Privacy Policy

1. Who is responsible

The controller responsible for processing your personal data is:

Christoph Lingg
C/ de Pena Santa 6, 2 C
28034 Madrid, Spain
Email: legal@lifesparks.app

I run LifeSparks as a natural person. I have not appointed a data protection officer because the law does not require one for a service of this size. For any question about your data, write to the address above or use the contact form.

2. Visiting the website

You can read all public pages of LifeSparks without creating an account and without telling me who you are. What happens technically when you do:

Hosting and server logs

The website is delivered by Firebase Hosting and the application programming interface (API) runs on Google Cloud Run, both operated by Google. Like every web server, they record each request in a log: your IP address, the date and time, the page or API path requested, the browser and operating system you use (the "user agent"), the referring page, and the response status. I use these logs only to keep the service running, to find errors, and to detect abuse. Server logs are automatically deleted after 30 days. Firebase Hosting delivers static files through Google's global content delivery network, so the server closest to you may be located outside the EU; the API and all stored data are in the EU (see section 8).

Fonts

The typefaces on this site are self-hosted: the font files are served from LifeSparks' own infrastructure together with the rest of the page. No request for a font ever reaches Google or any other third party, and no data about you is shared by loading them.

Legal basis: my legitimate interest in operating a secure, working website (Art. 6(1)(f) GDPR). No cookies or comparable identifiers are set while you browse, so no consent is needed (Art. 22.2 of Spanish Law 34/2002, LSSI-CE).

3. Creating an account and signing in

To store Sparks you need an account. Sign-in is handled by Firebase Authentication, a Google service. You can register with an email address and a password, or with your Google account.

Email and password

Your email address, your password and, if you enter one, your name are sent to Firebase Authentication. Your password is stored there in hashed form only; it never reaches my servers and I cannot see it. After you register I send a verification email containing a single-use link.

Sign in with Google

If you choose "Continue with Google", Google asks you to approve sharing your basic profile with LifeSparks and passes me your Google user ID, email address, display name and whether the email is verified. Google's own processing during that step is governed by Google's privacy policy.

What I store about your account

• a technical user ID assigned by Firebase
• your email address and whether it has been verified
• the address your Sparks and other emails go to, if you set one that differs from the address you sign in with, and a new address you asked to change to until you confirm it or the link expires (24 hours)
• your name (optional; you can change or remove it in Settings)
• your preferences: time zone, language, appearance (light/dark), reminder settings
• whether you want product news, and the record of that consent: when and where you gave it, the exact wording, and when you withdrew it
• the language your browser announced when you registered (used as the initial value of your language setting)
• the country your IP address was resolved to when you registered
• the date you registered and the date of your last sign-in

Legal basis: performance of the contract between you and me, namely providing the LifeSparks service (Art. 6(1)(b) GDPR).

Sign-in security: new-device detection

Every time you sign in, I look at your IP address and your user agent to work out whether this is a device I have seen on your account before. To do that, the IP address is sent to the geolocation service IPinfo (see section 8), which returns only the country. Your IP address and full user agent are used only in that moment and are not stored; what I keep, per device, is: a hashed fingerprint made from country, browser family and operating system family (never the browser version); the country; that same browser/OS family label on its own (e.g. "Chrome, macOS", never the full user agent string); and the first and last time that device was seen.

If the device is new and your account is not brand new, I email you a security notice with the time, the country and the device description of that sign-in, so you can react if it was not you. This notice cannot be switched off, because it protects your account.

Legal basis: my legitimate interest, and yours, in protecting your account against unauthorised access (Art. 6(1)(f) GDPR).

4. Your Sparks

A Spark is what you choose to put into it: a title, the date of the memory, and any number of pieces made of text, photos, videos or voice recordings. For each media file I also store its type, size, original file name and the time it was added. Voice recordings are made in your browser, after you grant microphone access, and stay on your device until you press "Upload".

Sparks may well contain information about your health, your relationships, your beliefs or other intimate matters. Such "special categories" of data are processed only because you deliberately write them down and ask me to keep them for you; by adding such content you give your explicit consent to its storage (Art. 9(2)(a) GDPR). You can withdraw that consent at any moment by deleting the Spark.

Where Sparks are stored and who can see them

• Text and metadata are stored in a PostgreSQL database (Google Cloud SQL) in Belgium.
• Photos, videos and audio are stored in a private Google Cloud Storage bucket in Belgium. The bucket is not publicly accessible. For each photo, a small preview copy is stored next to it to make overviews load quickly, and for each video a single still frame from it; neither carries location or camera data, and each is deleted together with its photo or video. All of it, including photos, which are resized and delivered through an image service that I run in the same Google Cloud project, is served only through signed links that expire within two days at most (at the end of the day after they were issued), so a link that leaked or was shared stops working on its own.
• All data is encrypted in transit (TLS) and at rest by Google. It is not end-to-end encrypted; when I access content, and when I don't, is set out below.
• Nobody else sees your Sparks. I do not analyse their content, do not use them for advertising, do not sell them, and do not use them to train AI models.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and, for special categories of data, your explicit consent (Art. 9(2)(a) GDPR).

Storage limit and file formats

Each account includes 10 GB of storage. To keep storage manageable, I may convert stored files into more space-efficient formats and reduce their size, within the limits set in section 8 of the Terms of Use: photos keep a long edge of at least 3,000 pixels, video is never reduced below 1080p, and audio never below 192 kbps (audio already at or below that is left as it is). The converted file replaces the original; nothing about it is shared with anyone.

When I access your content

I do not read your Sparks. There is no routine review, no scanning and no analysis of what is in them.

Your content is encrypted at rest: Google encrypts everything it stores for LifeSparks, which protects it against anyone who gets hold of the storage itself. This is not end-to-end encryption. The keys are managed within the Google Cloud project that I run, so as the operator I can technically access what is stored. I have never claimed otherwise.

I look at the content of an individual account in three cases only:

• you ask me for help with a problem that cannot be solved otherwise;
• someone affected makes a specific report about that content;
• the law obliges me to, for example a court or authority with a valid order.

In each case, I look only at what dealing with it requires.

Removal of content

If a specific piece of content breaches the rules in section 6 of the Terms of Use, I may remove or block that piece rather than close the whole account. I tell you when I do, unless the law prevents me.

Legal basis: performance of the contract, which includes these rules (Art. 6(1)(b) GDPR); a legal obligation where the law requires access or removal (Art. 6(1)(c) GDPR); and the legitimate interest of a person affected by the content in having a specific report dealt with (Art. 6(1)(f) GDPR).

5. Spark reminders and the emails I send

Smart Replay reminders

The point of LifeSparks is that your own good moments come back to you. Once you have Sparks, I send you one of them at the rhythm and time of day you choose in Settings (daily to every two weeks, or off). Which Spark you get is picked at random from those that have not been sent recently; there is no profiling and no automated decision that affects you. To make this work I keep a delivery log: which Spark was sent to you, when, through which channel, whether sending succeeded, the email provider's message ID, and the time you first opened the Spark through the link in the email. That last timestamp drives the "relived" counter on your home page and stops me from sending a follow-up email if you have already opened a Spark. You can change the rhythm or switch reminders off in Settings at any time.

Push notifications are not yet available. If a future mobile app lets you enable them, a device push token will be stored with your notification settings for that purpose.

Service and security emails

Besides Spark reminders, I send the following emails, all of which are part of running your account: a welcome message, email verification, password reset, confirmation that your password was changed, the new-device notice described above, confirmation messages to the old and the new address when you change your email, a confirmation when you delete your account, and a message with your download link when you request a copy of your data. The only optional email is product news, described next.

Product news (optional)

If you tick the box for it when you register, or later under Settings → Emails, I send you occasional product news, a few times a year at most. For this I use your email address and your name, if you have set one, for the purpose of telling you about changes to LifeSparks and what is written or said about it. To be able to show that you agreed, I store when you agreed, where (registration or Settings) and the exact sentence you agreed to, and, if you withdraw, when. These emails are sent and logged like every other email (see below).

Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by unticking the box under Settings → Emails, or with the unsubscribe link in every product-news email, which works without signing in. Withdrawing does not affect the lawfulness of the emails sent before it. It has no effect on your Spark emails, which are part of the service and are switched off separately.

How emails are sent

Emails go to the address shown under Settings → Account, which you can change there; it does not have to be the address you sign in with. Only the emails about signing in itself (verifying your address, resetting or changing your password) go to the address you sign in with. All emails are sent through Twilio SendGrid (see section 8). SendGrid receives your email address, your name if you have set one, and the content of the message. SendGrid reports back to me whether a message was delivered or bounced, and, because open and click tracking are switched on, whether and when it was opened and whether a link in it was clicked. This works through a small invisible image in the email and by routing links through a SendGrid address before they reach their destination. I keep an email log with the recipient address, the type of email, its delivery, open and click status, the provider's message ID and any error, so that I can tell whether a reminder actually reached and reached you, not just whether SendGrid accepted it. This matters because LifeSparks' core purpose, bringing a past Spark back to you, only works if the email carrying it arrives; without this I would have no way to notice a delivery problem and no way to know if the reminder feature is failing someone. It is not used for advertising, and I do not build engagement profiles from it.

Legal basis: performance of the contract for reminders and account emails (Art. 6(1)(b) GDPR); my legitimate interest in knowing whether email, the delivery channel the reminder service depends on, is actually working, and in the security of your account for security notices (Art. 6(1)(f) GDPR).

6. How the service is used

To find out what works and what doesn't, I measure how LifeSparks is used: how often Sparks are created, whether a Spark email is opened, and which settings are changed. This is data about how the service is used, not about what is in your Sparks — I measure that a Spark was created, never what it contains.

I use no third-party trackers or analytics tools for this. The figures come from the records the service already keeps to work, as described in this policy.

Legal basis: my legitimate interest in improving the service (Art. 6(1)(f) GDPR). You can object to it on grounds relating to your particular situation (Art. 21 GDPR; see section 11).

7. Contact form

When you use the contact form, I receive your message, your email address, the topic you picked and, optionally, your name and up to five attachments. To help me reproduce bugs, the form also sends the page you came from, the app version, your browser window size, time zone, browser language, chosen appearance, your user agent and your IP address. If you are signed in, your user ID and account email are attached too. The message is sent through Twilio SendGrid to a mailbox on the lifesparks.app domain, and your address is set as the reply address so that I can answer you directly. That mailbox, and the one behind legal@lifesparks.app if you write to me there instead, is hosted by ALL-INKL.COM in Germany (see section 8) — SendGrid only relays the message, it doesn't store it.

To limit spam, the server keeps the IP address of each submission in memory for ten minutes and blocks more than five messages from the same address in that window. Your message itself is never written to our database; it exists only as that one email, in the mailbox described above, for as long as I need it to handle your request before deleting it.

Legal basis: my legitimate interest in answering your enquiry (Art. 6(1)(f) GDPR) or, where the enquiry concerns your account, performance of the contract (Art. 6(1)(b) GDPR).

8. Who processes data on my behalf

I do not share your data with anyone for their own purposes. The following providers process data on my instructions as processors under Art. 28 GDPR. I have data processing agreements with each of them.

Transfers outside the EU

Where data is processed in the United States, the transfer is based on the EU-US Data Privacy Framework: Google LLC and Twilio Inc. are certified under it, which the European Commission has recognised as providing adequate protection (Art. 45 GDPR). In addition, the processing agreements with Google and Twilio include the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). IPinfo receives nothing but the IP address of a sign-in, which it answers with a country code; IPinfo states that it does not build profiles from these requests.

Apart from these processors, I disclose personal data only if I am legally obliged to, for example to a court or authority with a valid order.

9. Cookies and storage in your browser

LifeSparks sets no cookies. The app uses your browser's built-in storage for four things that are strictly necessary for it to work, and for nothing else:

• Your sign-in session, kept by the Firebase Authentication library in your browser's IndexedDB so you stay signed in. It is removed when you sign out.
• Your appearance choice (light, dark or system), kept in local storage under the key ls-theme so the page does not flash when it loads.
• The page you were heading to before being asked to sign in, kept in session storage under the key ls-redirect and cleared right after sign-in.
• Your product-news choice while you register, kept in session storage under the key ls-newsletter-opt-in until your account is created, then cleared.

None of this is used to track you, none of it is shared, and none of it needs consent under Art. 22.2 LSSI-CE or Art. 5(3) of the ePrivacy Directive, which is why there is no cookie banner. When you sign in with Google, Google's own pages may set cookies on Google's domains; that is Google's processing, not mine.

10. How long I keep data

When you delete your account, your account record, all Sparks, media files, device records, delivery logs, links, preferences and your prior email history are deleted immediately, and your Firebase Authentication account is removed. Copies in backups and restorable deleted files are gone within 30 days.

Inactive accounts

If nobody has used an account for 18 months — the site or an app opened, or a link in an email followed — and no email sent to it has been interacted with either, I write to it twice by email, at least 30 days apart and at least 30 days before anything happens. Each message has a one-click link to keep the account and a link to download everything. Only if none of this is answered are the account and everything in it deleted, in the same way as when you delete it yourself.

11. Your rights

Under the GDPR you have the right to:

• Access the personal data I hold about you and receive a copy (Art. 15).
• Rectify inaccurate data (Art. 16). Your name, email, time zone, language and reminder settings can be changed directly in Settings.
• Erase your data (Art. 17). "Delete my account" in Settings does this immediately and completely; you do not need to ask me.
• Portability: receive your Sparks and account data in a structured, machine-readable format (Art. 20). Use "Request data export" in Settings or write to me; I will send you a download link.
• Restrict processing in the cases set out in Art. 18.
• Object to processing based on legitimate interest, for example new-device detection, on grounds relating to your particular situation (Art. 21).
• Withdraw consent at any time, for example by unticking product news under Settings → Emails, or by deleting a Spark that contains sensitive content; this does not affect processing that happened before.
• Complain to a supervisory authority. In Spain that is the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es. You may also complain to the authority of the EU country where you live.

To exercise a right that you cannot handle yourself in Settings, email legal@lifesparks.app from the address linked to your account, or use the contact form. I will answer within one month, free of charge. If I cannot tell from the request that it comes from you, I may ask you to confirm it, for example by replying from your account email.

12. Security

All connections use TLS encryption. Stored data is encrypted at rest by Google. The media bucket is private and reachable only through signed, expiring links. Passwords are handled exclusively by Firebase Authentication and stored hashed. Single-use links in emails are stored as hashes only. Credentials for the infrastructure are kept in Google Secret Manager, and the database is reachable only from within the Google Cloud project. Security notices (new device, password changed, email changed) let you spot unauthorised access early. No system is perfectly secure; if a breach ever affects your data, I will inform you and the AEPD as the GDPR requires.

13. Children

LifeSparks is not directed at children. The minimum age is 16, set in section 3 of the Terms of Use. If I learn that an account belongs to someone under 16, I delete it; you can tell me through the contact form.

14. No automated decision-making

I do not make any decision with legal or similarly significant effects on you by automated means, and I do not profile you. The random choice of which Spark to send is not profiling.

15. Changes to this policy

I will update this policy when the service or the law changes. The date at the top shows the current version. If a change materially affects how your data is used, I will tell you by email or with a notice in the app before it takes effect.