Privacy Policy
Effective 2026-10-02
The short version.
- We store what you write, your email address, and the language settings you choose.
- No analytics, no advertising, no tracking, and no cookies of any kind.
- Your journal text is sent to an AI provider when, and only when, you ask for a review. That is how the review is written.
- We never sell your data.
- You can ask us to erase your account.
What we collect
All of it is data you gave us by using the app, or data that using the app produces.
| What | Why | Stored in |
|---|---|---|
| Email address | To sign you in with a magic link, and to contact you. | users |
| First name | To address you in the app. Taken from Google if you sign in with Google. | users |
| Native language | The language correction explanations are written in. | users |
| Target language | The language a new journal opens in. | users |
| Journal title and content | It is the thing you came here to write. | journals |
| Each entry’s language | So the AI reviews an entry for the language it was written in. | journals |
| Reviews, corrections and explanations | So the diff renders without asking the AI again. | journal_reviews, corrections |
| Practice exercises and your answers | So progress counts what you actually did. | practice_items, practice_attempts |
| The days you wrote | The streak and the progress screen. | derived from journals |
| Sign-in tokens | To keep you signed in. Stored only as a hash, never as the token itself. | sessions, magic_link_tokens |
| AI call records | An operator record of cost and failure: model, token counts, duration, outcome, and the provider’s own error text. Never your writing. | ai_calls |
What we deliberately do not collect
- No analytics or product-tracking service, and no third-party script on this site.
- No advertising, and no advertising identifier.
- No location data.
- No access to your contacts, photos, microphone or camera.
- No cookies.
Cookies
Sparkslingo sets no cookies, in the app or on this site. This is a design decision rather than an oversight: signing in gives the app a session token, which it keeps on your own device and sends back with each request. Because there is no cookie, there is nothing to consent to, which is why this site has no cookie banner.
This website stores nothing on your device at all. In the browser app, the session token is kept in your browser's local storage; on a phone it is kept in the system keychain.
Why we use it
- To give you the service you asked for: a journal, reviews, practice and progress.
- To sign you in and keep your account secure.
- To send the sign-in email you requested.
- To keep the service affordable: the AI call records are how we see cost and failure.
- To answer you when you write to us.
Under Indonesia's Personal Data Protection Law (UU 27/2022) we rely on your consent, which you give by creating an account and by asking for a review, and on the need to perform the agreement described in the Terms of Service.
Who else sees your data
We share data only with the providers that make the service work. We never sell it, and we never share it for advertising.
| Provider | What it receives | When |
|---|---|---|
| AI provider | The text of the journal you ask to have reviewed, plus that entry’s language and your native language. No email address and no name travel with it. | Only when you start a review. |
| The email address and name on the Google account you sign in with. | Only if you choose to sign in with Google. | |
| Email provider | Your email address, and the sign-in link we send to it. | Only when you ask for a magic link. |
| Hosting and database provider | Everything listed in the table above. This is where it is stored. | Always. |
This is the part worth reading twice. A review is written by a separate company, on its own servers, under its own terms. We send it the text you asked us to review, because reading your writing is the only way to review it. If you would rather not send a particular entry to them, do not ask for a review of it. Writing and storing a journal without a review never contacts the provider.
Where your data goes
The AI provider and Google are outside Indonesia, and their servers may be in the United States or elsewhere. Using those features means your data is transferred to and processed in those countries. If you do not want that, use the email sign-in instead of Google, and do not ask for AI reviews.
How long we keep it
- Journals, reviews, corrections, exercises and answers. Until you delete the journal, or until we erase your account. Deleting a journal in the app removes the reviews, corrections and exercises that came from it at the same time.
- Sessions. 30 days from last use, then they stop working.
- Magic-link tokens. 15 minutes, usable once, and stored only as a hash.
- AI call records. If you delete a single journal, the record of the AI calls made for it stays, but its links to that journal and its review are cleared. If your whole account is erased, these records go with it.
Your rights
You can ask us to:
- show you the personal data we hold about you;
- correct data that is wrong;
- delete your data;
- withdraw your consent for a use you agreed to;
- object to a particular use; and
- give you a copy of your data in a usable form.
Write to [CONTACT EMAIL] and we will answer within the time the law allows. You may also complain to the Indonesian data protection authority.
Erasure is currently a request, not a button. There is no self-service "delete my account" screen yet. Email us and we will erase your account and everything in it. Deleting a single journal is self-service, in the app.
If you are in the EU or the UK
You have the rights set out in Articles 15 to 22 of the GDPR (or the equivalent UK provisions): access, rectification, erasure, restriction, portability, objection, and rights about automated decisions. Our legal bases are the performance of our contract with you and your consent.
Sparkslingo does not make automated decisions about you. An AI review is a suggestion about a piece of text, and it has no effect on your access, your price or your rights. You may complain to the supervisory authority in your country.
Security
Session tokens and magic-link tokens are stored only as hashes, so a copy of the database contains no usable credential. Traffic between the app and the API is sent over HTTPS. Access to the production database is limited to the people who operate the service. No system is perfect, and if a breach affects you we will tell you.
Children
Sparkslingo is not intended for children. Do not use it if you are below the age at which you can consent to data processing where you live. Under Indonesian law, consent for a child is given by a parent or guardian. If we learn that a child has an account, we will erase it.
Changes to this policy
If we change this policy, we will update the effective date at the top of this page. A change that materially affects you will be announced in the app or by email.
Contact
[LEGAL ENTITY NAME], [REGISTERED ADDRESS]. Write to [CONTACT EMAIL], or see the contact page.