SparkColors Privacy Policy

Version: 1.1.0 Effective date: August 6, 2026 Last updated: August 6, 2026

1. Who We Are and What This Policy Covers

SparkColors is an independently developed browser extension and related online service for annotating webpages, organizing knowledge, using AI-assisted reading tools, and sharing selected content with a community. In this Privacy Policy, “SparkColors,” “we,” “us,” and “our” refer to the operator of SparkColors.

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you use the SparkColors browser extension, website, account services, community features, paid features, and related services (collectively, the “Service”). It does not govern third-party websites, applications, AI providers, identity providers, payment providers, or browser stores that have their own privacy practices.

For privacy questions or requests, contact us at hi@sparkcolors.com.

2. Information We Collect

The information we collect depends on which features you use.

2.1 Account and authentication information

We may collect:

• your email address, display name, profile image, account identifier, and account settings;
• authentication and session information, such as access tokens, refresh tokens, session identifiers, login time, and session status;
• information received when you sign in with Google or GitHub, such as your provider user ID, email address, name, and profile image, depending on the permissions you grant to that provider; and
• records showing which version of our Terms or Privacy Policy you accepted, including the acceptance time and related technical information such as IP address and user agent.

We do not receive your Google or GitHub password.

2.2 Content you create or submit

We may collect and store content you choose to create, import, submit, or synchronize through the Service, including:

• webpage annotations, highlighted or selected text, comments, thoughts, tags, reactions, and casual notes;
• URLs, page titles, favicons, page metadata, source references, document information, and annotation locations needed to reconnect your content to its source;
• files, documents, or text you choose to import or process;
• community posts, replies, reports, feedback, and visibility choices, including public, private, or anonymously displayed content;
• AI chat messages, prompts, instructions, generated summaries, translations, classifications, scores, suggested tags, extracted entities, relationships, knowledge-graph data, and other AI-assisted results; and
• support requests and other communications you send to us.

2.3 Webpage and browsing-context information

When you activate SparkColors on a webpage or use a feature that requires page context, the extension may access the active page’s URL, title, visible or selected text, page structure, metadata, scroll position, and other content needed to provide the requested feature. For example, this information may be used to create an annotation, restore its position, generate a reading summary, answer a question about the page, translate text, or prepare an export.

SparkColors does not continuously create or sell a general history of every page you browse. Page content is sent to our servers or a third-party provider only when needed for a feature you initiate or enable, such as synchronization, AI-assisted processing, translation, or publishing.

If you explicitly use a visual annotation, capture, copy, or export feature, SparkColors may process the visible portion of the active page on your device. A visual capture is not uploaded solely because it was created locally; it is transmitted only if you choose a feature that requires upload or synchronization.

2.4 AI and translation activity

When you request an AI or translation feature, we may process the submitted text, relevant webpage content, source URL and title, your instructions, conversation history, provider and model selection, token or usage counts, task status, latency, and error information.

If you provide your own AI provider credential, we may store it in encrypted form so the Service can make requests you authorize. The selected provider will receive the content needed to respond to your request.

2.5 Subscription, payment, and membership information

Paid transactions are processed by Creem. We may receive and store limited transaction and membership information, such as your customer or transaction identifier, product or plan, subscription status, amount, currency, payment status, renewal or expiration time, and refund status. Payment card or other full payment credentials are provided directly to the payment provider and are not stored by SparkColors.

2.6 Usage, device, and security information

We may collect technical and operational information such as:

• IP address, browser type and version, operating system, device type, language, time zone, extension or application version, and request timestamps;
• feature interactions, synchronization status, task status, usage limits, errors, crash or diagnostic information, and security events;
• login history, active sessions, authentication failures, abuse or fraud signals, and moderation records; and
• membership entitlements, rewards, points, wallet balances, transaction records, and related activity where those features are available.

We use this information to operate, secure, troubleshoot, and improve the Service. We do not use it to build profiles for third-party advertising.

2.7 Information stored locally on your device

The extension and website may use browser extension storage, local storage, session storage, cookies, or similar technologies to keep authentication state, preferences, theme and language settings, disabled-site choices, navigation state, membership access state, and other information needed for the Service to work.

We do not currently use third-party advertising cookies or tracking pixels for personalized advertising. You can clear local data through your browser or uninstall the extension, although doing so may sign you out or reset local preferences. Removing local data does not automatically delete information already synchronized to your SparkColors account.

3. Browser Permissions

Browser permissions vary by browser and Service version. A permission allows a technical capability; it does not mean that all accessible information is collected or transmitted.

SparkColors may request the following permissions:

• Storage: to save authentication state, preferences, cached data, and extension settings.
• Identity: to support sign-in flows such as Google authentication.
• Active tab, tabs, and website access: to identify and interact with the page where you use annotation, reading, translation, capture, or related features. These permissions are not used to sell your browsing history.
• Side panel: to display the SparkColors interface in browsers that support a side panel.
• Downloads: to save an export or other file when you ask us to do so.
• Clipboard write: to copy content to your clipboard after an action you initiate. This permission does not allow SparkColors to read your clipboard.

You may disable SparkColors on selected sites through available settings. Restricting permissions may prevent some features from working.

4. How We Use Information

We use personal information to:

• create, authenticate, and manage your account and sessions;
• provide annotation, synchronization, search, organization, community, export, reading, translation, AI chat, knowledge-graph, and related features;
• remember your settings and reconnect annotations or notes to their source pages;
• process subscriptions, membership entitlements, usage limits, rewards, refunds, and transaction records;
• send service-related emails, such as sign-in codes, security messages, receipts, and important policy or account notices;
• provide support, respond to feedback, and communicate with you;
• detect, investigate, and prevent spam, fraud, abuse, security incidents, and violations of our terms;
• moderate public or anonymously displayed content and enforce community rules;
• monitor reliability, diagnose errors, maintain infrastructure, and improve the Service;
• comply with law, respond to valid legal process, and establish, exercise, or defend legal claims; and
• create aggregated or de-identified information that is not reasonably capable of identifying you.

5. Legal Bases for Processing

Where laws such as the GDPR require a legal basis, we process personal information on one or more of the following bases:

• Performance of a contract: when processing is necessary to provide the Service you request, manage your account, synchronize content, or deliver paid features.
• Consent: when you choose to connect an identity provider, submit content for an optional AI or translation feature, publish content, or otherwise consent to specific processing. You may withdraw consent at any time, but withdrawal does not affect processing already performed.
• Legitimate interests: to secure and improve the Service, prevent abuse, maintain reliable operations, provide customer support, understand feature performance, and protect our users and rights, where those interests are not overridden by your rights.
• Legal obligations: when processing or retention is required to comply with tax, accounting, consumer-protection, law-enforcement, or other legal requirements.

6. AI-Assisted Features

AI features are activated by your request or by a setting you enable. To provide them, SparkColors may send your prompt, relevant webpage text or imported content, source context, and conversation history to our backend and to the AI provider selected or configured for the feature. Providers may include DeepSeek, OpenAI-compatible providers, or a provider you configure.

SparkColors does not use your content to train AI models operated by SparkColors. Third-party AI providers process data under their own terms, privacy policies, contractual commitments, and account or API settings. Their retention and model-improvement practices may differ, especially when you use your own provider credential. Review the applicable provider’s terms before using that provider.

Do not submit passwords, payment credentials, government identifiers, health information, or other highly sensitive information to AI or translation features unless you have determined that the processing is appropriate. AI-generated results can be inaccurate and should be reviewed before use or publication.

7. When We Disclose Information

We may disclose information only as described below.

7.1 Service providers

We use service providers to operate specific parts of the Service. Depending on the feature, these may include:

• **Google and GitHub** for optional account authentication;
• **Creem** for checkout, payment, subscription, tax, fraud-prevention, and refund processing;
• **Resend** for transactional email delivery;
• **DeepL** for translation when that integration is enabled;
• AI model or API providers selected by SparkColors or configured by you for AI-assisted features;
• **Vercel** for hosting or delivery of the public website; and
• backend hosting, database, storage, security, and infrastructure providers needed to operate the Service.

These providers receive only the information reasonably needed for the relevant service and process it under their contracts and applicable privacy terms. Some providers may act as independent controllers for parts of their services.

7.2 Public and community features

Content you choose to publish may be visible to other users and the public, together with information you choose to associate with it. Public content may be copied, indexed, reshared, or retained by others outside our control.

If you choose an “anonymous” display option, your public profile identity is hidden from other users as described in the interface. The content may still remain associated with your account internally so that we can operate the feature, prevent abuse, respond to reports, and comply with law. Anonymous display is not the same as technical anonymity from SparkColors.

Authorized administrators may access account or content information when reasonably necessary for support, security, moderation, abuse prevention, or legal compliance.

7.3 Legal, safety, and business reasons

We may disclose information if we reasonably believe it is necessary to comply with law or valid legal process; protect the rights, safety, and security of users, the public, SparkColors, or the Service; investigate abuse or fraud; enforce our agreements; or establish, exercise, or defend legal claims.

If the Service or its assets are involved in a merger, acquisition, financing, reorganization, or sale, information may be disclosed to advisers and transferred as part of that transaction, subject to appropriate confidentiality and legal safeguards.

7.4 Browser stores and external platforms

Google Chrome Web Store, Microsoft Edge Add-ons, Mozilla Firefox Add-ons, and other platforms through which you obtain or use the Service may independently collect information under their own privacy policies. SparkColors does not control their processing.

8. No Sale of Personal Information or Behavioral Advertising

We do not sell your personal information. We also do not share personal information for cross-context behavioral advertising or use your webpage content to serve personalized third-party advertisements.

9. International Data Transfers

SparkColors and its service providers may process information in countries other than the country where you live. Those countries may have different data-protection laws.

Where required, we rely on appropriate transfer mechanisms, such as adequacy decisions, standard contractual clauses, contractual protections, or another lawful basis. You may contact us for more information about safeguards relevant to your information.

10. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including providing the Service, maintaining security and continuity, resolving disputes, enforcing agreements, and meeting legal obligations. Retention depends on the type of information and feature:

• Account and synchronized content: generally retained while your account is active and until deleted by you or through the account-deletion process, subject to the exceptions below.
• Account deletion: after you request deletion, your account may enter a 15-day grace period during which deletion can be cancelled. After the grace period, we begin deleting or de-identifying account data from active systems, except information we must or are permitted to retain for security, fraud prevention, dispute resolution, legal compliance, or other legitimate purposes.
• AI reading tasks and temporary page-processing data: active task availability normally expires within 24 hours. Expired task records or inputs may remain for a limited period where needed for operational cleanup, security, troubleshooting, or backup rotation.
• AI conversations and saved results: generally retained until you delete or reset them, delete the related content, or delete your account, unless a shorter product-specific period is shown.
• Authentication sessions and security logs: retained for the lifetime of the session and for a reasonable period afterward to secure accounts and investigate abuse.
• Payment, subscription, tax, refund, and accounting records: retained for the period required by applicable law and the payment provider’s requirements.
• Policy-acceptance, moderation, fraud, audit, and legal records: retained as reasonably necessary to demonstrate compliance, protect the Service, resolve disputes, and enforce agreements.
• Local browser data: retained until it expires, you clear it, or you uninstall the extension, depending on the storage type.
• Backups: residual copies may remain in encrypted or access-controlled backups until they are overwritten or expire under normal backup cycles.

When retention is no longer necessary, we delete or de-identify information, subject to technical limitations and legal requirements. Third-party providers may retain information under their own retention schedules.

11. Your Choices and Privacy Rights

You can use available account and product controls to:

• view or update profile information;
• control whether content is private, public, or anonymously displayed where those options are offered;
• delete annotations, notes, conversations, or other content where deletion controls are available;
• manage active sessions, connected sign-in methods, disabled sites, and extension permissions;
• choose whether to submit content to optional AI or translation features; and
• request account deletion.

Depending on where you live and the law that applies, you may also have the right to request access to, correction of, or deletion of your personal information; receive a portable copy; restrict or object to processing; withdraw consent; or appeal our response. We may need to verify your identity before completing a request. Some rights are subject to exceptions, including where retention is required by law or needed for security, fraud prevention, or legal claims.

11.1 EEA, United Kingdom, and similar jurisdictions

Where applicable, you may have rights of access, rectification, erasure, restriction, portability, and objection, as well as the right to withdraw consent. You may also lodge a complaint with the data-protection authority where you live or work. If we rely on legitimate interests, you may request information about the balancing of those interests against your rights.

11.2 California and other U.S. state rights

Where applicable, you may have rights to know, access, correct, delete, or obtain a copy of personal information, and to receive equal service without unlawful discrimination for exercising a privacy right. Because we do not sell personal information or share it for cross-context behavioral advertising, there is no sale or behavioral-advertising sharing to opt out of through SparkColors.

To exercise a privacy right, email hi@sparkcolors.com and describe your request. We will respond within the period required by applicable law.

12. Security

We use reasonable administrative, technical, and organizational measures designed to protect personal information, including access controls, transport encryption, protected credential storage, and monitoring appropriate to the Service. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

You are responsible for protecting access to your email account, devices, authentication sessions, and any third-party provider credentials you connect to SparkColors. If you believe your account or information has been compromised, contact us promptly at hi@sparkcolors.com.

13. Children’s Privacy

The Service is not intended for children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided personal information to us, contact hi@sparkcolors.com. If we learn that we collected such information without valid authorization where required, we will take reasonable steps to delete it.

14. Changes to This Policy

We may update this Privacy Policy to reflect changes to the Service, technology, providers, or law. We will post the updated Policy with a new “Last updated” date and version number. If a change materially affects how we process personal information, we will provide additional notice or request renewed acceptance where required. Your use of the Service remains subject to the version presented to and accepted by you where acceptance is required.

15. Contact Us

For privacy questions, rights requests, or complaints, contact:

SparkColors Email: hi@sparkcolors.com