw that consent before the report is sent, it is not sent, and the IP address, browser information, _fbp and _fbc are deleted. A report that was already sent cannot be recalled. We delete the IP address, browser information, _fbp and _fbc after 60 days, and keep the ad identifiers to report on our campaigns. Deleting your account deletes all of it, and these details are part of your data export. We never send Meta your name or your collection data. For the collection and transmission of Pixel and Conversions API data, Sparkl and Meta Platforms Ireland Limited act as joint controllers; Meta then uses the data as an independent controller, see the Meta Privacy Policy.

Links that keep the campaign. Whatever your choice, when you follow a link from sparkl.gg to the web app, the App Store, TestFlight or our Discord, our pages add the campaign tags (utm_, ref) that were already in the address you arrived with; an ad click identifier, and Meta's meta_ad_id and placement tags, are passed on only to our own web app (app.sparkl.gg), never to Apple or Discord; and App Store links name the campaign source (for example ct=bing-hero-badge), so that a visit, download or sign-up can be attributed to the campaign that brought it. Nothing is stored for this, and the ad tags described above still run only with your advertising consent. Links from our partners work differently; see section 2.9.

Why. Microsoft, Google and Meta use this information to report which ads led to these actions, to optimize the delivery of our ads and, because the advertising choice also allows ad personalization, to let us show our ads to people who visited Sparkl. Microsoft and Google also process this data for their own purposes as independent controllers; see the Microsoft Privacy Statement and how Google uses information from sites that use its services. Our legal basis is your consent.

Campaign of your first visit. If you allow advertising, the web app also keeps the campaign details of your first visit (the utm_ tags, ref, Meta's meta_ad_id and placement tags, the ad click identifier, the page you arrived on, the referring website and the date) in your browser’s local storage (sparkl_first_touch) and, if your answer covered Meta, the details of the first Meta ad that brought you (campaign, ad set, ad and creative identifiers, placement, the Meta click identifier and the date) in sparkl_meta_touch, so that an account or a purchase can later be related to the campaign that brought it. When you start a Sparkl Pro checkout, the web app sends our servers the traffic source, campaign and ad group labels of that campaign and, with consent that covers Meta, the Meta details described above; it then keeps a marker (sparkl_meta_shared) so that a later withdrawal also reaches our servers. These entries are deleted from your browser when you decline or withdraw advertising consent, except that marker, which stays until our servers have received the withdrawal.

The campaign behind a new account. When you create a Sparkl account on the web (with Google, Apple or an email address), the sign-up request tells our servers which of our campaigns brought you, if any: the traffic source label (for example "bing"), the campaign and ad group labels, the page of the web app you arrived on and when. Our servers keep these labels, with the approximate country and the kind of device (phone or computer) of that request, on the account the request creates, once, and never on an existing account. They contain no ad click identifier and are sent whatever your cookie choice. If you allowed advertising, the request also carries the ad click identifier of that visit (msclkid, gclid, gbraid, wbraid or fbclid), which our servers keep with the account. We use this only to count, per campaign, the accounts created, how many of them buy Sparkl Pro and the revenue that follows; we do not send it to Microsoft, Google or Meta. Deleting your account deletes it, and it is part of your data export. Our legal basis is our legitimate interest in knowing which of our campaigns bring paying users and, for the ad click identifier, your consent.

Retention and your choice. The cookies above last at most for the periods stated, and are deleted when you withdraw; Microsoft, Google and Meta keep the data they receive according to their own policies. You can refuse advertising while still accepting analytics ("Choose"), and change or withdraw your choice at any time with the "Cookie choices" link at the bottom of every page or the withdrawal button in section 2.6. Withdrawing tells the tags that advertising storage is denied (for Meta, that consent is revoked), stops them on later page loads and removes their cookies from sparkl.gg and app.sparkl.gg. If a purchase report to Meta has not been sent yet, the withdrawal also stops it (see Meta above); a withdrawal made on sparkl.gg reaches our servers at your next signed-in visit to the web app.

2.8 Optional public profiles

Publishing a Sparkl profile is optional and requires an express opt-in. If you publish, Sparkl creates a public page at a stable URL such as sparkl.gg/u/yourhandle (and its French-language equivalent). The page contains only an allowlisted public snapshot, such as the handle, display name, avatar, bio, selected highlights, and coarse collection summaries you chose to make public. It does not expose your email, subscription status, private notes or tags, acquisition prices, targets, certificate numbers, wishlist, scan times, exact private collection records, or exact private collection counts.

If you allow search indexing, search engines and social platforms may index the page or cache a link preview. You can hide the page from search results or unpublish it, but search snippets, social previews, browser caches, screenshots, and copies made by others may remain until those third parties refresh or remove them. We can request or encourage removal but cannot control their timing.

To prevent a stale public URL from later identifying or impersonating a different person, a normalized handle that has ever been public is not reassigned. After a rename or account deletion, we retain that plaintext handle indefinitely as an ownerless reservation. The reservation has no owner identifier. Any secret-keyed former-owner reference created for the finite dispute or appeal window is later removed, but the handle text itself remains and may itself be personal data. Other narrowly limited deletion records are described in the retention section below.

Separately, after account deletion, Sparkl keeps six narrowly scoped classes of permanent denial mechanisms so delayed or offline work cannot recreate deleted account data. The primary-database fence and the relevant sync-shard fence each retain only the historic internal account identifier. If the account had claimed legacy trainer records, one ID-only fence remains for each historic internal trainer identifier; it contains no account link, token, timestamp, or other field. A UserStore partition and a profile-authorization partition selected from the historic account identifier each retain only a constant erased-state marker; their stored payloads contain no account identifier or deletion token. Where RevenueCat has been used, the sixth class is a durable processor-erasure suppression record containing the historic internal account UUID used as the RevenueCat customer identifier, the exact RevenueCat project identifier, and limited deletion-retry and completion fields; its contents and purpose are described in Section 7. An exact opaque token is used only while cleanup and its completion-confirmation and bounded-pruning period remain active, then removed from the shard fence, replaced by the UserStore constant marker, and discarded with the transient retry record. There is no permanently shared deletion token. The permanent records do not contain the former email, handle, collection, profile content, or network address. Except for the operational retry and completion timestamps in the RevenueCat suppression record, they do not retain a deletion timestamp. The raw identifiers and identifier-derived partitions can still be related to a known former account or trainer by an authorized system. We therefore treat all six classes as potentially linkable pseudonymous operational data rather than claiming they are anonymous. They are retained only to deny resurrection, are not used for advertising or personalization, and require a documented necessity, proportionality, storage-limitation, security, rights, and objection assessment. They are distinct from the plaintext handle reservation described above.

Cloudflare processes public-profile requests at its network edge to route and protect the Service. This can include the requested URL (and therefore the public handle in a profile path), network address, and request headers before our application code runs. We configure the public-profile gateway not to retain automatic invocation logs or traces, and the gateway removes ambient Cookie and Authorization headers before application routing or downstream calls. These controls do not mean Cloudflare never processes the original edge request. The separate API Worker keeps native platform logs for reliability, with platform retention capped at no more than seven days. Any separately disclosed and approved Logpush, Tail, OpenTelemetry, security-log, or similar destination must have its own reviewed access and retention limit.

Public-profile requests may also generate limited operational and view telemetry in Cloudflare Analytics Engine. We use a secret-keyed pseudonymous profile key rather than a raw handle or account identifier, and record only bounded fields such as route type, locale, result, and a validated referral category. This dataset does not contain exact collection fields and is retained for up to three months. Because these events are pseudonymous and used in aggregate, we may not be able to locate and erase an individual event; it expires under the retention period.

You may report a public profile or appeal a moderation decision as described in our Public Profile & Content Policy. We may review reported content, restrict indexing, unpublish content, or suspend an account where needed to enforce that policy, protect people, or comply with law.

If you use the public-profile report form, we receive the reported profile handle, a report category, your chosen language, any optional detail you submit, and operational timestamps. The web gateway derives a fixed-length deterministic secret-keyed pseudonymous rate token from the network address used for abuse prevention before relaying the report. The API receives the report at a constant internal route and applies report-specific redaction so its application logs and report store do not retain the raw network address or country metadata; the Cloudflare edge processing described above still applies. The derived report/deduplication link is removed after its short operational window, and caller-free daily abuse totals are retained for up to 35 days.

Optional report detail, the report row's copy of the resolution reason, and free-form reasons in report-linked decision or hold events are normally removed within 90 days after a decision. Detail on an undecided report is escalated for review after 30 days and removed after at most 180 days. The ordinary report record and its report-specific events and administrative links are scheduled for removal within 365 days after intake or, if a decision is made later, within 365 days after that decision. A still-active or replayable moderation job may temporarily delay that final deletion so the system does not sever a live workflow; the overdue linkage is counted and alerted, and terminal job links are removed before the report is deleted. An authorized administrator may place a reasoned legal hold. Every hold receives a review deadline no more than 90 days later; a documented review may renew it for another period of no more than 90 days or release it. An overdue deadline alerts the responsible team but does not silently delete preserved evidence. Releasing a hold starts fresh 90-day detail-and-reason and 365-day ordinary-record clocks.

2.9 Partner and referral links

Sparkl works with creators and other partners who share their own Sparkl links (for example sparkl.gg/r/partner-name). When you open such a link, our server records the visit so that the partner can be credited: the partner and link, the time, the kind of device and platform (for example iPhone or desktop), the type of site or app the link was opened from (for example YouTube or Discord, derived from the referring site or the in-app browser), your approximate country and browser language, and a keyed hash of your network address. We never store the network address itself. No cookie is set and nothing is stored on your device.

How a visit is matched to an account. On the web, the link adds a random click identifier (sclid) to the address of the page it opens. Our pages pass it only to our own web app, which sends it to our server once you sign in, so that a Sparkl account created after that visit is credited to the partner; the web app then removes it from the address bar. App Store links on that page carry the partner's campaign name (ct=p-…) so that Apple's aggregate App Store statistics can credit the partner too. In the iPhone app, the first launch after a download can be matched to a recent visit of a partner link using the keyed hash of the network address together with the device platform, language and time. That hash is kept for at most 48 hours and used only for this matching and for counting unique visits. An account is credited to at most one partner: the last partner link opened within the 30 days before the account was created. Purchases on the account then count toward that partner's estimated earnings.

What partners see. Partners see only aggregate statistics (for example visits, downloads, sign-ups and estimated earnings) and pseudonymous activity entries that identify you only by a random code specific to that partner. They never receive your name, email address, account identifier, collection or network address.

Your choice. When a partner offers a welcome reward, Sparkl tells you who invited you. “Claim” confirms the invitation and adds the reward (for example a period of Sparkl Pro) to your account; “Not me” removes the credit, and purchases on your account then no longer count for that partner. You can also ask us to remove a partner credit at contact@sparkl.gg. Your data export includes your partner credit. When you delete your account, its partner records are de-identified; the partner’s totals do not change. Our legal basis is our legitimate interest in running our partner program and crediting partners fairly; none of this depends on the cookie banner.

2.10 Pulse (social features)

Pulse is Sparkl's social area: a live stream of what collectors are logging, leaderboards and weekly leagues, a release calendar, friends, and shared binders. It is built from activity you already record in Sparkl — the cards, sealed products and graded slabs you log, your wishlist and set progress, your binders, XP, streaks and achievements. Every account starts as Anonymous. You choose how you appear, and you can change it at any time in Settings → Pulse.

How you appear.

• Friends always see each other's real identity, in every mode. A friendship is mutual: both people accept it.
• Changing your mode applies to your past Pulse items too on the next refresh: going Hidden removes you from past items, leaderboards and this week's league; going Public shows you on past items.
• Leaving Public deletes everyone's follows of you. Going Hidden turns your public binders into link-only binders with new links (the old links stop working).

Anonymity safeguards. Anonymous items never carry your user identifier, your full handle, your display name or an exact time. The anonymous avatar changes on every item, so your anonymous items can't be linked to each other by their look. Your anonymous country flag is shown only when at least 20 active anonymous collectors share your country. Times about other people are shown as days, never exact times.

Age. Going Public requires confirming that you are 16 or older (we store the time you confirmed) and having a handle. Anonymous and Hidden don't require it.

What Pulse uses.

Pulse does not collect your precise location, your contacts, your collection's total value or the prices you paid (Pulse shows single-card market values only), or web push tokens.

Who can see it.

• People without a Sparkl account can see Live, leaderboards, the calendar, challenges, goals and bounties, public binders, public people pages and card and set statistics, with the same masking as signed-in collectors.
• Hidden categories remove specific kinds of activity from every Pulse surface, in any mode: wishlist, sealed products, graded slabs and set progress. “Hide card values” removes prices (and the value-based “chase” flair) from all your items and binders; “Hide my collection from Compare” removes your collection from your friends' Compare.
• Blocking someone hides each of you from the other everywhere in Pulse and removes the friendship, follows and requests between you.
• People who see a public item or binder may take a screenshot of it or share it.

Reports and moderation. Anyone signed in can report a Pulse item, a binder or a person (spam, offensive, impersonation, minor safety, other). Sparkl reviews reports. Moderators can hide an item or binder, or suspend a person from Pulse: a suspended person disappears from every Pulse surface for everyone else (they still see their own items), and their binders stop being served. Binder titles and descriptions are checked automatically (links, @handles and some words are rejected).

2.11 Invites

Every Sparkl account has a personal invite code and link (for example sparkl.gg/i/7K2M9QXA) to share with friends. You can change your code in the app: the old link then stops working, and the people you already invited still count.

The invite page. When someone opens an invite link, the page asks our server whether the code is valid. It shows the inviter’s display name or handle only if the inviter chose Public in Pulse (section 2.10); otherwise it says “A Sparkl collector”. The page sets no cookies and loads neither Google Analytics nor DataFast. It records only anonymous events on our own infrastructure (page shown, code copied, App Store or web app opened), with the referring website and campaign labels described in section 2.6. Invite codes and names are never included in these events, and link-preview crawlers that fetch an invite link are counted without the code. Tapping “Copy code”, or the App Store button, puts the code on your clipboard so you can paste it in the app once it is installed.

Joining with a code. A new account can enter an invite code within 7 days of being created (Sparkl sets this window and the rewards; the app and the invite page show the current ones). Entering a code adds a period of Sparkl Pro to the new account, currently 3 days. This welcome reward is given once per device: in the iPhone app, the invite is stored with the app’s install identifier (a random identifier kept in your device’s keychain, so it survives a reinstall), and a device that already received the reward can’t receive it again. To detect abuse, such as many invites claimed from one network, we also store a keyed hash of the network you claimed from, never the network address itself; it is deleted once the invite counts or ends. Where Pulse is available to you, entering a code also offers “Add your inviter as a friend” (on by default): if you keep it, you become Pulse friends at once and see each other as friends (section 2.10). Otherwise no friendship is created.

What your inviter sees. By entering a code, you agree that your inviter sees your progress toward making the invite count: the day you joined, how many cards are in your collection against the goal (currently 20) and on how many different days you have used Sparkl against the goal (currently 3), for 30 days after you enter the code. Unless you are friends, you appear to your inviter only as a neutral “Collector” with a generic avatar: no name, handle, avatar or country. Your inviter is never told why an invite didn’t count. When invites count, the inviter earns badges and, at some milestones, Sparkl Pro; for a subscriber, those Pro days are kept and start if the subscription ends. Sparkl may notify you about your invites in your Sparkl notifications (for example when a friend joins with your invite or when you receive Pro days).

Your data. Your data export includes your invite codes, the invites you sent (days, states and rewards, without other people’s identifiers) and the invite you used. When you delete your account, your codes are deleted (your links stop working) and your invite records are de-identified; the install identifier stays with the de-identified record so that the once-per-device rule still applies. Our legal bases are performance of a contract (running the invite program you take part in) and our legitimate interest in preventing abuse of its rewards.

3. How we use information

• Provide, maintain, and sync the Service and your collection across devices;
• Authenticate you and keep your account secure;
• Identify scanned cards and display estimated market values, history, and alerts;
• Process and manage your Pro subscription;
• Credit the partner whose link brought you to Sparkl and grant their welcome reward (section 2.9);
• Run Pulse (section 2.10): show your activity the way your Pulse mode allows and show you other collectors' activity; compute leaderboards, leagues, the Nations Cup, set races, card and set statistics and world-first moments; run friends, follows, Compare, nudges and blocks; publish the binders you share; run weekly challenges, the monthly community goal and the weekly bounty and grant their XP and badges; send the Pulse notifications you've enabled; and keep Pulse safe with reports, moderation, rate limits and anti-spam limits;
• Understand Pulse usage in aggregate, without individual profiling;
• Provide customer support and respond to your requests;
• Monitor, debug, and improve performance, features, and reliability;
• Detect, prevent, and address fraud, abuse, or security issues;
• Comply with legal obligations and enforce our Terms.

We do not sell your personal information. Advertising tags from Microsoft, Google and Meta run only if you allow advertising cookies, to measure and improve our own ads (section 2.7).

4. Google user data & Limited Use

If you choose to sign in with Google, Sparkl requests only your basic Google profile and email address, and only for authentication and account management. Sparkl's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we use Google user data only to provide and improve the sign-in and account features you request; we do not transfer it to others except as necessary to provide the Service, comply with applicable law, or as part of a merger or acquisition; we do not use it for advertising; and we do not allow humans to read it unless we have your consent, it is necessary for security or to comply with law, or the data has been aggregated and anonymized. You can disconnect Google access at any time from your Google Account's connected-apps settings.

5. How we share information

We share information only as described here:

• Service providers: trusted vendors who process data on our behalf to run the Service — for example hosting and content delivery (Cloudflare), authentication (Apple, Google), card recognition (Google Cloud), purchase processing (Apple), and card market-price data sources. They may only use the data to perform services for us.
• Subscription management: RevenueCat processes the stable Sparkl account UUID, Apple purchase history and subscription or transaction state, and limited SDK technical data on our behalf to manage Pro products, purchases, restores, and lifecycle notifications. Sparkl does not configure RevenueCat customer attributes with your name or email address.
• Advertising platforms (only with your advertising consent): Microsoft Advertising, Google Ads and Meta receive the ad-measurement data described in section 2.7 (for Meta, also the report of a first Sparkl Pro purchase from our servers). Without that consent, nothing is shared with them for advertising.
• Partners (aggregate statistics only): creators and other partners in our partner program see aggregate, pseudonymous statistics about the visits, sign-ups and purchases that came through their links (section 2.9), never your name, email address, account identifier, collection or network address.
• Other collectors and the public (Pulse): Pulse shows your activity to other collectors, and to people without an account, the way your Pulse mode and hidden categories allow (section 2.10). Friends you accept see your real identity.
• Legal & safety: when required by law, regulation, legal process, or to protect the rights, property, or safety of Sparkl, our users, or the public.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this policy.

We never sell your personal information.

6. Legal bases for processing (EEA/UK)

If you are in the European Economic Area or the United Kingdom, we process your personal data on the following bases: performance of a contract (to provide the Service you request), legitimate interests (to secure, maintain, and improve the Service), consent (where required, e.g. optional features — which you may withdraw), and legal obligation.

For the permanent ownerless reservation of a once-public handle, our intended legitimate interest is preventing stale-link impersonation and protecting the identity and expectations attached to an intentionally public URL. Before public profiles launch, counsel must confirm that indefinite plaintext retention is necessary and proportionate, document the balancing and storage-limitation analysis, and confirm the applicable objection process; otherwise we will change the design or retention period before launch.

For the permanent account-deletion denial records described above, our intended legitimate interest is preventing delayed, retried, or offline writes from recreating account data after a deletion has completed. Before launch, counsel must confirm that each retained account or legacy-trainer identifier and each identifier-derived partition is necessary, that the transient deletion token is removed after the completion-confirmation and bounded-pruning period under a monitored maximum-retention control, and that no less-identifying reliable control is reasonably available. Counsel must separately review the RevenueCat suppression record's retention of the historic account identifier, project identifier, and operational retry fields, as well as its permanent retention and approximately 30-day re-deletion purpose. Indefinite retention, access controls, security, storage limitation, data-subject rights, and the objection process must be confirmed as necessary and proportionate; otherwise we will change the design or retention before launch.

7. Data retention

We keep your information for as long as your account is active or as needed to provide the Service, and thereafter only as required to comply with legal obligations, resolve disputes, enforce our agreements, or pursue a documented and proportionate legitimate interest described in this policy. When you delete your account, we delete or anonymize your personal data within a reasonable period except for such limited justified retention.

Pulse (section 2.10):

Partner links (section 2.9): the keyed hash of a visitor’s network address is deleted after at most 48 hours. Visit and partner-credit records are kept while our partner program needs them to report partners’ statistics and estimated earnings, and the records linked to your account are de-identified when you delete it.

The vendor-specific period for which RevenueCat retains subscription-management data processed for Sparkl must be confirmed against Sparkl's executed processor agreement and applicable legal requirements before RevenueCat is enabled. Counsel must approve the final retention disclosure; this review draft deliberately does not state an unverified period. When you delete your Sparkl account, Sparkl submits a project-scoped request to delete the related RevenueCat customer and retries until RevenueCat confirms deletion or confirms that the customer is already absent. A queued but unconfirmed response remains pending rather than being treated as completed.

To prevent a stale or offline device from recreating that RevenueCat customer after deletion, Sparkl permanently retains a narrow processor-erasure suppression record. It contains the erased Sparkl account UUID, the exact RevenueCat project identifier, creation, update, retry, and completion timestamps, an attempt counter, and a short normalized error category. It contains no email, RevenueCat aliases, raw webhook body, Apple transaction identifier, redemption code, collection data, or profile data. Sparkl uses it only to retry deletion and to reassert deletion approximately every 30 days. The original account UUID cannot be replaced with an unlinkable value because RevenueCat's customer-deletion request requires that identifier. This record is not used for advertising or personalization. Counsel must approve the necessity, proportionality, security, rights handling, and permanent retention of this suppression mechanism before RevenueCat customer erasure is enabled.

When you unpublish a profile, Sparkl first blocks new authorized access and starts durable cleanup of generated profile and social-preview artifacts. The Sparkl page normally stops resolving within a few minutes. Account deletion starts the same durable cleanup before account removal completes; if cleanup is delayed, we retain only the minimum state needed to finish and verify it. Depending on how you signed in, this can include a minimal account tombstone and provider-revocation state, including Apple revocation state where applicable, until that work completes. An exact opaque deletion token remains only in the active cleanup fences and transient retry record. After cleanup completes, the retry record is held for a 24-hour completion-confirmation window and then becomes eligible for bounded oldest-first deletion; deletion backlog and maximum retention must be monitored and approved before launch. A completed deletion may leave an unlinkable randomized security-erasure receipt that does not contain the raw account identifier. Deterministic former-owner links used for an erasure dispute or appeal are removed after their finite operational window, normally within 90 days after completed erasure. The once-public handle remains as an ownerless plaintext reservation with no owner identifier. The six denial-mechanism classes described in Section 2.8 remain permanently as potentially linkable pseudonymous operational data under the documented assessment described above: the primary and sync-shard fences retain only the historic internal account identifier; any legacy-trainer fences retain only their historic internal trainer identifier, with no account link; the UserStore and profile-authorization partitions retain only constant erased-state markers; and the RevenueCat processor-erasure suppression record retains only the fields and purpose described immediately above. No shared deletion token remains permanently. We do not imply that every provider-side identifier, security record, or token disappears at the same instant. Third-party search, social, browser, or recipient-held copies can persist longer as explained above. Public-profile Analytics Engine events expire within three months.

8. Security

We use technical and organizational measures designed to protect your information, including encryption in transit and access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your data and to promptly address any issues.

9. Your rights & choices

Depending on where you live, you may have the right to access, correct, delete, export, or restrict the processing of your personal data, to object to certain processing, and to withdraw consent. You can delete your account at any time from within the app, which removes your associated personal data as described above. To exercise any right, email contact@sparkl.gg; we will respond as required by applicable law. If you are in California, we do not sell your personal information as that term is defined under the CCPA/CPRA, and we do not "share" it for cross-context behavioral advertising unless you allow advertising cookies (section 2.7); declining or withdrawing that choice opts you out. You will not be discriminated against for exercising your rights. You may also have the right to lodge a complaint with your local data-protection authority.

Pulse. In Settings → Pulse you can change your mode (Public, Anonymous or Hidden) at any time, choose an automatic flag, another country or no flag, hide categories, and turn each Pulse notification type on or off. You can accept or decline friend requests, remove friends, and block and unblock people (unblocking lifts only your own block). You can share a binder privately, by link or publicly, get a new link, or stop sharing. Your account export includes a Pulse section: your Pulse profile (including the time you confirmed you are 16 or older, the games and languages seen, your first card time and your last mode change), friends, follows, blocks (with the labels you saw), shared binder details, your moments, your collection summary, league results, badges, reactions you gave, reports you filed, set completions, challenge completions, bounty claims, release follows, pending friend requests and the spotlights you appear in; very large lists are capped and marked as truncated. Deleting your account deletes your Pulse data: your Pulse profile, moments, collection summary, the reactions you gave (and their counts), friendships, requests, follows, blocks, friend codes, QR codes, shared binders and their stored pages, badges, set and challenge completions, bounty claims, release follows, spotlights, league data and the reports you filed, and your entries are removed from the live stream server. Reports about you are kept for safety with your identity removed, and other collectors' reactions on your items are kept without a link to you. If two Sparkl accounts are merged, Pulse data moves to the remaining account; if that account is Hidden, its public binders become link-only with new links.

You can separately unpublish a public profile or turn off search indexing without deleting your account. Reports and moderation appeals follow the process in our Public Profile & Content Policy.

10. International transfers

We may process and store information in countries other than your own. Where we transfer personal data internationally, we rely on appropriate safeguards (such as Standard Contractual Clauses) where required by law.

11. Children's privacy

Sparkl is not directed to children under 13 (or the minimum age of digital consent in your country, which may be higher — for example 16 in parts of the EEA), and we do not knowingly collect personal data from them. Showing your identity publicly in Pulse (the Public mode, section 2.10) requires confirming that you are 16 or older. If you believe a child has provided us personal data, contact contact@sparkl.gg and we will take appropriate steps to delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, provide additional notice. Your continued use of the Service after an update means you accept the revised policy.

13. Contact us

Questions, requests, or concerns about this policy or your data? Email contact@sparkl.gg.