Cookies and device storage
Updated 3 November 2026. Spark is operated by Ole Kristian Lillebo, enskild näringsidkare, Sweden. Contact lillebo@outlook.com.
Your choice
Optional analytics is off until you actively accept it. Rejecting analytics does not stop you using Spark. Open Cookie settings at any time to see availability, change your choice or withdraw permission. We also honour a browser Global Privacy Control or Do Not Track preference by keeping analytics off.
We use browser local storage and session storage, rather than an analytics cookie. The same consent controls apply. We do not use advertising trackers, automatic click capture or session replay.
Essential storage
These first-party entries support sign-in, actions you ask Spark to perform, and preferences you choose. They do not depend on analytics consent. Clearing them may sign you out or interrupt an unfinished action.
| Storage | Purpose | Duration |
|---|---|---|
Sign-in tokenssb-…-auth-token | Maintain your signed-in session. | SDK-managed; removed on sign-out. The browser entry has no separate fixed expiry. |
Requested Google/Apple sign-inspark.auth.oauth-return and SDK PKCE verifier | Return you to the session or workspace you were opening and securely complete the sign-in you requested. The return entry may include an invitation or room access reference. | Return context is valid for 10 minutes and consumed on callback; tab closure ends its session storage. The SDK removes the verifier after successful exchange; an interrupted verifier is replaced by a later attempt or removed by clearing site data. |
Participant and routingflutter.person, flutter.name, spark.workspace.signed-in | Remember your participant identity/display name and route returning visitors. | Until replaced, relevant account cleanup or site-data clearing; routing hint removed on sign-out. |
Chosen preferencesflutter.spark.appearance.…, flutter.spark.facilitator.profile, flutter.sessionVideo:…, flutter.sessionVoice:…, flutter.useTeamMemory:… | Apply appearance, facilitator and media choices. This does not grant microphone or camera permission. | Until changed, relevant account cleanup or site-data clearing. |
Requested session actionsflutter.spark.billingSetup:…, flutter.pendingRoomCreation:…, flutter.pendingMemory:…, flutter.pendingCommitment:…, flutter.teamMemoryFrom:… | Recover an interrupted session setup or action without duplicating it; retain explicitly selected team context. These may contain your draft/content or access information. | Pending actions removed after confirmation or definitive rejection; uncertain actions retained for recovery. No independent browser expiry. |
Privacy request referenceflutter.spark.privacy.request:… | Retry a requested privacy action safely. Passwords are not stored here. | Until confirmed completion or relevant account cleanup. |
Consent choicespark.privacy.analytics-consent | Remember acceptance or rejection, policy version and expiry. | 180 days for either choice; expired choices no longer permit analytics. |
| Browser cache | Deliver application files. | Controlled by your browser. Current Spark code does not register a service worker; an older installation may retain cached files. |
Optional product analytics
When available and accepted, we use PostHog Inc., EU Cloud to count visits, session-start clicks, signup steps, setup, creation, joining, observed session completion and opening a summary. Our legal basis is consent. A random visit identifier connects those actions within the same tab; we do not send your account or room identifier.
The payload contains only a predefined event name, random visit reference, broad surface (landing, workspace or legal) and schema/privacy flags. We exclude names, email addresses, session titles, participant content, recordings, page URLs, referrers and access links. The application does not create a person profile. Handling an erasure request may require a temporary provider record for that random visit; we do not add your account identity to it. The network connection necessarily exposes an IP address to the provider while delivering the request; stored client IP data and GeoIP enrichment are disabled for our events.
| Storage | Purpose | Duration |
|---|---|---|
spark.privacy.analytics-visitFirst-party session storage | Random identifier generated only after acceptance. | At most 24 hours or until that tab's session ends; removed when you reject analytics or the signed-in account changes. |
The Spark project has a one-month event-retention window. Older events are deleted at PostHog’s next monthly cleanup, so this is not a promise of deletion exactly 30 days after collection. Cookie settings shows whether optional analytics is currently available and your current choice. When analytics is paused, no events are sent by the site.
EU Cloud stores event data in Frankfurt. PostHog is a US company and authorised processing or subprocessors can involve international transfers under its data-processing terms and applicable safeguards. EU hosting is not a promise of EU-only processing. See PostHog's privacy notice.
Withdrawing consent and requests
Rejecting analytics stops future collection and removes the current local visit identifier. It does not automatically erase events already delivered. While analytics is accepted, Cookie settings shows the current visit reference. Save that reference if you want to request access or erasure of those events; we cannot match an anonymous visit to your account or email. We will review requests even if you do not have the reference.
If storage is blocked, analytics stays off. A failed attempt to save a changed choice is shown in the controls; if a previous acceptance cannot be overwritten, clear Spark's site data in your browser before reloading. See Privacy and data requests for your rights and contact details.
Other providers
If you choose Continue with Google, Google authenticates your account and shares the identity information needed for your Spark sign-in. Spark does not receive your Google password. Google applies its own privacy policy. Apple sign-in will appear only when configured.
Payment checkout, connected services and browser permissions have their own interfaces and policies when you choose to use them. This notice describes Spark's first-party device storage and product analytics; it does not claim those separate provider flows have all been audited.