Privacy Policy

STATUS: DRAFT. This document has not been reviewed by licensed counsel. It describes how Sparkshed actually behaves today and is published so that behaviour is inspectable, but it is not legal advice and it is not a finished agreement. See the counsel review packet for what is still outstanding.

What we collect

Sparkshed is designed to be privacy-first. We collect as little data as possible to operate the service.

Page analytics: Cloudflare Web Analytics runs on our infrastructure. It does not use cookies, does not track individual users across sessions or sites, and does not collect personal data (IP addresses are not logged for analytics purposes).

Product telemetry: If you tell us you are 13 or older, we count anonymous events (e.g., 'design generated', 'quest completed') to understand how the product is used. These events contain no personal information — no names, no email addresses, no IP addresses, no device fingerprints.

Account data: If you create an account, we store the information you provide (email, display name). We never sell or share your data with advertisers.

Project data: Your circuit designs are stored locally in your browser by default. If you publish a design to the community, the design and your display name become publicly visible.

What we don't collect

We do not track your browsing across other websites.

We do not use cookies for advertising or tracking.

We do not collect biometric data, location data, or device fingerprints.

We do not read your files, contacts, or other browser data.

Children's privacy (COPPA)

If you tell us you are under 13, telemetry never fires and account sign-in is not offered, so nothing you build can be uploaded — your projects stay in your browser (IndexedDB). Viewing public community content (a shared feed) is read-only and sends no personal information.

We do not knowingly collect personal information from children under 13 without verifiable parental consent. If you believe your child has provided personal information through our service, contact us and we will delete it promptly.

For classroom use, we comply with FERPA requirements. Student data is accessible only to the teacher who created the classroom, and students use anonymous handles by default.

How we protect your data

All data is encrypted in transit (HTTPS) and at rest (encrypted database).

Project data is local-first: your designs stay in your browser's IndexedDB storage until you explicitly share or publish them.

We use Cloudflare's infrastructure, which is SOC 2 Type II, ISO 27001, and PCI DSS certified.

Your rights

You can export all your project data at any time (BOM CSV, pick-and-place CSV, KiCad netlist, firmware source).

You can delete your account and all associated data by contacting us. Deletion is permanent and irreversible.

You can opt out of telemetry by not consenting at the age gate, or by clearing your browser's localStorage.

For GDPR/CCPA requests (access, deletion, portability), contact privacy@sparkshed.dev.

Data sharing

We do not sell, rent, or trade your personal information.

When you ask the Genie to design something, the text of your request is sent to our server and on to a third-party AI provider (such as Anthropic or OpenRouter) to generate the design. Don't put personal information in a design request; we don't use your requests to train models.

When you order parts through our partner links (PCBWay, DigiKey, Mouser), you are redirected to their websites. Their privacy policies apply to those transactions.

We may share anonymized, aggregate usage statistics publicly (e.g., '10,000 designs generated this month'). No individual user data is included.

Contact

For privacy questions or data requests: privacy@sparkshed.dev