Who we are
Spark is a dating app for people who make things on the internet, operated by Bold Italic Studio (the "controller"). Questions and privacy requests: hello@sparked.love.
What we collect
Account: your Google account email and name, used to sign you in. We never see your Google password.
Profile: what you add — name, age and date of birth (you must be 18+), photos, role, company, city, bio, prompt answers, interests, languages, height, school, and optionally pronouns, gender, religion, drinking, smoking and family plans.
Preferences: who you want to meet, including preferred genders, age range and distance. Together with your own gender these can reveal your sexual orientation, which is why we ask for explicit consent before you fill them in.
Location: approximate coordinates you set for matching by distance, and coordinates you attach to plans you host. We do not track your device location in the background.
Activity: likes, passes, matches, messages, plan RSVPs, video-date invites, and events such as viewing a profile — used to rank who we show you (see "Matching").
AI assistant: when you use Hitch, the text it drafts for you and the request you made are kept for 30 days, then erased; the fact of usage (for credit billing) is kept.
Matching (automated ranking)
We rank candidate profiles for you using your stated preferences and behavioural signals (impressions, opens, likes, passes, replies). Each shown profile is logged with the score and policy version that ranked it. This is profiling in the GDPR sense; it selects what you see but makes no decision with legal or similarly significant effect. You can object or ask questions at any time via the contact above.
Who processes your data
Supabase hosts our database and photo storage in Tokyo, Japan (a jurisdiction covered by an EU adequacy decision).
Google provides sign-in, push notification delivery (Firebase Cloud Messaging) and the AI model behind Hitch (Gemini). When you ask Hitch to write an opener, the other person's public profile fields are included in the request to Gemini.
Vercel (US) serves the web application.
We do not sell personal data and there is no third-party advertising.
How long we keep things
Profiles, photos, matches and messages: until you delete them or your account.
Behavioural matching events: 180 days. Daily match suggestions: 60 days. Notifications: 90 days. Hitch drafts: 30 days (billing record kept). Push tokens for devices not seen in 180 days are dropped.
These windows are enforced by an automated nightly job, not by promise.
Your rights
Export: Me → Download my data gives you everything we hold on you as JSON, immediately.
Erasure: Me → Delete account permanently removes your account, profile, photos, matches, messages and behavioural data. There is no grace period and no undo.
Rectification: edit anything on your profile at any time.
You can also withdraw consent, object to profiling, or complain to your supervisory authority. Write to the contact above and we will respond within one month.
Security
Photos live in a private bucket readable only by signed-in members through expiring links. Every table is protected by row-level security. Blocking someone removes the connection in both directions and hides you from each other.