Privacy Policy — Spark Couples

Last updated: 2026-05-26

This policy applies to the Spark Couples mobile app and the associated website at spark-couples.com.

The German version of this policy is the legally binding one. This English translation is provided for your convenience. In case of any discrepancy, the German text prevails. You can find it at spark-couples.com/datenschutz.

We're glad you're using Spark Couples. This policy explains which data we process, when, why, and on what legal basis. Spark handles sensitive content about your relationship and intimacy. That's why we take data protection particularly seriously and go beyond the minimum.

1. Controller and contact

The controller within the meaning of Art. 4(7) GDPR is:

Spark Couples is still being built. The app has not launched yet, and apart from the waitlist this website does not process any data.

The controller is the operator of this website. You can reach us at:

Email: hi@spark-couples.com

We will add the full controller details including postal address once business operations begin, and at the latest when the app launches. If you would like to know who is behind Spark before then, or wish to exercise any of your rights under section 11, simply write to the address above. We respond within the statutory period of one month.

2. Data protection officer

We have not appointed a data protection officer so far. Whether one is required for the operation of the app will be assessed before its launch; the app processes special categories of personal data under Art. 9 GDPR. Through this website we currently process only the waitlist signup, which involves no Art. 9 data.

For data protection enquiries, please contact us directly at the address given in section 1.

3. General information about processing

3.1 Voluntary use

Using Spark Couples is voluntary. You decide what information you enter in your profile, in challenges, in game night or in BDSM mode. Information required to enter into the contract is clearly marked (for example, your email address for the account).

3.2 Sensitive content

As part of personalization and the couple features, Spark processes information about your relationship, your intimacy, your pronouns and your sexual preferences. This data falls under Art. 9 GDPR (special categories of personal data). See section 6 for details.

3.3 Protection of minors

Spark Couples is intended exclusively for people aged 18 and over. We do not knowingly process data from minors. If you become aware that a minor holds an account, please contact us immediately.

4. Categories of data processed

4.1 Account and profile data

4.2 Couple, relationship and intimacy data (Art. 9 GDPR)

4.3 Personalization tags (Art. 9 GDPR, sensitive)

During onboarding and in the personalization wizard you can enable tags that guide our task selection. The following tags constitute special categories of personal data:

• Relationship and intimacy tags: for example `vanilla`, `playful`, `kinky`
• BDSM mode tags: for example `bondage`, `spanking`, `power_play`, `pegging`, `wax_play`, `temperature_play`
• Sensitive special tags: `cnc`, `choking`, `pee_play`, `pain_play`

These tags are processed only if you actively enable them. Enabling them constitutes explicit consent under Art. 9(2)(a) GDPR and can be withdrawn at any time. On withdrawal, the tags and any recommendations based on them are removed without delay.

4.4 Communication data

4.5 Usage data and technical logs

4.6 Payment and subscription data

We do not receive any payment credentials such as credit card numbers or bank details. Those are processed exclusively by Apple.

5. Purposes and legal bases

6. Specific notes on Art. 9 data and consent

Where you enter information in Spark Couples about your relationship, your sex life or your sexual orientation, we process special categories of personal data within the meaning of Art. 9(1) GDPR.

This processing takes place exclusively on the basis of your explicit consent under Art. 9(2)(a) in conjunction with Art. 6(1)(a) GDPR. You give this consent:

• when creating your account, via a separate checkbox ("I consent to the processing of sensitive relationship and intimacy data"),
• when enabling a sensitive tag in the personalization wizard, via a dedicated disclosure dialog,
• when enabling BDSM mode, via a second confirmation step.

We internally record the time, the text version and the account ID of each consent, so you can always trace what you consented to.

You may withdraw your consent at any time with effect for the future, without affecting the lawfulness of processing carried out before withdrawal. You can withdraw:

• in the app settings under "Privacy and consent",
• by email to hi@spark-couples.com.

After withdrawal, the affected data is deleted or anonymized without delay.

If you prefer not to have sensitive data processed in the app, you can use standard mode with non-sensitive challenges. Spark also works without sensitive tags.

7. Recipients and processors

We only share your data with third parties where this is necessary to provide our services or required by law.

7.1 Apple (Apple Distribution International Ltd., Ireland)

Subscriptions are purchased through the Apple App Store. Payment is handled exclusively by Apple Distribution International Ltd. as a separate controller. We receive information from Apple about the status of your in-app purchases, namely product identifier, purchase date, expiry date and cancellation, in order to unlock the corresponding premium features.

Apple's privacy policy is available at https://www.apple.com/legal/privacy/.

7.2 RevenueCat, Inc. (USA)

We use RevenueCat, Inc. to manage in-app subscriptions. RevenueCat processes the following data on our behalf under Art. 28 GDPR:

• a pseudonymous user ID
• information about in-app purchases made
• device-specific information
• IP address

Where RevenueCat transfers data to the USA, this is based on the EU Standard Contractual Clauses under Art. 46(2)(c) GDPR. RevenueCat's privacy policy is available at https://www.revenuecat.com/privacy.

7.3 Supabase (PostgreSQL, EU data centre)

Our app data is stored on servers operated by our service provider Supabase. The database is located in a data centre within the European Union (Frankfurt, for example Frankfurt or Dublin). Supabase processes the data exclusively on our instructions as a processor under Art. 28 GDPR. Supabase's privacy policy is available at https://supabase.com/privacy.

7.4 Apple Push Notification Service (APNs)

The app can send you push notifications if you enable them. To do so, we transmit a device-specific identifier (device token) to Apple's push service. Activation happens only with your consent via the iOS system dialog. Push message content is designed so that no sensitive details about your sex life or relationship are disclosed. For example: "A new Spark idea is waiting for you" rather than a specific task title.

7.5 Plausible Analytics (EU)

We use the analytics service Plausible Analytics for anonymous audience measurement. Plausible does not use cookies and does not store persistent identifiers. No personal data is transmitted to Plausible. The legal basis is Art. 6(1)(f) GDPR. Plausible's privacy policy is available at https://plausible.io/privacy.

7.6 Email delivery

For transactional and, where applicable, promotional emails we use Resend, Inc. (USA). For US providers, transfers are based on the EU Standard Contractual Clauses. Only the data necessary for delivery (email address, content) is transmitted.

7.7 MailerLite (waitlist on our website)

On our website you can join a waitlist to be informed about the launch of Spark Couples. To manage this waitlist and send the associated emails, we use MailerLite as a processor under Art. 28 GDPR. For users in the European Economic Area, the contracting entity is MailerLite Limited, 88 Harcourt Street, Dublin 2, D02 DK18, Ireland.

We process only:

• your email address
• your browser language code (for example "de" or "en")
• the origin of the signup (internal marker "waitlist_landing")
• the time and technical record of your confirmation

Signup uses a double opt-in procedure: after submitting the form you receive an email containing a confirmation link. Only once you confirm that link do we add you to the waitlist. Unconfirmed signups are not used for sending and are deleted after 30 days at the latest.

The legal basis is your consent under Art. 6(1)(a) GDPR. You may withdraw it at any time without affecting the lawfulness of prior processing: via the unsubscribe link in every email, or by email to hi@spark-couples.com. After withdrawal we remove your address from the waitlist. We retain the record of the consent you gave for as long as necessary to defend against claims.

We do not transmit any app data and no sensitive data within the meaning of Art. 9 GDPR to MailerLite for the waitlist. The waitlist is entirely separate from your Spark account.

Waitlist data is stored in a data centre within the European Union (Google Cloud, Netherlands). MailerLite in turn uses the following sub-processors: Google Cloud EMEA Ltd., Ireland (hosting and database operations) and Vercom S.A., Poznań, Poland (intra-group services and further development of the service). Where the affiliated company MailerLite, Inc., San Francisco, USA, has access to the data, the transfer is based on the EU Standard Contractual Clauses under Art. 46(2)(c) GDPR; MailerLite, Inc. is additionally certified under the EU-US Data Privacy Framework.

MailerLite's privacy policy is available at https://www.mailerlite.com/legal/privacy-policy, and the data processing agreement at https://www.mailerlite.com/legal/data-processing-agreement.

7.8 Authorities

We disclose data to authorities only where we are legally required to do so or where it is necessary for legal enforcement. We review every request carefully.

8. Transfers to third countries

Some processors are based in the USA or other countries outside the EEA. Specifically:

Before every third-country transfer we assess whether the level of protection corresponds to that of the GDPR, and supplement the safeguards where necessary with technical and organizational measures such as encryption and pseudonymization.

9. Retention and deletion

After you delete your account, all data not subject to a statutory retention obligation is irreversibly removed within 30 days. Data subject to a retention obligation is restricted and processed solely for that purpose.

9.1 Couple pairing after separation or account deletion

If one partner deletes their account or ends the couple link:

• couple-specific data (shared challenges, game night history) is handled as set out in our Terms (see Terms, section 11),
• each partner retains access to their own answers and notes,
• the other partner is informed via an in-app notice and by email.

10. Device access and ePrivacy

Spark does not use cookies in the traditional sense and does not store tracking identifiers on your device that are not strictly necessary to provide the services.

The following access to your device takes place:

• local app cache (authentication token, profile cache): strictly necessary
• push token (APNs): only with your consent
• Apple App Store receipt: strictly necessary for subscription validation

11. Your rights

Under the GDPR you have the following rights:

• Access (Art. 15): what we have stored about you.
• Rectification (Art. 16): correction of inaccurate data.
• Erasure (Art. 17): the right to be forgotten.
• Restriction of processing (Art. 18).
• Data portability (Art. 20): export of your data in a machine-readable format.
• Objection (Art. 21): against processing based on legitimate interests.
• Withdrawal of consent (Art. 7(3)): at any time with effect for the future.
• Complaint to a supervisory authority (Art. 77): you may lodge a complaint with the competent data protection authority. The competent authority is the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, https://www.dsb.gv.at.

To exercise your rights, contact us directly at hi@spark-couples.com. We respond within the statutory period of one month.

12. Data security

We use technical and organizational measures to protect your data, in particular:

• TLS encryption for every connection between app and server
• AES-256 encryption at rest on Supabase storage
• pseudonymization of user IDs in logs and towards processors
• row-level security in the PostgreSQL database, so that no user can see another user's data
• regular security updates and audits

There is no such thing as complete security on the internet. We do, however, work carefully and to the current state of the art to justify your trust.

13. Changes to this policy

We update this privacy policy when the legal situation, our features or our processors change. We inform you about material changes in the app and by email. The current version is always available in the app under "Settings → Privacy" and at spark-couples.com/datenschutz.

Last updated: 2026-05-26