Legal
Privacy Policy
Who we are
Sparkmas is operated by Anchored Development Co. ("ADC", "we", "us", or "our"), a sole proprietorship registered in Nova Scotia, Canada. We build thoughtful software for real families.
Email: [email protected]
Website: sparkmas.ca
What information we collect
Account information
When you create an account, we collect your name and email address via Firebase Authentication (Google). If you sign in with Google, we receive only the name and email you have permitted Google to share. If you sign in with email and password, we receive the email you provide. We do not store raw passwords.
App content you create
- Gift Tracker data — gift recipient names, gift descriptions, purchase status, and budget amounts you enter into the tracker.
- Advent Calendar progress — which days you have opened (1–24), stored so the app remembers your progress across sessions.
- Elf on the Shelf idea history — the AI-generated Elf placement ideas you have received and saved to your memory book log.
Photos uploaded to Decor AI
When you use the Decor AI feature, you may upload a photo of your home. This photo is transmitted directly to our AI sub-processors (Anthropic and OpenAI, described below) for processing and is not permanently stored by Sparkmas beyond the time needed to generate your results. We do not retain your home photos after your Decor AI session ends.
Payment information
All payment processing is handled by Freemius. We do not collect, see, or store your credit card number, banking details, or payment credentials. Freemius handles all payment data under their own privacy policy.
Automatically collected information
- Authentication tokens — managed by Firebase Authentication to keep you signed in. These are stored in your browser's local storage.
- Usage data — we may collect aggregate, anonymised data about feature usage to improve the product. This data is never linked to your identity.
What we do NOT collect
- We do not collect GPS location or device location data.
- We do not run third-party advertising networks or tracking pixels.
- We do not sell, rent, or trade your personal information to any third party.
How we use your information
We use the information we collect to:
- Provide and operate the Sparkmas service.
- Authenticate your identity and secure your account.
- Save and sync your Gift Tracker data, Advent Calendar progress, and Elf idea history across sessions.
- Transmit your uploaded photos to our AI sub-processors (Anthropic, OpenAI) to generate Decor AI suggestions.
- Send transactional emails such as account confirmations and password resets.
- Improve and debug the service using aggregated, anonymised data.
We will only send you marketing emails if you have opted in. You can unsubscribe at any time.
Third-party services we use
Sparkmas relies on the following third-party services to operate. Your data may be processed by these services in data centres outside Canada, including in the United States. Each provider is contractually required to handle your data in accordance with applicable privacy laws.
| Service | Purpose | Privacy policy |
|---|---|---|
| Firebase / Google | Authentication and Firestore database (user data storage) | policies.google.com/privacy |
| Cloudflare | Web hosting, CDN, and Cloudflare Workers (AI proxy) | cloudflare.com/privacypolicy |
| Anthropic (Claude API) | AI text generation for Elf on the Shelf ideas and Decor AI decoration text suggestions | anthropic.com/privacy |
| OpenAI (Images API) | AI image transformation for Decor AI (processing uploaded home photos) | openai.com/policies/privacy-policy |
| Freemius | Subscription billing and payment processing (Merchant of Record) | freemius.com/privacy |
A note on AI processing: When you use Elf on the Shelf ideas or Decor AI, your prompts and/or photos are transmitted to Anthropic or OpenAI through a secure Cloudflare Worker proxy. We do not expose API keys to your browser, and your content is used solely to generate your results. We do not use your content to train AI models, and we do not permit our AI providers to use your data for training under our API agreements.
Cookies and local storage
Sparkmas uses browser local storage and session cookies solely for authentication purposes — to keep you signed in between sessions. We do not use advertising cookies, cross-site tracking cookies, or analytics cookies that identify you personally.
Data retention
We retain your personal data for as long as your account is active or as needed to provide the service. If you delete your account, we will delete or anonymise your personal data within 30 days, except where we are required by law to retain it longer (for example, billing records required for tax purposes).
Decor AI photos are not retained. They are processed in transit and discarded after your session results are returned.
Your rights under PIPEDA
As a Canadian resident, you have the following rights regarding your personal information:
- Access — request a copy of the personal information we hold about you.
- Correction — request that inaccurate personal information be corrected.
- Deletion — request deletion of your account and associated personal data.
- Withdraw consent — withdraw consent to the collection or use of your personal information, subject to legal or contractual restrictions.
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.
Users in other jurisdictions (including the EU/UK and California) may have additional rights under GDPR, UK GDPR, or CCPA. We will honour those rights to the same standard.
Children's privacy
Sparkmas is a family Christmas app, and we welcome families using it together. However, account holders must be at least 18 years of age (or the age of majority in their province or country) to create an account.
Family members of any age — including children — may use Sparkmas through the account holder's account with the account holder's supervision. Children do not create separate accounts and do not directly provide us with personal information.
We do not knowingly collect personal information directly from children under the age of 13. If you believe a child has provided us with personal information without a parent's or guardian's involvement, please contact us at [email protected] and we will delete it promptly.
Security
We implement reasonable technical and organisational measures to protect your personal information, including HTTPS encryption in transit, Firebase security rules restricting Firestore data to authenticated account owners, and a server-side proxy for all AI API calls. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security but we are committed to protecting your data.
Changes to this policy
We may update this policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For material changes, we will notify you by email or with an in-app notice. Continued use of the service after changes take effect constitutes acceptance of the revised policy.
Contact us
If you have questions or concerns about this Privacy Policy or how your personal data is handled, please contact:
Anchored Development Co.
Email: [email protected]
Location: Bedford, Nova Scotia, Canada