← Back to Spark

Privacy Policy

Version 2026-09-21. Last updated 21 September 2026.

This policy explains what happens to the information you give us when you join the Spark waiting list. It is deliberately short, because the waiting list collects almost nothing: a name, a mobile number, and a record that you agreed to be texted.

1. Who is responsible

The business responsible for your information — the "controller" under the GDPR and the person "carrying on an enterprise" under Quebec law — is:

• Spark
• Montreal, Quebec, Canada

Person in charge of the protection of personal information

As required by section 3.1 of Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25), Spark has a person in charge of the protection of personal information. You can reach them at:

• sprkcht@gmail.com

Write to them about anything in this policy, including any request to see, correct, or delete what we hold about you. They are the same contact for requests under the GDPR, PIPEDA, and the CCPA.

2. What we collect, and nothing else

When you join the waiting list we store exactly this:

• The name you type. So a text from us is not from a stranger.
• The mobile number you type, normalised to international format.
• Proof that you consented: the date and time you ticked the box, the version of the wording you ticked, and the page you were on. Canadian anti-spam law puts the burden of proving consent on us, so this record is what makes it lawful for us to text you at all.
• A one-way cryptographic hash of your IP address — never the address itself. We use it to stop one machine submitting the form thousands of times, and to corroborate the consent record. It cannot be reversed into an IP address.

We do not collect an email address, a date of birth, a location, a photo, or anything about your device. There are no analytics, no advertising pixels, and no third-party scripts of any kind on this site. There are no cookies — the site does not set one, and because of that there is no cookie banner to dismiss.

3. Why we collect it, and the legal basis

One purpose: to send you a text message when Spark opens, and to answer you if you write to us about it. That is the whole of it. Under Quebec law, consent must be given "for specific purposes", and this is the specific purpose.

We will not use your number to send you anything else, and we will not use it to look you up anywhere.

• Quebec (Law 25) and Canada (PIPEDA): your express consent, given by ticking an unchecked box that was presented separately from our terms.
• Canada (CASL): express consent to receive commercial electronic messages, collected at the same moment and recorded with its wording and timestamp.
• EU/UK (GDPR): consent, Article 6(1)(a).

4. Automated decisions

Section 12.1 of Law 25 requires us to tell you if a decision about you is made exclusively by automated means. None is. Joining the waiting list is not a decision about you — everyone who asks is added.

5. Who else sees it

We do not sell your information, and we never will. We do not share it, trade it, or hand it to advertisers or data brokers. Under the CCPA/CPRA we neither "sell" nor "share" personal information as those terms are defined, which is why there is no "Do Not Sell or Share My Personal Information" link on this site.

The only parties who process it are the ones who have to:

• Supabase — the database. Our database is hosted in the AWS ca-central-1 region, in Montreal, Quebec. Your name and number are stored encrypted, not as plain text.
• Vercel — serves this page. It receives the ordinary web-server request log for the page load itself; the form submission does not pass through it.
• An SMS provider, at the point we actually send the launch text. We have not chosen one yet, and this policy will name it before a single message is sent.

Information outside Quebec

Law 25 requires us to tell you that your information may be accessible from outside Quebec. Supabase and Vercel are both United States companies. Although the database itself sits in Montreal, their staff and systems in the United States may be able to access it for support and operational purposes, and United States law may compel disclosure in ways Quebec law would not.

6. How it is protected

This is the part most policies are vague about, so here is the specific answer.

• The list cannot be read from a web browser, by anyone. The public key this website carries has no permission to read the waiting list — not to view it, not to count it, not to check whether a particular number is on it. The only thing it may do is add an entry. This is enforced by database privileges, not by hiding anything in the page.
• Your name and number are encrypted at rest, with a key held separately from the data.
• The form cannot be used to find out who has signed up. It gives the identical response whether or not a number is already on the list, so it cannot be used to test numbers.
• Reading the list requires an administrative credential that exists only on the server side and never in any app or website.
• This site is served only over HTTPS.

One honest limitation, because you should not have to guess at it: encryption at rest protects against a stolen copy of the database. It does not protect against someone who legitimately holds our administrative credentials, because those credentials can decrypt. We keep those credentials to as few people as possible.

7. How long we keep it

• Your name and number: until Spark opens and we have sent the launch text, or until you ask us to delete them — whichever is first. If Spark has not launched within 24 months of your signing up, we delete the list. A waiting list for something that never arrived is not a list, it is a liability.
• The consent record: kept for three years after the last message we send you, which is the period Canadian anti-spam law expects a sender to be able to prove consent for.
• The hashed IP: the rate-limiting copy is discarded within 24 hours.

Section 23 of Law 25 requires us to destroy or anonymise information once the purpose it was collected for is achieved, and these periods are how we do that.

8. Your rights

Write to sprkcht@gmail.com for any of these. We answer within 30 days, which is the deadline under both Law 25 and PIPEDA — and we will not charge you for it.

• Withdraw consent / stop the texts. Reply STOP to any message, or email us. This is free and takes effect immediately.
• See what we hold about you.
• Correct it if it is wrong.
• Have it deleted. We will remove your entry entirely.
• Receive it in a portable format. Since 22 September 2024, section 27 of Law 25 gives you the right to get the information you gave us in a structured, commonly used technological format. We will send it as JSON or CSV, your choice.
• Complain. If we handle this badly, you are entitled to take it further, and we would rather tell you how than have you find out later:
  • Quebec: the Commission d'accès à l'information (CAI), cai.gouv.qc.ca
  • Elsewhere in Canada: the Office of the Privacy Commissioner of Canada, priv.gc.ca
  • EU/UK: your national data protection authority.

We may ask you to confirm the mobile number you signed up with before we act on a request. That is not an obstacle — it is how we avoid deleting or disclosing someone else's entry on the strength of an email.

9. If something goes wrong

Law 25 calls a breach a "confidentiality incident". If one happens and it presents a risk of serious injury to you, we are required to notify both you and the Commission d'accès à l'information promptly, and we will. We maintain a register of all such incidents, as section 3.8 requires, and keep it for five years.

10. Age

Spark is for adults. The waiting list is for people 18 or older and we do not knowingly collect information from anyone younger. If you believe someone under 18 has signed up, tell the contact above and we will delete the entry.

11. Changes

If we change this policy we will change the version date at the top. If a change affects what we do with information you have already given us — a new purpose, a new recipient, a longer retention — we will ask for your consent again rather than assume it. Continuing to sit on a waiting list is not agreement to a new use of your number.

12. Contact

Spark
Montreal, Quebec, Canada
sprkcht@gmail.com