Privacy Policy

1 Information We Collect

We collect only the minimum necessary information required to operate, secure, and maintain Sparktrail:

• Account Information: Your email address, registration date, and password hash (cryptographically hashed via Django's default PBKDF2-SHA256 algorithm with individual salts).
• Profile Metadata: Optional display name, custom avatar photo, preferences, or fallback avatar emoji.
• Workspace Data: Your Sparks, Glints, custom categories (including color accents and icon selections), tags, and Markdown notes.
• Security PIN: If enabled, a cryptographically salted, PBKDF2-SHA256 hashed 4-digit PIN. Your raw PIN is never stored or transmitted to our servers in plaintext.

2 Cookies & Local Storage

Sparktrail utilizes essential cookies and browser local storage strictly to provide core functionality. This includes maintaining your active authenticated session, remembering your UI preferences (like dark mode), and managing the 15-minute sliding window for your Security PIN session. We do not use third-party tracking, advertising, or marketing cookies.

3 Data Storage & Protection

• Data Isolation: User workspace content—including Sparks, Glints, Categories, and Tags—is stored in secure database systems hosted on dedicated cloud virtual machines. Access to persistent storage volumes is restricted to authenticated internal processes and system administrators.
• Network Security & Firewalls: All network communications with our services are secured using industry-standard Transport Layer Security (TLS/HTTPS) to protect data in transit. Inbound and outbound connections to our production servers are filtered using network- and host-level firewalls, restricting public exposure strictly to standard secure web endpoints (Ports 80/443) and defending against automated network intrusions.

4 The 4-Digit PIN Vault Security Model

Sparktrail features an optional 4-digit Security PIN challenge engineered for client- and session-level confidentiality:

• Local Snooping & Shoulder-Surfing Defense: The PIN Vault provides a local security barrier designed specifically to protect your sensitive thoughts from casual onlookers when working in shared environments.
• 15-Minute Sliding Session with Full Redaction: When Vault Protection is turned on for any Spark, its title, notes, Glints, and tags are completely masked and redacted across your dashboard list, stream columns, search results, and interactive Constellation maps. Entering your 4-digit PIN starts a 15-minute sliding session window; every action you take in your workspace automatically refreshes this window. You can also manually lock your vault at any time.
• PBKDF2 Hashing Transparency: Your 4-digit PIN is cryptographically salted and hashed using PBKDF2-SHA256 before it is saved. Raw PIN digits are never stored in plaintext or written to server logs. Because PBKDF2 is a one-way hash, a forgotten PIN cannot be recovered, viewed, or decrypted by anyone—including Sparktrail administrators.
• Brute-Force Rate Limiting: Automated rate limiting prevents brute-force guessing. If 5 incorrect PIN attempts are made, the system triggers an automatic 15-minute lockout.

5 Developer Access & Server-Side Processing

We believe in complete transparency regarding how our feature set operates:

• Server-Side Processing for Core Features: To power advanced real-time tools—such as our multi-operator search engine, real-time inline Glint extraction, server-side PDF compilation, and dynamic Constellation orbit calculations—user workspace content is processed in server memory exclusively to fulfill authenticated requests. Because these operations occur on our application servers rather than client-side, content is loaded and indexed in active memory during execution.
• Strict Engineering Access Policy: Engineering personnel only access database infrastructure for essential system maintenance, operational troubleshooting, or at your explicit request to resolve technical support issues. Access is governed by strict administrative controls, and staff never browse or inspect user content without your authorization.

6 Third-Party Service Providers

We do not sell your data. We only share necessary technical data with trusted service providers to operate the platform:

• Infrastructure: Cloud compute and secure hosting facilities.
• Billing Information: Payment and recurring subscription processing is handled entirely by our PCI-compliant third-party processor, Stripe. Sparktrail never stores or has access to your credit card number, CVV, or banking credentials.
• Transactional Email: Secure providers used strictly to send password resets, account notifications, and welcome emails.

7 Data Location and Infrastructure

Your data is housed in isolated database environments on secure cloud compute instances located within the United States. All core application processing, search indexing, and persistent storage are centralized on our production servers to maintain data consistency, eliminate latency from cross-region synchronization, and minimize attack surfaces across distributed networks.

8 Data Portability, Deletion, & Retention

• Self-Serve Export: You can export your entire workspace at any time as either a tabular CSV spreadsheet or a structured Markdown document ("AI-Native Hearth Book") directly from your account settings.
• PIN-Protected Sparks: To safeguard confidential information from plaintext leakage, your 4-digit security PIN is strictly required to include any PIN-protected (Vaulted) Sparks in your export. If an export is generated while your PIN session is locked, Vaulted Sparks will have their notes and highlights redacted.
• Permanent Account Deletion: You can execute account deletion at any time. Upon deletion, your user profile, Sparks, categories, Glints, and tags are permanently and irreversibly purged from our active database tables.
• Backup Retention: For disaster recovery purposes, encrypted snapshots of our database are retained for up to 30 days. If you delete your account, your data will remain in these inactive backups until they naturally expire and are overwritten.

9 Children's Privacy

Sparktrail is not intended for use by children under the age of 13 (or 16 in certain jurisdictions). We do not knowingly collect personal information from children. If we become aware that we have collected personal data from a child without parental consent, we will take steps to delete that information.

10 Your Privacy Rights & Contact

Depending on your location, you may have the right to request access to, correction of, or deletion of your personal data. You can perform most of these actions directly within your account settings. If you need assistance, or have any questions about this Privacy Policy, please contact us at: support@geovector.dev.