Privacy Policy

This policy describes what the hosted SparkFeed service collects, what we do with it, and who else sees it. We have written it against what the code actually does rather than against a template, so a few sections are more specific than you might expect. Where something does not exist yet, we say so instead of leaving it vague.

1. Who we are and what this covers

SparkFeed is operated by Sparkable Digital Solutions (OPC) Private Limited, a company registered in India. For the purposes of the GDPR and similar laws, we are the data controller for personal information collected through the hosted service. You can reach us at [email protected].

This policy covers sparkfeed.dev, the hosted application, our documentation site and our public demo. It does not cover a SparkFeed instance that somebody else runs. See section 16.

We apply the same standard to everyone, wherever you live. Rights described here as GDPR rights are offered to all users, not only to people in the EU or UK.

2. What we collect

Account data

Your name, email address, whether that address has been verified, and an optional profile image URL. If you sign in with a password, we store a hash of it, never the password itself. There are no social or single sign-on providers, so we never receive a profile from Google, GitHub or anyone else.

Workspace data

Workspace names, who belongs to which workspace and in what role, and the email addresses of people you invite. An invitation stores the invitee's address until it is accepted or expires.

Content data

The feeds and sources you add, your folder structure, keyword filters, reading state such as bookmarks, favourites and read-later flags, and the articles themselves. Articles include cached text fetched from the source site, described in section 4.

Technical data

When you sign in, we store the IP address and browser user-agent string associated with your session, together with the session token and its expiry. This is how a session is identified and how suspicious access can be spotted. Server logs may briefly contain request metadata for operational purposes.

Support and enquiry data

If you use the contact form inside the app, we store the name, email, company and message you send. If you use the contact form on our marketing site, that message is submitted from your browser to a third-party form service and delivered to us by email. See section 8.

Payment data

Paid plans are not live yet, so no payment data is collected today. When they launch, card details will be collected and held by our payment processor acting as merchant of record. We will see a customer and subscription reference, a plan, a seat count and a billing status. We will not see or store your card number.

3. Why we are allowed to

• To perform our contract with you. Running your account, fetching your feeds, storing your articles, billing you for a plan you chose.
• Our legitimate interests. Keeping the service secure and available, preventing abuse, debugging failures, and improving the product. We balance these against your interests and keep the data involved to the minimum that works.
• Your consent. Where we ask for it, for example for anything optional. You can withdraw it at any time.
• Legal obligation. Tax, accounting and responding to lawful requests.

4. Content we fetch and store

This is the part of SparkFeed that differs most from an ordinary web app, so it is worth being precise.

When you add a feed, our servers fetch it on a schedule and store each item's title, link, publication date, summary and, where the feed provides it, the full article body. We sanitise that HTML before storing it, removing scripts and similar. We also fetch each article's page once to find its preview image and store the image URL, not the image itself.

When you open an article that has no stored body, our server fetches the source page, extracts the readable text, and caches that text against the article so the next read is instant. That cache is what makes the in-app reader work.

When you add a site that publishes no feed, we fetch the page periodically and record the links, titles, dates and first paragraph we find. For these sources we do not store the full page.

Our fetcher requests pages over ordinary HTTP and HTTPS only, follows a capped number of redirects, times out quickly, refuses to fetch private or internal network addresses, and caps how much it will download. It sends no cookies or credentials of yours to the source site, so a source cannot identify you personally through our fetch. Only public content is retrievable.

There is no automatic expiry today. Stored article text stays until you delete the feed or folder it belongs to, or until you ask us to erase it. We will introduce a retention limit on the free plan in future, and we will update this policy and this date before we do.

5. Spark AI

When you send a message to Spark AI, exactly the following leaves our infrastructure:

• Your message.
• Metadata for up to 20 of your most recent articles: title, source name, publication date, link and the short summary the feed itself provided.
• Our system instructions.

Full article text is never sent to the AI provider. The cached bodies described in section 4 stay in our database.

Chat history is not stored anywhere. Each message is answered on its own, there is no conversation table in our database, and the conversation lives only in your browser's memory until you reload the page.

Which provider handles the request depends on how the service is configured, and is one of OpenAI, the Vercel AI Gateway, or OpenRouter. They process the request to return a reply. Spark AI is disabled entirely on the public demo, so nothing from the demo ever reaches a model provider.

6. Analytics

We run no analytics, telemetry, error tracking, session recording or advertising scripts, anywhere. Not on the marketing site, not in the app, not in the documentation. There are no third-party scripts on any of our pages.

We may add product analytics later, because at some point we will need to know which features are used. If we do, we commit to the following, and we will update this policy with a new date before anything goes live:

• A privacy-respecting, GDPR-compliant tool, named here as a sub-processor.
• Aggregate product usage only, never the contents of your feeds, articles or AI conversations.
• No cross-site tracking, no advertising networks, no data brokers.
• No selling or sharing of personal data for advertising, ever.

7. Cookies and local storage

We use no advertising or tracking cookies, and nothing that follows you across other websites. That is why you are not seeing a cookie consent banner: everything below is strictly functional.

Clearing your browser storage removes all of these. Signing out clears the session cookie.

8. Sub-processors

These are the third parties that process data on our behalf to run the hosted service. Each is bound by its own data processing terms.

We will keep this list current. If you self-host, none of this applies to you: you choose your own hosting, email and AI provider, or none at all.

9. Sharing and public links

Sharing is off by default. If you turn it on for a folder or a feed, anyone with the link can open it without an account, and the public view includes the articles in it along with their cached text and the list of source feeds. Sharing a folder also exposes everything beneath it, including sub-folders and their feeds.

An optional password can be set on a share link. It is stored in a form we can display back to you in the app, so treat it as an access gate rather than a secret, and do not reuse a password from elsewhere. Turning sharing off makes the link stop working immediately.

10. We do not sell your data

We do not sell your personal data, and we never will. We do not share it for advertising, we do not build profiles on you, and we do not use your feeds, articles or AI conversations to train any model, ours or anyone else's.

The only circumstances in which we disclose personal data beyond the sub-processors above are where the law requires it, where it is necessary to establish or defend a legal claim, or in the event of a merger or acquisition, in which case we would notify you first and the acquirer would be bound by this policy.

11. International transfers

We operate from India, and our sub-processors operate in various regions including the United States and the European Union. Your data may therefore be processed outside the country you live in. Where data leaves the EEA or the UK, we rely on Standard Contractual Clauses or an equivalent safeguard in our agreements with those providers.

12. Retention and deletion

We keep your data for as long as your account is open. Two things happen when you delete it.

Immediately and automatically. Deleting your account from settings removes your login credentials, all active sessions and your workspace memberships and pending invitations. Access ends at once, and nobody can sign in as you again.

On request, within 30 days. The reading data held against your workspace, meaning your folders, feeds, stored articles and cached article text, is not yet removed automatically by that same action. To have it erased, email [email protected] from the address on the account, or before you delete the account. We will erase it within 30 days and confirm when it is done.

We would rather tell you this plainly than claim an automatic erasure we do not yet perform. Extending automatic deletion to cover workspace data is planned, and this section will be updated when it ships.

Separately: contact form submissions are kept until they are dealt with and then removed periodically; backups roll off on their own schedule and are overwritten within 30 days; and once paid plans launch, invoices and payment records are kept for as long as tax and accounting law requires, which is typically several years and which we cannot delete on request.

13. Your rights

You can ask us to:

• Give you a copy of the personal data we hold about you.
• Correct anything inaccurate.
• Delete your data, as described in section 12.
• Restrict or object to how we process it.
• Export it in a portable format.
• Withdraw consent where our processing relies on it.

Email [email protected] and we will respond within the time the applicable law allows, and normally much sooner. We will not charge you for this or make the service worse because you asked.

If you are in the EEA or the UK and you think we have handled your data badly, you can complain to your local data protection authority. We would appreciate the chance to fix it first.

14. Security

• All traffic to and from SparkFeed is encrypted in transit with TLS.
• Passwords are stored as salted hashes, never in a readable form.
• API keys are stored only as a SHA-256 hash. The key itself is shown to you once when created and cannot be retrieved afterwards, by you or by us.
• Access to production systems is limited to what operating the service requires.
• Outbound fetching is restricted so the service cannot be used to reach internal networks.

One deliberate exception, stated plainly: share-link passwords are stored in a recoverable form, because the app shows them back to you so you can pass the link on. They are an access gate, not a secret. Do not reuse a password there.

No service can promise perfect security. If we ever become aware of a breach affecting your personal data, we will notify you and the relevant authority as the law requires.

15. Children

SparkFeed is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has created an account, tell us and we will delete it.

16. Self-hosted instances

SparkFeed is open-source software under AGPL-3.0, and anyone can run it. If you are using an instance operated by your employer, a community, or a friend, then this policy does not apply to you. Whoever runs that instance is the controller of your data, chooses which providers it talks to, and is responsible for how it is secured and retained. Ask them for their policy.

If you run your own instance, we receive nothing from it. It does not report to us, and there is no telemetry to disable.

17. Changes to this policy

We will update this policy as the product changes, and the "Last updated" date at the top always reflects the current version. For material changes, particularly adding a sub-processor or turning on analytics, we will give notice in the app or by email before the change takes effect.

18. Contact

Privacy questions, data requests and complaints go to Sudharsan Ananth at [email protected].

Sparkable Digital Solutions (OPC) Private Limited, India.

See also our Terms & Conditions.