Privacy, in plain language
Last updated 22 October 2026
PermaSpark is built to know as little about you as possible. This page explains what we collect, why, and how to get rid of it. It covers the app and this website.
This website
If you join the waitlist, we store the email address you type, the surface you signed up from (for example “hero” or a creator code), and the time. We use it to send one launch letter. We do not add you to a drip campaign, sell the list, or use advertising or analytics trackers on this site.
You can ask us to delete your waitlist entry at any time by emailing hello@permaspark.app; we will remove it within 30 days.
In the app
- Install identifier. A random ID created on your device. It is sent to our server only when you choose to start your ocean (post, resonate, launch, chat) or sign in. It is how an anonymous ocean is recognised.
- Email (optional). Only if you add one. Used to sign in, confirm the address, recover the account, and protect it from abuse. Stored as an address, never sold.
- Password (optional). Stored only as a salted PBKDF2 hash. We cannot read it.
- Content you choose to share. Display name, bio, interests, waves, rockets, comments, reports. Public content can be seen by other adults.
- Chat messages. Relayed through a short-lived queue and deleted when delivered (24-hour expiry at most). We do not keep a server-side transcript. Your own history stays on your device.
- Operational data. Request paths, status codes, and timestamps in server logs; no message bodies.
What we do not do
- No advertising SDKs, no third-party trackers, no data brokers.
- No selling or renting personal data.
- No reading of your conversations for marketing.
- No collection of precise location or contacts.
Who processes data for us
PermaSpark runs on Cloudflare (Workers, D1, KV), which processes data on our behalf under its own terms. Email delivery, when enabled, is handled by our email provider. We do not share data with anyone else except where required by law.
Retention
Account data stays while your account exists. Chat messages expire within 24 hours. Waitlist entries are deleted after the launch letter or on request. Deleted accounts are hard-deleted from our database; public posts are tombstoned so other people’s threads do not break, with the text removed.
Your choices
- Delete your account and data from Profile → Delete account, or email us if you cannot access the app.
- Export or correct your data by emailing us.
- Block and report anyone from their profile, a wave, a rocket, or a chat.
- Clear local data from Profile if you are browsing as a guest.
Age
PermaSpark is for adults, 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor is using the app, contact us and we will remove the account.
Security
Traffic is encrypted in transit. Passwords are hashed. Access to production systems is limited. No system is perfect; if we become aware of a breach affecting you, we will tell you and the relevant authorities as required.
Changes
If this policy changes materially, we will say so in the app and update the date above.