Diese Datenschutzerklärung auf Deutsch

Sparky Privacy Policy

Version 0.2 — 8 November 2026 — testing phase. This version has not yet been reviewed by a lawyer; it will be replaced by a reviewed version before Sparky launches. Earlier versions: 0.1 (8 November 2026), at https://sparky.mobi/privacy/0.1. The German version (Datenschutzerklärung) is the binding text; this English version is a translation for convenience.

Contents

Applies to: the Sparky apps for iPhone (iOS) and Android, the website sparky.mobi, the web pages Sparky's servers show for invite links (/i/…), profile links (/u/…), Sparky card links (/c/…), and the notice form for reporting illegal content (/report). During the testing phase, Sparky's servers are our test server (test.jadeburton.de), and where a setting on the test server differs from what we plan for the public release, this policy says so.

Sparky is a dating and meeting app for gay, bi and queer men and anyone who wants to meet them. Because of what Sparky is, the mere fact that you use it can reveal your sexual orientation. We treat everything we hold about you as sensitive, and we built Sparky so that we hold as little as we can.

In brief

1. Who is responsible

The controller under the GDPR is:

Tychio Labs UG (haftungsbeschränkt) i. G. (in Gründung: the company is being founded and not yet registered) Mühlenstr. 8a, 14167 Berlin, Germany Email: info@sparky.mobi Managing director, phone number and commercial register number: will be added once the company is registered.

Data protection officer: a data protection officer will be named here once appointed. Until then, please send all questions and requests about your data to info@sparky.mobi.

2. Words we use

All three servers run on our own systems at Hetzner in Germany (section 8).

3. What we process, why, on what basis, and for how long

Each part below says what we process, why, the legal basis, how long we keep it, and who receives it. Section 8 lists every recipient and section 9 every retention period in one place.

3.1 Your account and signing in

What: a random account ID; the sign-in method you choose. The apps currently offer Sign in with Apple, Sign in with Google, your phone number with a one-time code, and "Just this phone" (no method at all: the account lives on that phone only). For each method we keep only a keyed fingerprint (a one-way hash under a secret server key), not your name, email address or phone number. For Sign in with Apple we also keep Apple's account identifier and token encrypted, because Apple requires us to revoke the token when you delete your account, and so a move of the app to another Apple developer account doesn't lock you out. For phone-number sign-in during the testing phase, no text message is sent and no SMS provider receives your number: the app shows you the code itself. Your devices: a device ID (the ID of a key created on your phone), its public key, platform and app version, when first and last seen, and the security checks in section 3.23. If you sign in with your phone number, an optional registration-lock PIN.

Sign in with Apple and Sign in with Google ask only for an identifier ("openid"), never your name or email. On Android, Google's sign-in service also hands the app your name, email address and picture; the app never reads them and our servers never receive them.

Why: to create your account, let you sign in again on a new phone, and keep accounts secure.

Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR) and, because an account on Sparky reveals sexual orientation, your explicit consent (Art. 9(2)(a) GDPR, section 3.2). Apple and Google, when you choose to sign in with them, act as independent controllers: they learn that you use Sparky.

How long: until you delete your account, or until nobody has opened Sparky on any of its devices for a year (section 3.31). Devices that never completed sign-up, or that you retired: 30 days after last seen.

What: your display name, age, height, weight, gender and gender identity (cis or trans), sexuality, position, bio, answers to profile questions, tags (for example tribes such as Trans or Sober, what you're looking for, interests), languages, job, education, "Based in" (a neighbourhood and city you choose), relationship status, optional Instagram, TikTok and Snapchat handles, favourites (songs, films, TV shows, books), a status line, your profile photos (section 3.11) and your username (section 3.17).

Why: showing your profile to other people is what Sparky does.

Legal basis: your explicit consent under Art. 9(2)(a) GDPR, which you give on the privacy page before you sign up, separately from accepting the terms. The text you agree to (version 2) reads: "I agree that Sparky stores and shows my profile, including what it says about my sexuality, sex life and gender identity, and that people near me, and people who find me through virtual beacons or from further away, can see that I use Sparky." For the non-sensitive parts, performance of the contract (Art. 6(1)(b)). Showing your profile is the service itself, so this consent is a condition for using Sparky (Art. 7(4) GDPR).

Withdrawing consent: you can withdraw it at any time (Art. 7(3) GDPR) by deleting your account (Settings › Account › Delete account). Because showing your profile is the service, you can't keep using Sparky without it. Withdrawal doesn't affect what was lawful before it. If we change what the consent covers (a new kind of data, or a new group of people who can see you), we ask you again.

Who sees it: everyone Sparky shows your profile to: people near you (over Bluetooth, or within your phone's range of 3 km through the discovery service); people up to 50 km away when it's quiet where they are (section 3.6); people near one of your virtual beacons and people whose beacons find you (section 3.7); people who open your username, profile link or Sparky card (section 3.17), which works from any distance; people you're in a conversation with. Your profile is never shown across a block, nor while your account is suspended or under review. Sparky's team sees it when reviewing new photos and flagged texts, and when your profile is reported.

How long: until you change it or delete your account.

3.3 Discovery: Bluetooth, your live position and encounters

Bluetooth. While Sparky runs, your phone sends out a random ID that changes every 15 minutes, together with a signed token that contains that ID, the app's range and its validity, and nothing about you. Phones nearby read it. When phones that can't reach each other directly are both connected to a third Sparky phone, that phone passes on the tokens it read in the last two minutes, so you can still find each other ("introductions"; shown as "Nearby", without a distance). Messages can also travel phone to phone over Bluetooth, end-to-end encrypted.

Your live position. While Sparky is open (in the foreground), your phone sends its position (latitude and longitude) to the discovery service every 30 seconds, under the 15-minute ID. The discovery service:

Encounters. Your phone asks the app backend who is behind the IDs it saw. The app backend issues those IDs, so it can tell which account is behind each one. It deletes each ID's mapping 15 minutes after its time slot, and it doesn't record who looked up whom. The list of people you met is kept on your phone, not on our servers.

Why: to show you the people near you and show you to them.

Legal basis: performance of the contract (Art. 6(1)(b)) and your explicit consent (Art. 9(2)(a)), because being found on Sparky reveals that you use it. Reading your location through your phone's operating system is strictly necessary for the service you asked for (§ 25(2) no. 2 TDDDG); the operating system also asks for your permission. You can use Sparky over Bluetooth without allowing location.

How long: positions at most 5 minutes in memory; ID mappings 15 minutes after each slot.

3.4 Staying findable after you close Sparky ("lingering")

Off by default. If you turn on Settings › Privacy options › More privacy options › Stay findable after closing Sparky (1, 4, 8 or 12 hours), the discovery service keeps, after you close the app, only the 1 km grid cell you were last in, in memory, for the time you chose. People around there can still find you, see roughly where (about 1 km) and that you were there earlier.

Legal basis: your choice to turn it on, as part of the contract (Art. 6(1)(b)) and within your explicit consent (Art. 9(2)(a)). How long: the time you chose, then it's deleted; at once if you sign out, delete your account, switch profiles or turn it off.

3.5 Where you are now ("current area") and "Based in"

"Based in" is a neighbourhood and city you choose for your profile. The app can suggest one by asking your phone's operating system (Apple's or Google's geocoder) for the name of the place you're in; only the words you keep are saved. To find that name, your phone's operating system may send your coordinates to Apple or Google, under their own terms; Sparky's servers don't receive them.

"Show where I am now" is off by default. If you turn it on, your phone reports, with its once-a-minute presence signal while Sparky is open, the neighbourhood and city it's in (at most 60 characters, for example "Mitte, Berlin"), never coordinates. We store it encrypted with its time, and show it as "Now in Mitte, Berlin" to everyone Sparky shows your profile to, including people who find you from further away or through a beacon.

Legal basis: your choice (Art. 6(1)(b)) within your explicit consent (Art. 9(2)(a)). How long: a week after the last report; deleted at once when you turn the switch off or hide your activity.

3.6 Reaching further when it's quiet

When fewer than 20 people are within range, Sparky also shows the nearest people up to 50 km away, with a distance rounded to 5 km steps (at least 5 km), measured between 1 km cells. The same applies the other way round: people up to 50 km away can see you. This is part of discovery (section 3.3) and is named in the consent text. There is currently no switch to turn it off.

3.7 Virtual beacons

A virtual beacon lets you be found and find people around a place you pick, as if your phone stood there.

Why: to provide beacons, protect people from being tracked, and prevent misuse. Legal basis: Art. 6(1)(b), within your explicit consent (Art. 9(2)(a)); the safety rules also on our legitimate interest in protecting users (Art. 6(1)(f)). How long: as above; everything is deleted with your account.

3.8 Travelling to countries where same-sex relationships are criminalised

Your phone compares the country code its own geocoder gives with a list we publish to the app (based on the ILGA World database). If you're in such a country, it shows a safety notice once per country. Nothing about this is sent to us: your phone keeps only the codes of the countries the notice was shown for. Beacons can't be placed there (section 3.7). We refuse requests from authorities of such countries unless an EU or German legal basis requires us to answer (section 3.28).

3.9 Messages, photos and videos in chat

End-to-end encryption. Every message (text, hellos, vibes, likes signals, locations you send, gift cards, album keys) is encrypted on your phone for the recipient's device (the Olm protocol). Photos and videos are encrypted on your phone with a fresh key (AES-256-GCM); the key travels inside the encrypted message. Sparky refuses to send anything unencrypted. We can't read your messages, photos or videos.

What the relay holds: the encrypted message (padded so its length tells little), the sender's and the recipient's device IDs, and when it was sent and delivered. Encrypted photos and videos wait in our object store.

How long:

What the relay can see anyway: who writes to whom (as device IDs), when, and roughly how much.

Reports: if you report someone, your phone can include their last message (on by default) and photos they sent you or private photos they shared; your phone decrypts them and sends them to our moderators with the report (section 3.21). That is the only way Sparky's team sees chat content.

Legal basis: Art. 6(1)(b), within your explicit consent (Art. 9(2)(a)). Messages are also protected by the secrecy of telecommunications (§ 3 TDDDG).

3.10 Push notifications

To tell you about new messages while Sparky is closed, the relay stores your phone's push token (Apple Push Notification service on iPhone, Firebase Cloud Messaging by Google on Android) and sends a push that carries no content: no name, no text, only a count and a tag for your profile. Your phone then opens the message itself and shows what you chose under Notification previews (default "Name only": the sender's name and "New message"; you can choose "Nothing" or "Name and message"). The push token is created only after you've answered the privacy page. The same way, for update notifications while Sparky is closed, our app server asks the relay to send your phone a push that says only "New profile update" and your profile's tag (never who or what, nor why); the relay learns only that your phone was sent one, and when. Your phone then asks our app server what's new and shows it as your notification previews and app lock say.

Legal basis: Art. 6(1)(b); storing the token on your phone is strictly necessary for the service (§ 25(2) no. 2 TDDDG). How long: until the token is replaced, reported invalid, you turn notifications off, or delete your account. Apple and Google transfer data to the USA (section 8).

3.11 Profile photos, photo checks and the checkmark

What: the photos you upload to your profile (JPEG, with location and camera metadata removed on your phone), stored encrypted in our private object store; for each photo the results of our automatic checks; the date of a Sparky camera stamp, if the photo was taken with Sparky's camera.

Review: we run automatic checks on our own server, with open-source models; no photo leaves our servers for this. During the testing phase, the checks approve photos that are clearly fine, hide clearly explicit ones, and hold every other new photo until a person on Sparky's team checks it. They estimate nudity, count faces and people (detection only: we never create face templates or recognise who someone is), and compute a perceptual hash of the picture to spot the same photo on another account or on a banned one. A photo the checks aren't sure about can be hidden until a moderator looks; you get a statement of reasons and can appeal (section 3.21). Explicit photos are rejected and deleted at once; only the decision record stays.

The checkmark ("Photos checked and current"), when switched on, depends on a recent camera stamp, the checks above and no upheld fake report. During the testing phase it is switched on. It doesn't compare faces: no face comparison is built.

Legal basis: Art. 6(1)(b) and your explicit consent (Art. 9(2)(a)) for showing your photos; our legitimate interest in keeping Sparky free of explicit, illegal and fake content and meeting app-store requirements (Art. 6(1)(f)).

How long: until you remove the photo or delete your account; photos never put in a profile, a day; a rejected photo's record for six months so you can appeal (an explicit photo's file is deleted at once and, if you appeal, uploaded again from your phone until the appeal is decided); check results with the photo. Perceptual hashes of the photos of an account that was suspended and then deleted: two years (section 3.31).

3.12 Private albums

Your private albums are end-to-end encrypted: we store only sealed files we can't open, their sizes and dates. You decide who can see them, person by person (by request or offer), and you can stop sharing at any time. We don't learn who has access. We record requests and offers (who, to whom, when) for a day, for daily limits. If someone reports you and chooses to include your private photos, the reporter's phone sends us their keys with the report, and moderators can open them in memory (section 3.21).

Legal basis: Art. 6(1)(b), within your explicit consent (Art. 9(2)(a)). How long: until you delete them or your account; uploads not completed, an hour.

What: likes and secret likes, reactions to profiles (to a photo, the status, the bio or a favourite, which emoji), badge votes, first contacts (whom you first wrote to or heard from), partner links, blocks, gifts of beacons. Reactions are shown only to the profile's owner.

Favourites: when you search for a song or book, your phone sends the search text, its region and its IP address directly to Apple (iTunes Search API), without any Sparky identifier; we never see it. Searching for films and TV shows (through The Movie Database, TMDB) is switched off on our servers; before we switch it on, we'll describe it in this policy. Covers on profiles are fetched by our server and passed on to phones, so Apple never sees who views which profile. Tapping a favourite opens song.link or Apple's store page, under their own privacy policies.

Legal basis: Art. 6(1)(b), within your explicit consent (Art. 9(2)(a)). How long: until taken back, a block, or either account's deletion; first contacts with the conversation; partner requests 30 days unless accepted; daily-limit records a day.

Update notifications ("Notify me about updates" on a profile): we store that you want to hear about that profile, since when and when you were last told, and, until your phone fetches it, that the profile posted a status or added photos (which one, by ID, and when; at most 24 hours), and when your phone was last sent a push about it (section 3.10). The person you follow is never told, and can't find out from us, nor from their data export. What you're told is decided when your phone asks, as you would see their profile then: nothing across a block, nothing of a suspended account or one in stealth, nothing not yet approved. Your phone shows the notification itself, as your notification previews and app lock say. Legal basis: Art. 6(1)(b). How long: until you turn it off, a block between you, or either account's deletion.

3.14 Profile views

When you open someone's profile, the app backend records the visit. After 30 seconds the other person can see that you visited, and is told live. This also applies if you use features that otherwise make you less visible. In the public release there is no way to view a profile without the visit being shown; during the testing phase, testers can try "Hide visit" (section 6), which leaves a visit unshown. The list of profiles you've viewed is kept on your phone only.

Legal basis: Art. 6(1)(b), within your explicit consent (Art. 9(2)(a)). How long: 30 days.

3.15 "Looking at each other"

When you and another person both have each other's profile open at the same moment, both of you see "Looking at you too". To do this, your phone tells our server, over its live connection, whose profile is on screen. The server keeps this in memory only, never stores or logs it, and tells you only when the look is mutual: nobody ever learns about a look that isn't returned. On by default; you can turn it off in Settings › Privacy options; then you neither show it nor see it.

Legal basis: Art. 6(1)(b), within your explicit consent (Art. 9(2)(a)). How long: in memory while you look, at most 40 seconds after the last signal.

3.16 Online status and last active

While Sparky is open, your phone sends a presence signal once a minute. Others see whether you're online and when you were last active. With "Show my activity" off, they don't, and your current area isn't shown either. Legal basis: Art. 6(1)(b), Art. 9(2)(a). How long: only the latest time is kept, with the account.

You choose a username. With "Others can add me by username" on (the default), anyone who types it exactly can open your profile, from any distance, and your profile shows it. You can share a profile link (/u/<name>) or print Sparky cards with a QR code that leads to a link of its own (/c/<code>), which you can revoke. The PDF of the cards is made on your phone. The web page behind these links never shows your name, photo or age. When someone found you this way and contacts you, you see "Found you by your username" (or by card).

Legal basis: Art. 6(1)(b), within your explicit consent (Art. 9(2)(a)). How long: with your account. After you change your username, the old one is held for nobody for 30 days; after you delete your account, your username is held for nobody for a year, so nobody can take it and be mistaken for you. Card links until revoked or your account is deleted.

3.18 Invites and referral rewards

What: your invite code; who invited whom and when; whether the invited friend was confirmed (within 14 days: a complete profile with an approved photo and the app opened on 3 different days); the days an account was active in its first 14 days.

The inviter sees your name. If you join with a friend's code, profile link or card, your inviter sees that you joined, with your name only (no photo, no profile link). The app tells you so where you enter the code.

One reward per device. To stop people from collecting rewards with fake accounts, we keep a keyed hash of the device ID and App Attest key of every device confirmed for an invite, and we set a mark with Apple (DeviceCheck) or Google (Play Integrity device recall) that survives reinstalling. These marks stay after your account is deleted (section 3.31).

On Android, the app reads the Play Store's install referrer (which carries the code of the link you came from) only when you tap "Invited by a friend?".

Legal basis: Art. 6(1)(b) for the invite and the reward you asked for; showing your name to your inviter within your explicit consent (Art. 9(2)(a)); device marks and hashes on our legitimate interest in preventing referral fraud (Art. 6(1)(f)); setting and reading the marks on your device § 25(2) no. 2 TDDDG.

How long: invites with the account (an invite you joined with stays without you, so your inviter keeps the count); active days 15 days; device hashes 3 years; Apple's and Google's marks lapse after 2 years.

3.19 Beacon wallet, purchases and subscriptions

What: the beacons in your wallet (kind, where they came from: welcome, invite, gift, purchase, subscription; use-by; who gave a gift), and, for purchases, the store transaction ID or Play purchase token, the product, when, whether it was a test purchase and whether it was refunded; for subscriptions, the product, the number of permanent beacons, when it ends and whether it renews; a random store token for your account, which the store passes back so a purchase reaches the right account.

Payment is handled entirely by Apple (App Store) or Google (Google Play), who sell the items to you as merchant of record. We never see your payment details. Apple and Google process your purchase under their own privacy policies as independent controllers. Our server checks each purchase with Apple or Google before it adds the beacons.

Legal basis: Art. 6(1)(b). How long: with your account. The stores keep their own records.

3.20 Community board

Posts (ideas, bugs, frustrations), comments, votes and reports on the board are public to every Sparky account and not end-to-end encrypted. They show your name and main photo unless you post anonymously ("A Sparky user"); Sparky's team always sees which account wrote it. Bug reports can include your app version, platform, OS version, phone model and up to 3 screenshots; only the team sees the OS version, model and screenshots.

Legal basis: Art. 6(1)(b); moderation on Art. 6(1)(f). How long: until you delete them or your account: deleting your account deletes your posts and comments too (a comment others answered stays as an empty "Deleted" placeholder, without text or author). Activity notices 90 days. Posts kept without an account from before 6 November 2026 are erased on request.

3.21 Moderation: text checks, reports, review holds, statements of reasons and appeals

Text checks. When you save public text (name, bio, area, job, education, answers, tags, status, a beacon's message), our server checks it against word lists in six languages. Some text is refused (for example about minors, threats, slurs, selling sex or drugs). Some is held: you still see it, others don't until a moderator allows it; you get a statement of reasons and can appeal.

Reports. You can report a profile, a beacon, a community post or comment. A report contains the reason, your note, and by default the reported person's last message; optionally chat photos or private photos they shared with you (your choice, stored encrypted, opened only in memory by a moderator).

Review holds. If several people report an account within 30 days (each report weighted, newer or less reliable reporters count half), the account is hidden and limited until a person on our team reviews it. A report that an account belongs to someone under 18, from an account at least a day old, hides it at once. Nothing is banned until a moderator confirms it. See section 10.

Suspension. If a moderator suspends an account, its sign-in methods are banned and its devices marked with Apple (DeviceCheck) or Google (Play Integrity), so it can't simply sign up again.

Statements of reasons and appeals. Every restriction (suspension, review hold, rejected photo, held or removed text, removed beacon message) comes with a statement of reasons that says whether it was automated. You can appeal in the app within six months; a person decides.

Who sees it: Sparky's moderators, through a console that requires a passkey; every action is logged.

Legal basis: our legal obligations under the EU Digital Services Act (Art. 6(1)(c) GDPR with Art. 14, 16 and 17 DSA; we also offer appeals in the way Art. 20 DSA describes); our legitimate interest in a safe service and in defending against claims (Art. 6(1)(f)); for the special-category data involved, Art. 9(2)(a) and, where a report concerns a crime, Art. 9(2)(f).

How long: decisions, statements and appeals with the account; reports you filed with your account; reports about an account, while it exists, and a year after its deletion, without the account but with the keyed fingerprints of its sign-in methods, so moderators recognise someone who comes back; photos attached to reports as long as the report; the moderators' audit log two years.

3.22 Notices from anyone (/report)

Anyone, also people without Sparky, can tell us about illegal content or a breach of our terms at https://app.test.jadeburton.de/report (for example if a fake profile uses their photos). The form asks what it's about, why, an explanation, and optionally a name and email address (so you can stay anonymous), and a statement that the notice is made in good faith. It uses no cookies and no scripts, and we don't store your IP address or browser with the notice. We confirm receipt at once with a reference.

Legal basis: Art. 6(1)(c) GDPR with Art. 16 DSA. How long: what the notice says, the name, the email and our decision, encrypted, until a year after the decision. If you gave an email address, we tell you the outcome there.

3.23 Security, device checks and preventing abuse

What: App Attest (iPhone) and Play Integrity (Android) attestations that a request comes from the genuine app; Apple's DeviceCheck bits (one for banned devices, one for invite rewards); Play Integrity device recall bits (the same); limits on how often an account or an address may do something (counters in memory or in the database, kept until they reset, an hour to a day); server logs that contain only the route, status and duration, never IDs, addresses or content.

Encryption at rest: profiles, names, settings, consent entries, reports, statements and appeals are encrypted in our database with keys kept apart from it; the photo store encrypts every file.

On your phone only: the app lock and the "duress PIN" are kept on your phone; nothing about them is sent to us.

Legal basis: our legitimate interest in keeping Sparky and its users safe (Art. 6(1)(f)) and our duty to secure your data (Art. 32 GDPR); storing and reading the device's keys and attestations is strictly necessary (§ 25(2) no. 2 TDDDG). How long: attestation keys with the device; the bits are kept by Apple and Google and lapse after two years.

Both are off unless you turn them on (on the privacy page or in Settings › Account › Your data), and the software isn't even started before that.

Legal basis: your consent (§ 25(1) TDDDG and Art. 6(1)(a) GDPR). Withdrawal: turn the switch off at any time; the app stops sending, forgets the statistics ID and deletes unsent crash reports. How long: crash reports are kept by Google for 90 days; statistics are kept by TelemetryDeck under its own privacy policy. Neither can be linked to your account.

3.25 "I want Sparky here" (launch cities)

Whether you're inside a launch area is worked out on your phone only. If you tap "I want Sparky here", the app sends the city and country your phone's geocoder names; we add one to that city's count and keep nothing about you. Legal basis: Art. 6(1)(f) (planning where to launch).

When you open sparky.mobi or a link page (/i/, /u/, /c/, /report), your browser sends its IP address, the page requested, its language and its browser type. We use the language to show the page in it and the browser type to show the right store button. The link pages set no cookies and never name the person whose link it is. During the testing phase, the link pages and the notice form are served from app.test.jadeburton.de. The website sparky.mobi runs on the same server, hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (section 8). Our web server keeps no access logs, for either.

Legal basis: Art. 6(1)(f) (delivering the page securely); § 25(2) no. 2 TDDDG.

3.27 Contacting us

If you write to us (by email or through the app), we use what you send to answer you. Legal basis: Art. 6(1)(b) or (f). How long: as long as we need it to deal with your request. Our mailbox info@sparky.mobi is hosted by IONOS SE (Montabaur, Germany). We don't use an email service provider to send emails automatically yet.

3.28 Requests from authorities

We disclose data to police, prosecutors or courts only where a law binding on us requires it (Art. 6(1)(c) GDPR), for example a court order or a request under German criminal procedure law, or a European production or preservation order (Regulation (EU) 2023/1543). We check every request, give only what the request covers, and log it. We can only give what we have: we have no positions on disk, no message contents, and no record of who met whom beyond pickups (7 days).

To prove that you gave your consent (Art. 7(1) GDPR), your phone and our server keep a record of your answers on the privacy page: the item, yes or no, the text version, when and where it was given, and the app's platform and version. Statistics and crash-report choices stay on your phone.

After you delete your account we keep a proof of consent for three years: those entries, when the account was deleted, and keyed hashes of the account's IDs and sign-in fingerprints, nothing that names you without our server key. With the key and an identifier you give us (for example your account ID), we can find it, for example to answer a complaint about processing before the deletion.

Legal basis: our legitimate interest in being able to prove consent and defend against claims (Art. 6(1)(f), Art. 17(3)(e) GDPR). How long: three years after deletion (the standard limitation period, § 195 BGB).

3.30 Exporting your data

Settings › Account › Export my data gives you two files: a ZIP of everything on your phone (your profile, photos, chats and media, the people you met, blocks, beacons, reactions, private albums) and "Get my server data", a JSON file of everything our app backend holds about you (profile, sign-in methods, consent record, photos, likes and views you gave, likes and views you received as times only, reports you filed, reports about you as reason, dates and outcome only, decisions and appeals, community posts, beacons, wallet, purchases, devices, invites, the profiles you get update notifications for, and more; never who gets update notifications about you). We leave out keys, tokens and hashes, and the identity of people who reported you (Art. 15(4) GDPR). This serves your rights of access and portability (Art. 15 and 20 GDPR). If you can't use the app any more, write to us (section 11).

3.31 Deleting your account, inactive accounts, and backups

Delete your account in Settings › Account › Delete account. In one step, our app backend deletes your account, profiles, photos, private albums, likes, reactions, votes, views, blocks, update notifications (yours, and others' about you), conversations' records, beacons and pickups, invites you made, wallet and purchases, decisions and appeals, reports you filed, and your community posts. It then has the relay erase your devices' messages, push tokens and keys. Your phone deletes everything on it.

Inactive accounts: if none of your devices opens Sparky for a year, we delete the account in the same way.

What stays, and why:

What How long Why
Messages you sent that the recipient hasn't collected yet up to 30 days they're the recipient's too
Encrypted chat media up to 30 days the keys sit in those messages
Reports about you, without your account, with keyed fingerprints of your sign-in methods 1 year so an abuser can't escape reports by deleting and signing up again (Art. 6(1)(f), 17(3)(e))
If you were suspended: keyed fingerprints of your sign-in methods 5 years from the ban so a ban holds
If you were suspended: perceptual hashes of your photos (no account, no photo) 2 years to spot the same photos on a new account
If your device was confirmed for an invite: keyed hashes of its IDs; Apple's/Google's device marks 3 years; marks 2 years one invite reward per device
Proof of consent under keyed hashes 3 years section 3.29
Your username, held for nobody 1 year so nobody can impersonate you with it
Moderators' actions in the audit log, without the account 2 years accountability
The IDs of deleted profiles in the deletion ledger 60 days so a restored backup doesn't bring your account back
Records of codes sent (hash, device) 1 day sending limits
Copies in backups up to 5 weeks see below
Statistics and crash reports (if you allowed them) their own periods not linked to your account, so they can't be found

Backups. We back up our databases and profile photos every night. Backups on the server are kept 14 days; encrypted copies in a second location in the EU (Finland) are kept as 7 daily and 4 weekly copies. A deleted account's data is gone from every backup within five weeks; chat media within 38 days of upload. Backups are used only to restore the service. If we ever restore one, our deletion ledger deletes every account deleted since before the service runs again.

3.32 Hash lists and their limits

Several lists above keep keyed hashes instead of the data itself (sign-in fingerprints, device IDs, photo hashes). A keyed hash is calculated with a secret key that is kept apart from the database and its backups, so the hash alone can't be turned back into a phone number, an email or a device ID. But a keyed hash is still personal data (pseudonymised, not anonymous): if you come back with the same sign-in method, device or photo, our system recognises it, which is the point. Perceptual photo hashes identify a picture, not a person. Each list has a fixed end date (above); none is kept indefinitely.

4. Where data is kept: on your phone

Much of Sparky's data lives only on your phone: your chats and media, the people you met (encounters), the profiles you viewed, the exact places of your beacons, your recent photos, your app lock and duress PIN, your settings. Sparky's database and media are excluded from your phone's backups. Deleting the app or your account deletes them.

Storage on your device (§ 25 TDDDG). Sparky stores and reads on your device what the service you asked for strictly needs (§ 25(2) no. 2 TDDDG): its device key and tokens, its local database and settings, the push token, App Attest, DeviceCheck and Play Integrity information. Only statistics and crash reports need your consent (§ 25(1) TDDDG, section 3.24). The Play install referrer is read only when you tap "Invited by a friend?". On Android, Firebase starts with the app so that push messages can work; its automatic messaging start is off, and crash reporting stays off until you allow it.

5. No advertising, no tracking, no sale

Sparky contains no advertising, attribution or data-broker software, doesn't use your phone's advertising ID, and doesn't track you across other companies' apps or websites. We don't sell or rent personal data, and we don't share it with anyone for their own advertising.

6. Features not yet offered

Some built features are not part of the public release yet: stealth mode, a second profile, nearby alerts, venues, browsing all photos, hiding a visit, moving most beacons, unsending a message, sharing a live location and sending videos. During the testing phase they are switched on for testers on our test server, so testers can try them; this version of the policy doesn't describe them in detail yet. We'll update this policy before we offer any of them to everyone.

7. Who is 18 or older

Sparky is only for adults. We don't knowingly process data of anyone under 18. If we learn that an account belongs to someone under 18, we hide it at once and delete it after review.

8. Recipients and transfers outside the EU

We don't pass your data to others except as described here. Our service providers (processors) work only on our instructions under a data processing agreement (Art. 28 GDPR).

Recipient Role What Where Transfer safeguard
Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany processor hosting of all servers, databases, object stores and backups, and of the website sparky.mobi Germany (Nuremberg, Falkenstein); encrypted backups in Finland (Helsinki) EU
Apple Inc. / Apple Distribution International Ltd. push service (processor/service provider); independent controller for Sign in with Apple, App Store purchases, DeviceCheck, App Attest, its geocoder and maps, the iTunes Search API push tokens, attestations, device marks; for purchases and sign-in what Apple handles itself Ireland, USA EU-US Data Privacy Framework (Apple Inc. certified); Apple's terms
Google Ireland Ltd. / Google LLC processor for Firebase Cloud Messaging and Crashlytics (crash reports only with consent); independent controller for Sign in with Google, Google Play purchases, Play Integrity, Android's geocoder, and the Google Maps SDK that shows maps in the Android app (for example when placing a beacon) push tokens, crash reports, integrity tokens, device marks; for maps, what the Maps SDK sends to Google under Google's terms Ireland, USA EU-US Data Privacy Framework (Google LLC certified); Firebase Data Processing and Security Terms
TelemetryDeck GmbH, Von-der-Tann-Str. 54, 86159 Augsburg, Germany processor (only with consent) pseudonymous usage statistics Germany (company seat); hosting as described in TelemetryDeck's privacy policy EU
IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany processor our mailbox info@sparky.mobi (emails you send us, and our replies) Germany EU
Email provider for sending emails automatically (sign-in codes, outcome emails) — not yet in use — —
SMS provider — not in use during the testing phase: no phone number is sent to an SMS provider (section 3.1) — —
Other Sparky users recipients by the nature of the service your profile and what this policy says they see worldwide (Sparky can be used anywhere once installed) Art. 49(1)(b) GDPR, as necessary to perform the contract
Authorities recipients only where required by law section 3.28 Germany/EU —

Transfers to the USA rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), for which the US recipients named are certified, and otherwise on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).

9. How long we keep data: overview

Data Kept
Live position (discovery service, memory only) at most 5 minutes after the last report
Lingering cell (memory only, if turned on) the time you chose (1 to 12 hours)
Beacon points (discovery service, memory only) up to 7 days after the last refresh
ID mappings (who is behind a rotating ID) 15 minutes after each slot
Current area (if turned on) a week after the last report
Pickups until collected, at most 7 days
Profile views 30 days
Update notifications (who follows whom) until turned off, a block, or either account's deletion
An update not yet fetched (a status or photos posted) until your phone fetches it, at most 24 hours
First contacts ("I'm messaging this user") 30 days from the last contact
"Looking at each other" memory only, seconds
Delivered messages (encrypted) 7 days after delivery
Undelivered messages (encrypted) 30 days
Chat media (encrypted) until downloaded, at most 30 days
Account, profile, photos, likes, reactions, beacons, wallet, purchases, decisions until you delete the account, or after a year without use
Photos never used in a profile 1 day
Rejected photo records 6 months
Verification codes 10 minutes
Devices without an account 30 days after last seen
Notices via /report 1 year after the decision
Community activity notices 90 days
Reports about a deleted account 1 year
Banned sign-in fingerprints 5 years from the ban
Photo hashes of a suspended, deleted account 2 years
Invite device hashes 3 years (Apple's/Google's marks 2 years)
Proof of consent 3 years after deletion
Deleted account's username (held for nobody) 1 year
Moderators' audit log 2 years
Deletion ledger 60 days
Backups 14 days on the server, at most 5 weeks offsite

10. Automated decisions and human review

We make no decisions with legal or similarly significant effect based solely on automated processing (Art. 22 GDPR), with these exceptions, which are temporary and always reviewed by a person:

Each comes with a statement of reasons that says it was automated, and you can contest it, explain your view and ask for a person to decide (the appeal in the app). These holds are necessary for a safe service we provide under our contract with you (Art. 22(2)(a) GDPR).

11. Your rights

You have the right to:

To use your rights, write to info@sparky.mobi (section 1). We may ask you to prove the account is yours, for example by writing from the app or by naming your account ID; we never ask for an ID document beyond what's needed. We answer within a month (Art. 12(3) GDPR).

Do you have to give us your data? No law requires it. But without the profile consent, an account and your position or Bluetooth, Sparky can't work.

12. Changes to this policy

We'll update this policy when Sparky changes. If a change needs your consent (for example a new kind of sensitive data or a new group of people who can see you), we'll ask you in the app before it applies. The current version is always at https://sparky.mobi/privacy (in German at https://sparky.mobi/datenschutz), and each version stays available at its own address, for example https://sparky.mobi/privacy/0.2.

Versions

Version Date Changes
0.1 8 November 2026 First version, for the testing phase; not yet reviewed by a lawyer.
0.2 8 November 2026 The website sparky.mobi is now hosted by Hetzner on our own server (no access logs), no longer by IONOS, which only hosts our mailbox; this policy's address is now sparky.mobi.