privacy policy. the short, honest version.

What we collect

• Account: your email address, username and a password (stored hashed by our authentication provider, we never see it).
• Profile: whatever you choose to add, like a photo, your country, and a postal address if you win a physical prize and want it shipped.
• Training data: the activities you log (distance, time, pace, heart rate if you add it, notes, photos), check-ins, and progress through your plan. Heart rate and similar numbers are health-adjacent, so we treat them with extra care and only use them to power your own training features.
• Cycle tracking, if you turn it on: the dates and the cycle length you type in. It is optional and off unless you switch it on, it is visible only to you, it is never shown to other members, it is never used for anything but your own training guidance, and you can delete it on its own without touching the rest of your account.
• Community content: posts, comments, polls, reactions, chat messages and anything else you share inside Sparkies.
• Payments: handled entirely by Stripe, on the website. We see what you bought, your email, and a shipping address if the thing you bought gets posted to you. We never see or store your card details.
• Usage: privacy-friendly, cookieless analytics via Plausible (aggregate page counts, no personal tracking), plus standard server logs from our host.
• Push token, in the app only: if you turn on notifications, the phone gives us a device token so a nudge can reach you. It identifies the device, not you, and it is used for nothing but sending you notifications. Turn notifications off in your phone settings and we delete it.

We never collect your device location. The only location we hold is a country, and a city if you type one in for the voyage map, both of which you enter yourself and can clear at any time.

Strava

If you choose to connect Strava, here is exactly what happens, and nothing more:

• We only fetch data when you tap "pull latest from Strava" on the log form: your single most recent run (name, distance, time, pace, average heart rate, route map and a link to the activity), which pre-fills a log entry that you review and confirm yourself. There is no background syncing and no bulk import.
• Strava-sourced data is shown inside the Sparkies community the same way as any run you log, always attributed with a "View on Strava" link. We never share it with third parties, never use it for advertising or analytics products, and never use it with any AI system.
• Withdrawing: tap Disconnect in your account settings. That deletes your Strava connection and removes Strava links, routes and activity references from our database, and we confirm on screen when it is done. If you revoke Sparkies from inside Strava instead, we receive that signal and do the same automatically. If you delete an activity on Strava, its imported copy is removed from Sparkies automatically too.
• Your use of Strava itself is governed by Strava's own terms and privacy policy.

The app

The Android and iOS apps are the same Sparkies, with the same account and the same data. Two things are worth naming:

• Notifications. We ask only after you have logged your first run, never when you first open it. Say no and the app works exactly the same, quieter. Say yes and we send the same things the emails say: your nudges, prize drops, the weekly wrap and when the boat makes port. You can turn them off in your phone settings whenever you like.
• Nothing is for sale in the app. Memberships and plans are bought on the website. The app only reads what you already have.

Reporting and blocking

Anything a member posts can be reported from the app or the site, and any member can be blocked. A report tells Ben what you flagged and why, and he reads every one. Blocking hides that member's runs, posts and comments from you, and they are not told.

Your health data gets extra care

Heart rate, recovery check-ins and cycle information are sensitive, so they are held to a tighter rule than the rest: locked to your account, never surfaced socially, never fed into analytics, never used for advertising, and deleted when you ask. Coaching guidance in Sparkies is general information from a running coach, not medical advice. If something hurts or does not feel right, see a doctor, not an app.

How we use your data

• To run the product: your plan, your log, your points, your tribe, the feed and messages.
• To show your activity to other members inside the community (your runs, posts, comments and leaderboard placings are visible to other logged-in Sparkies, that is the point of the club). We do not publish member data on the open web.
• To email you: receipts and account emails always; community digests, weekly wraps and coaching nudges with unsubscribe controls in your settings.
• To ship prizes you have won, using the postal address you give us for that purpose.
• We do not sell your data, we do not run advertising, and we do not use your data to train AI models.

Who touches it

A short list of processors, each doing one job: Supabase (database and login), Netlify (hosting), Stripe (payments), Resend (email delivery), Firebase Cloud Messaging, which is Google, to deliver app notifications, Strava (only if you connect it), Plausible (cookieless analytics). Service providers may also collect usage data about our API integrations for their own compliance purposes. That is the whole list; nobody else gets member data.

How long we keep it

For as long as you have an account, so your log and history keep working. To delete it: your profile, then Edit your profile, then Delete my account. That wipes your data straight away, no waiting and nobody to ask. If you would rather email us, we do it within 14 days and usually the same day. A few records we are legally required to keep, like payment receipts, are retained only as long as tax law requires.

Where it lives

Your data sits with the providers above, and some of them operate outside Australia: Supabase, Stripe, Resend, Google and Plausible all run infrastructure overseas, so by using Sparkies you are agreeing that your information may be stored and handled outside the country. We pick providers with real security practices, everything travels encrypted, and the same rules in this policy apply wherever it is kept.

Your rights

Ask any time and we will show you what we hold, correct it, export it or delete it. Email ben@sparkies.app and it gets actioned by a human, promptly, and we confirm when deletion is complete. If you are in the EEA or UK you have these rights under the GDPR; in Australia under the Privacy Act; everywhere else we honour them anyway.

Cookies

Inside the app: none. Your login session and a few functional preferences (like "onboarding seen") are kept in your browser's local storage, purely so the app works, and our analytics (Plausible) is cookieless by design. If you pay, the checkout happens on Stripe's own site under Stripe's cookie policy.

On our marketing pages (not the app) we use one advertising cookie: the Meta (Facebook) pixel, so we can show Sparkies ads to people who visited. If you are in the EU, UK or Switzerland it only loads after you tap OK on a consent banner, as your law requires; elsewhere it loads with this notice instead. Either way you can switch it off for good with one click: opt out of marketing cookies. Data the pixel collects goes to Meta under Meta's privacy policy. Your training data, community activity and anything from Strava are never shared with Meta or used for advertising.

Security

Data travels encrypted (HTTPS everywhere), lives in access-controlled databases with row-level security so members can only read what they are meant to, and payment details never touch our servers. No system is perfect, but if we ever have a breach that affects you, we will tell you quickly and honestly.

Kids

Sparkies is built for adults and older teens. If you are under 16, please do not create an account. If you are 16 or 17, a parent or guardian should be across your use of it. We do not knowingly collect data from anyone younger, and if we find out we have, we delete it.

Changes

If this policy changes in a way that matters, we will say so in the app, not bury it. The latest version always lives at this address.

Questions, and complaints

Message Ben in the app, or email ben@sparkies.app. A person reads it, not a ticket system, and you get an answer.

If we handle something badly and you are not happy with how we sorted it, you can take it to the Office of the Australian Information Commissioner at oaic.gov.au. We would rather you told us first and gave us the chance to fix it.