Privacy Policy

Spark to Story (“the Service”) is operated by Derek Tran (“we,” “us,” “our”), based in Los Angeles, California, United States. For privacy inquiries, contact us at privacy@sparktostory.ai.

Account Information (Identifiers)

When you sign in with Google OAuth, we receive your name, email address, and profile picture. We use this information to create and manage your account and to communicate with you about the Service.

Content You Create (User-Generated Content)

We store content you create within the Service, including story plans, character profiles, chapter drafts, worldbuilding documents, and associated metadata. This content is stored in our database solely to provide the Service to you.

Usage Data (Internet Activity)

We collect basic analytics data including page views, referrer URLs, browser type, and device type. This data is collected via Cloudflare Web Analytics, which does not use cookies, does not track users across sites, and does not collect personally identifiable information. IP addresses are processed by Cloudflare for delivery but are not stored or made available to us.

Information We Do Not Collect

We do not collect financial information, precise geolocation, biometric data, or sensitive personal information as defined by the CCPA/CPRA.

We process your information for the following purposes:

• Provide the Service — storing your content, authenticating your identity, and serving the application (legal basis: contract performance)
• AI-assisted features— sending portions of your content to Anthropic’s Claude API to generate writing suggestions, edits, and plans (legal basis: contract performance)
• Service improvement — analyzing anonymized usage patterns to improve the product (legal basis: legitimate interest)
• Communication — sending service-related notices such as security alerts or policy changes (legal basis: legitimate interest)
• Security — detecting and preventing abuse, fraud, and unauthorized access (legal basis: legitimate interest)

When you use AI-assisted features (writing, editing, outlining, planning), portions of your content are transmitted to Anthropic’s Claude API for processing. This is necessary to provide the core functionality of the Service.

No training on your work.We do not use your content to train, fine-tune, or improve any AI or machine learning model. Under Anthropic’s commercial API terms, API inputs and outputs are not used for model training. Anthropic retains API logs for up to 30 days for safety and abuse monitoring purposes, after which they are deleted.

What is transmitted. Only the content relevant to the specific AI operation is sent (e.g., a chapter outline, character profile, or draft text). Your entire account data is not transmitted in bulk.

We use the following third-party services to operate the Service. Each processes data on our behalf under appropriate data processing agreements:

• Google — Authentication via OAuth. Receives: name, email, profile picture. Subject to Google’s Privacy Policy.
• Anthropic — AI content generation and editing. Receives: portions of your story content as needed for AI features. Subject to Anthropic’s Privacy Policy.
• Supabase — Database and authentication infrastructure (PostgreSQL, hosted in the United States). Stores: all account data and content. Subject to Supabase’s Privacy Policy.
• Vercel — Application hosting and serverless functions (United States). Subject to Vercel’s Privacy Policy.
• Cloudflare — Web analytics (cookie-free) and CDN. Subject to Cloudflare’s Privacy Policy.

We do not sell your personal information. We do not sell, rent, or share your personal information with third parties for marketing or advertising purposes. We do not engage in cross-context behavioral advertising.

We may disclose your information only in the following circumstances:

• With the third-party service providers listed above, as necessary to operate the Service
• When required by law, regulation, subpoena, or legal process
• To protect the rights, property, or safety of our users, ourselves, or the public
• In connection with a merger, acquisition, or sale of assets (you will be notified of any change in data controller)

We retain your information for the following periods:

• Account information (name, email, profile picture) — retained while your account is active and for 30 days after deletion request
• Your content (stories, plans, characters, worldbuilding) — retained while your account is active; deleted within 30 days of account deletion
• Usage analytics — aggregated and anonymized; individual data points are not stored by us (processed by Cloudflare)
• AI processing logs — retained by Anthropic for up to 30 days per their data retention policy, then deleted
• Authentication session data — expires when you sign out or after the session timeout period

We may retain certain information longer where required by law (e.g., tax records, legal claims, or regulatory obligations).

Depending on your jurisdiction, you may have some or all of the following rights regarding your personal information:

All Users

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your account and associated data
• Export your content at any time

California Residents (CCPA/CPRA)

• Right to know what personal information is collected and how it is used
• Right to delete personal information
• Right to correct inaccurate personal information
• Right to opt out of the sale or sharing of personal information (we do not sell or share your information, so there is nothing to opt out of)
• Right to non-discrimination for exercising your rights

We honor Global Privacy Control (GPC) signals. California residents may also designate an authorized agent to make requests on their behalf.

European Economic Area Residents (GDPR)

• Right of access (Art. 15)
• Right to rectification (Art. 16)
• Right to erasure / right to be forgotten (Art. 17)
• Right to restriction of processing (Art. 18)
• Right to data portability (Art. 20)
• Right to object to processing (Art. 21)
• Right to withdraw consent at any time, where consent is the legal basis
• Right to lodge a complaint with your local data protection supervisory authority

Other U.S. State Residents (Virginia, Colorado, Connecticut, and others)

Residents of states with comprehensive privacy laws (VCDPA, CPA, CTDPA, and similar) have rights to access, correct, delete, and port their data, and to opt out of targeted advertising, profiling, and sale of personal data. We do not engage in targeted advertising or profiling.

How to exercise your rights. Contact us at privacy@sparktostory.ai. We will respond within 30 days (GDPR) or 45 days (CCPA). We may ask you to verify your identity before processing your request.

Your data is stored and processed in the United States by our service providers (Supabase, Vercel, Anthropic). If you are located outside the United States, your data will be transferred to and processed in the United States.

For transfers from the EEA, we rely on: (a) the EU-U.S. Data Privacy Framework, where our sub-processors are certified participants; and (b) Standard Contractual Clauses (SCCs) as approved by the European Commission. You may request a copy of the applicable transfer mechanism by contacting us.

We implement reasonable technical and organizational measures to protect your information, including:

• Encryption in transit (TLS/HTTPS for all connections)
• Encryption at rest (Supabase PostgreSQL with AES-256 encryption)
• Access controls and authentication via Google OAuth
• Infrastructure security provided by SOC 2 compliant sub-processors (Supabase, Vercel)

No method of transmission over the Internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

In the event of a data breach that affects your personal information, we will notify affected users by email without unreasonable delay and no later than 72 hours after becoming aware of the breach (as required by GDPR), or within the timeframe required by applicable state law. We will also notify relevant supervisory authorities where required by law.

Essential cookies only. The Service uses essential cookies for authentication session management (e.g., Supabase auth tokens). These are strictly necessary to operate the Service and cannot be disabled.

No tracking cookies. We do not use advertising cookies, tracking pixels, or cross-site tracking technologies. Cloudflare Web Analytics is entirely cookie-free.

Cloudflare CDN. Cloudflare may set a functional cookie ( __cf_bm) for bot management purposes. This cookie is strictly functional and does not track users for advertising.

The Service is not directed at children under the age of 13 (or 16 in the EEA). We do not knowingly collect personal information from children under these ages.

If we discover that we have collected personal information from a child under the applicable age, we will promptly delete that information and terminate the associated account. If you believe a child has provided us with personal information, please contact us at privacy@sparktostory.ai and we will take immediate action.

The Service uses AI as an assistive writing tool at your direction. We do not use automated decision-making or profiling that produces legal effects or similarly significant effects on you. All AI features are tools that you choose to use, and you retain full control over whether to accept, modify, or reject AI-generated suggestions.

We do not collect, use, sell, or share your personal information or content for the purpose of training large language models or other AI systems. Your stories, characters, and creative works are yours alone and are never used as training data.

We may update this Privacy Policy from time to time. For material changes, we will notify you by email or prominent notice within the Service at least 30 days before the changes take effect. Continued use of the Service after the effective date constitutes acceptance of the revised policy.

Previous versions of this policy are available upon request.

For privacy-related questions, requests, or complaints, contact us at:

Derek Tran
Spark to Story
privacy@sparktostory.ai

If you are in the EEA and believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection supervisory authority.