Spark · Privacy Policy

Spark Privacy Policy

Last updated: May 13, 2026

This Privacy Policy describes how Spark ("the App", "we", "us", or "our") collects, uses, and protects your information when you use our iOS application.

1. Who we are

Spark is a life counter and match history app for the Magic: The Gathering Commander format. The App is developed and operated by Xavi Saucedo Martín, a sole developer based in Spain.

Contact: [email protected]

2. Information we collect

2.1 Match and gameplay data

When you play a game with Spark, we record:

• Match metadata: start/end timestamps, game duration, number of players, game mode (Commander/Normal), starting life total, winner.
• Per-player state: life totals, commander damage received, poison counters, energy/experience/radiation counters, eliminations.
• Player names: the names you assign to each player in the pre-game setup. These can be free-text or selected from your saved Friends list.
• Commander selections: the commander cards you assign to players (sourced from the public Scryfall database).
• Game events: a chronological log of life changes, combat phases, eliminations, and other in-game actions used to build the Battle Book timeline.

2.2 Friends and Playgroups

If you create Friends profiles or Playgroups, we store:

• Friends: the display names you provide.
• Playgroups: group name, ranking-enabled flag, list of member Friend IDs.

2.3 Subscription data

If you subscribe to Spark Pro or purchase the lifetime IAP, we receive from Apple a confirmation of your active entitlement. We do not receive your full payment information — Apple handles that. We use the entitlement only to unlock Pro features in your app instance.

2.4 Authentication and account identifier

Spark uses Sign in with Apple for cloud sync. Authentication is fully optional: you can use the full life counter, Battle Book and all local features without signing in. When you choose to sign in we collect, on Apple's behalf:

• Apple's stable opaque user identifier — a randomized UUID issued by Apple specifically for Spark, not your real Apple ID.
• The display name you choose to share at first sign-in. You can edit or replace it at any time in Settings.
• An optional username (e.g. @xavi) that you pick yourself, used as a public-facing handle for cross-account features.

We never receive your real Apple ID email unless you explicitly choose to share it. Apple defaults to a private relay address ([email protected]) that forwards mail to your inbox without exposing your real address.

If you do not sign in, no account data is stored on our servers and your data never leaves your device.

You can sign out at any time in Settings. You can permanently delete your Spark account and all server-side data associated with it via Settings → Danger zone → Delete account.

2.5 What we do NOT collect

Spark does not collect:

• Your real name, email, phone number, or any direct identifier (beyond the optional username you pick).
• Your location.
• Contacts, photos, or any other on-device data outside the App.
• Advertising identifiers (IDFA).
• Health, financial, or biometric data.
• Browsing history or analytics outside Spark itself.

We do not use third-party advertising networks, tracking SDKs, or analytics providers that profile users across apps.

3. How we use your information

We use the information collected for the following purposes:

• Core functionality: maintain your Battle Book history, calculate stats, and compute Rankings (when applicable).
• Cloud sync (Pro feature): synchronize your match history, Friends, and Playgroups across your devices via Supabase, our backend provider.
• Commander artwork: fetch card images from Scryfall to display alongside your matches.
• Service delivery: validate your Spark Pro subscription via Apple StoreKit.

We do not sell, rent, or share your data with advertisers, data brokers, or any third party for marketing purposes.

4. Data storage and processing

• On-device: all your data is stored locally on your iOS device using Apple's SwiftData framework.
• Supabase (cloud sync, Pro only): if you have an active Spark Pro subscription, your data is also synchronized with Supabase Inc. (a U.S.-based hosting provider). Supabase processes data on our behalf under a Data Processing Agreement and stores it in encrypted form at rest and in transit (TLS 1.2+).
• Scryfall: when you search for or display commander cards, the App fetches card data from Scryfall.com (a public Magic: The Gathering database). Scryfall has its own privacy policy: scryfall.com/docs/privacy-policy
• Apple StoreKit: subscription transactions are processed by Apple under Apple's Privacy Policy: apple.com/legal/privacy

5. Data retention

• Local data: retained on your device until you delete the App or manually remove individual matches.
• Free tier: only the 5 most recent matches you create as a Free user are kept. Older Free matches are automatically deleted in LIFO order. Matches created while you held a Spark Pro entitlement are preserved indefinitely.
• Pro tier: matches you create while subscribed to Spark Pro are kept indefinitely (and preserved if you later cancel your subscription).
• Recently Deleted: deleted matches are kept for 90 days before permanent removal, allowing recovery.
• Cloud copies (Pro): synchronized data on Supabase is retained as long as you maintain an active Spark Pro subscription. Upon cancellation, cloud data is preserved for 90 days, then deleted.

6. Your rights

You have the right to:

• Access: view all your data directly within the App (Battle Book, Friends, Playgroups, Settings).
• Delete: remove individual matches, profiles, or playgroups from within the App. Deleting the App removes all local data immediately. Signed-in users can permanently delete their account and all server-side data via Settings → Danger zone → Delete account.
• Cloud data deletion (Pro users): contact us at [email protected] to request full deletion of your synced cloud data. We will respond within 30 days.
• Data portability (Pro users): request a JSON export of your data via the Battle Book (Export option) or by emailing [email protected].
• GDPR / CCPA: if you are a resident of the European Economic Area or California, you have additional rights including objection to processing and lodging a complaint with your local supervisory authority.

7. Children's privacy

Spark is rated 4+ in the App Store. The App does not knowingly collect personal information from children under 13. The data we do collect (gameplay state, free-text player names) is created by the user during play and not analyzed or used for profiling.

If you believe a child under 13 has provided personal information to us, please contact [email protected] and we will delete the information immediately.

8. Security

We protect your data using industry-standard measures:

• All cloud communication uses TLS 1.2 or higher.
• Cloud data at rest is encrypted by Supabase using AES-256.
• Local data is protected by iOS sandboxing and Apple Data Protection (encrypted when device is locked).
• Authentication uses Sign in with Apple — we never see your real Apple ID credentials.

No method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

9. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the latest revision. Material changes will be communicated through an in-app notice the next time you open Spark. Continued use of the App after changes constitutes acceptance of the updated policy.

10. Contact

For privacy questions, data deletion requests, or any other inquiry related to this policy:

Spark is not affiliated with, endorsed, sponsored, or specifically approved by Wizards of the Coast LLC. Magic: The Gathering, the Magic logo, and Commander are trademarks of Wizards of the Coast LLC. Card images and database information used in Spark are sourced from Scryfall, a fan-run service, in accordance with the Wizards of the Coast Fan Content Policy.