Privacy Policy

Here is what happens when you upload an image or video:

• We store the file you upload. If a video needs it to post, your browser converts it first. If you crop a photo or video, we store the cropped file.
• Once a photo or video posts, we keep one small copy of it. See section 2.
• We do not remove EXIF data from photos. A photo can carry location, device and timestamp info. If you do not want that stored, strip it before you upload. Your phone or photo app can do this.
• Some platforms need a set format. Instagram and TikTok need JPEG, for example. When that happens we make a converted copy for that post. Your original stays as it is. We delete the converted copy when we delete your original.
• Your files are reached through signed links our app controls. They are not public and they are not listed anywhere.
• To have a file deleted sooner, email privacy@sprkly.app.

Files are stored in Cloudflare R2 object storage.

The rules are the same on every plan.

• If a file is in more than one post, we keep it as long as the post that needs it longest.
• Our cleanup runs once a day, so a file may stay a little past these times.

What we keep after a post goes out

• For a photo: one smaller copy, a JPEG 1080 px on its longest side.
• A very large photo we cannot shrink gets no copy.
• For a video: one still image from it, 480 px.
• We use them to show your posts in your calendar and your stats, and to Repost a photo.
• Videos sent through our API or an AI tool get no still.
• There is no media library.
• To have any file deleted sooner, email privacy@sprkly.app.

We store the following account information to operate the service:

• Email address and display name, from the sign-up form, or from Google when you sign in with Google
• Profile picture URL (served from your OAuth provider's CDN)
• Connected social platform handles and OAuth access tokens and refresh tokens, encrypted at rest before storage
• Bluesky sign-in tokens, encrypted the same way. You sign in on Bluesky, so we never see your Bluesky password
• LinkedIn access tokens, encrypted the same way. LinkedIn gives no refresh token, so you reconnect LinkedIn every 60 days
• Scheduled post captions and target platforms
• Referral codes and reward history
• How you found sprkly, the country you signed up from, and which features you use

We do not sell or rent your personal data. We do not give your name, your email or your posts to anyone for advertising. The Meta Pixel can tell Meta that an account was created, but not whose. See section 9.

If you connect Instagram messaging, we receive some data from Meta so you can read and answer people from sprkly.

• What we receive: direct messages sent to your account, comments on your posts, button taps inside messages, and the sender's Instagram id and handle.
• Why: to show them in your inbox, to send the replies you set up, and so you can reply by hand.
• What we send: only the DMs and comment replies you set up, and the replies you type yourself, from your account.
• How long: message and comment text is kept for 30 days. The sender and time details are kept for 13 months. An automatic job deletes them after that.
• Email addresses: if an automation asks for an email and someone replies with one, we store that address and the time they sent it, so you can follow up. It is deleted with the sender details, after 13 months.
• Link taps: buttons in automated DMs open through a sprkly link first, so we can count taps. We store when the tap happened, which automation and which contact it came from. We do not store their IP address. We delete these after 13 months.
• WhatsApp and contact links: if you add your WhatsApp number or username to an automation, we store it so we can send the button. Anyone who gets that DM can see it. We delete it when you delete that automation or your account. Records of sent DMs that hold the link are cleared within 13 months.
• Unsent messages: if someone unsends a message, we delete its text as soon as Instagram tells us.
• Hidden and deleted comments: if you hide or delete a comment in sprkly, we do it on Instagram and mark our copy.
• Automated replies only go to people who commented on or messaged your account first. Anyone can reply STOP to end them. After STOP, that person gets no automatic reply unless they ask again with your keyword. sprkly never messages anyone on its own.
• We do not sell this data. We do not use it to train AI. Disconnecting the Instagram account or deleting your sprkly account removes these records.

This data is used only for the features above, under Meta's Platform Terms.

We use administrative, technical, and organizational safeguards designed to protect personal information and sensitive data used to provide sprkly.

• Encryption in transit: sprkly is served over HTTPS/TLS to protect data transmitted between your browser and our service.
• Encryption at rest: OAuth access tokens and refresh tokens for connected platforms, including Google/YouTube, are encrypted before storage using AES-256-GCM. Tokens are decrypted only when needed to connect, refresh, publish, delete, or verify content on your behalf.
• Secret management: API keys, OAuth client secrets, signing secrets, and token-encryption keys are stored separately from application code in protected environment secrets and are not shipped in client-side application bundles.
• Least-privilege access: Access to production systems and stored user data is restricted to authorized personnel and service processes that need access to operate, secure, debug, or support the service.
• Media protections: Your files are stored in Cloudflare R2 and reached only through signed links our app controls. Those links are time limited and are not listed anywhere public. Note that we do not strip EXIF data from photos. See section 1.
• Monitoring and incident response: We monitor service health and errors, investigate suspected unauthorized access, and will notify affected users or authorities when legally required.

If you connect a YouTube channel, sprkly requests only the Google OAuth scopes needed for YouTube scheduling and publishing, such as YouTube upload and YouTube read-only channel scopes. We use this data to authenticate your channel, display connected-channel information, upload scheduled videos or Shorts, refresh expired access tokens, and record publishing results.

We do not sell Google user data, use it for advertising, or transfer it except as needed to provide sprkly's user-facing features, comply with law, prevent abuse, or protect the service. You can disconnect your YouTube account or delete your sprkly account to revoke sprkly's stored access, and you can also revoke access from your Google Account permissions page.

sprkly's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• Cloudflare R2 and D1: file storage and database.
• Stripe: payment processing. We only store the Stripe Payment Intent ID; your card details are never on our servers.
• OAuth providers (Google and others): used for sign-in. We receive only the scopes you explicitly grant.
• The social platforms you connect(Instagram, Facebook, Threads, TikTok, YouTube, Bluesky, X, LinkedIn, Pinterest and Telegram): we send them the posts you schedule. Each one handles your post under its own privacy policy. From Pinterest we read your username and profile picture, the names of your boards, and the views, saves, reactions and comments on pins you made with sprkly.
• Google Analytics: counts visits to our site. See section 9.
• Meta Pixel: measures our ads. See section 9.
• Whop: to see which visits turn into sales on Whop. See section 9.
• PostHog: shows us how people use sprkly. See section 9.

You can delete your account at any time from Settings → Account. This permanently removes:

• Your account record and all associated data
• All media files, including the small copies we keep, from Cloudflare R2
• All scheduled posts, referral records, and credit purchase history

Deletion is irreversible. Your account goes at once, and we finish deleting your media files within 7 days. Stripe records are subject to Stripe's own retention policies for financial compliance purposes.

To export a copy of your data before deleting, email privacy@sprkly.app.

• We use a session cookie to keep you signed in.
• In this section, "the EU" also means Iceland, Liechtenstein and Norway. If we cannot tell which country you are in, we treat you as if you are in the EU.
• We use Google Analytics to count visits, button clicks, sign ups and Book a call clicks. It is a third-party analytics tool and it sets cookies. In the EU, the UK and Switzerland it runs only if you accept analytics cookies. Elsewhere it runs unless you decline them in the cookie banner.
• We save how you first found us: the site you came from, the first page you saw, and any campaign tag. This is kept in a cookie called sprkly_ft for 90 days. In the EU, the UK and Switzerland it is set only if you accept analytics cookies. Elsewhere it is set when you first visit. It is not set if you decline analytics cookies. If it is already there, we delete it.
• If you came from a Google ad, sprkly_ft also keeps Google's ad click id. We keep it only if you allow advertising cookies. If you turn them off, we remove it.
• When you click one of our buttons, we note which one in a cookie called sprkly_cta. It lasts until you close your browser. When you sign up, we read it to see which button brought you. In the EU, the UK and Switzerland it is set only if you accept analytics cookies. It is not set if you decline them.
• We use the Meta Pixel to see if our ads work. It is an advertising tool from Meta and it sets cookies.
• It tells Meta which of our public pages you opened, and if you opened the plans page. It also tells Meta that an account was created, that a plan was started or bought, with its price, and that you clicked Book a call. It does not send your name, your email, or anything you post.
• Our server also sends two of these to Meta: that you clicked Book a call, and that an account was created. It sends the page address, your IP address, your browser type and Meta's own cookie ids. It never sends your name or your email. It sends only when the Meta Pixel is allowed to, so the same cookie rules apply.
• If you came from a Meta ad, Meta's cookie _fbc keeps the ad's click id for 90 days. It is set only if you allow advertising cookies. If you turn them off, we delete it.
• It does not run on the password reset page, on the pages that connect an AI tool, or on any page whose link carries a sign-in or connect request.
• In the EU, the UK and Switzerland it runs only if you accept advertising cookies. Elsewhere it runs unless you decline them in the cookie banner.
• We use the Whop pixel to see which visits turn into sales on Whop. It sets cookies and keeps an id for your browser. It runs on the same pages as the Meta Pixel, and by the same advertising cookie rules. It does not read what you type into forms.
• We use PostHog to see how people use sprkly. Its servers are in the United States. It sets a cookie and saves data in your browser.
• PostHog records the pages you open and the buttons you click. When you are signed in, it also gets your account id, your email and your name.
• When you are signed in, PostHog also records your screens inside the app. Anything you type is hidden. So are messages in your inbox and the caption box when you write a post. Other things on the screen, like your list of posts, can show.
• In the EU, the UK and Switzerland PostHog runs only if you accept analytics cookies. Elsewhere it runs unless you decline them. If you say no later, it stops.
• Our server also tells PostHog about the main steps in your account. For example: you signed up, connected an account, a post went out, or your plan changed. These use your account id, not cookies. So they are sent whatever you pick in the cookie banner.
• The sign up step also says how you found us, which button you clicked, and any ad click id. We send only what your cookie answers let us keep.
• When you are signed in, we record which screens you open and which features you use. This is tied to your account. We use it to fix problems and decide what to build.
• On the plans page, Stripe sets its own cookies (__stripe_mid and __stripe_sid). They help stop fraud and are needed to take payment.
• Our host, Cloudflare, may count page views with Cloudflare Web Analytics. It does not set cookies.
• We do not sell this data.
• What you post, schedule and see inside the app is not sent to Meta.
• To change your answer, use "Cookie settings" at the bottom of the page. From then on, the tools you turned off stop counting you.
• If you turn off advertising cookies, we also delete _fbc and the Google ad click id in sprkly_ft. We do this on our public pages: right away if you are on one, or the next time you open one.

• Who is responsible: sprkly is run by WILLOW TECH PTE. LTD., a company in Singapore. It is the data controller for your account data.
• Your followers' data: Messages and comments from your followers belong to your account. You decide what happens to them. We handle them for you.

Why we may use your data:

• To run your account and publish your posts. This is our contract with you.
• To keep the service safe, fix problems and decide what to build. This is our legitimate interest.
• To count visits, see how the site is used and measure ads, with cookies. Only with your consent.
• To meet legal duties, such as tax records.

Your rights:

• See the data we hold about you.
• Fix data that is wrong.
• Delete your data.
• Get a copy of your data to take elsewhere.
• Ask us to stop or limit a use of your data.
• Withdraw your consent at any time. Use the "Cookie settings" link at the bottom of the page. See section 9 for what stops.

How to use them:

• Email privacy@sprkly.app. We reply within 5 business days, and we finish your request within one month.
• You can also complain to the data protection authority in your country.

Where your data goes:

• Our providers (Cloudflare, Google, Meta, PostHog, Stripe, Whop) may handle data outside your country, including in the United States.
• Where the law asks for it, the transfer is covered by standard contractual clauses or a similar safeguard.

Automated decisions:

• We do not make decisions about you by automated means that have a legal effect on you.

Our browser extension, "sprkly: snip and post", works in Chrome and Edge.

• It opens your sprkly composer in a side panel. It uses your sprkly.app sign-in. It never sees your password.
• It only looks at a tab when you start a snip, with the Snip button or Alt+Shift+S.
• The first time you press the Snip button, your browser asks if sprkly may see the pages you visit. It asks then, not when you install. We use it only to start a snip on the tab you are on. You can say no and use Alt+Shift+S instead.
• A snip is a picture of the box you draw. The rest of the screen never leaves your browser.
• It does not read the words on a page or your browsing history. It checks the page address only to tell you when a page cannot be snipped. That address is never sent to us.
• It keeps one setting in your browser: the last snip shape you picked. It is never sent to us.

What is sent to sprkly, and when:

• A snip: when you finish drawing the box, it goes into your composer and uploads to sprkly, like any photo you add.
• A file you drop on the panel: it uploads to sprkly the same way, when you drop it.
• An image you drag from a web page: its web address goes to our server, which fetches the image for you. We do not keep that copy. The image then uploads like any photo you add.
• From there, sections 1 and 2 apply, the same as any upload.
• Inside the panel, the composer is our website, so section 9 applies. PostHog runs there. The Meta Pixel does not.

Questions about this policy or your data? Email privacy@sprkly.app. For legal and privacy requests, we respond within 5 business days. A request to use your rights in section 10 is finished within one month.