Spark Privacy Policy

Last updated: May 5, 2026

This Privacy Policy describes how Spark ("the App", "we", "us", or "our") collects, uses, and protects your information when you use our iOS application.

1. Who we are

Spark is a life counter and match history app for the Magic: The Gathering Commander format. The App is developed and operated by Xavi Saucedo Martín, a sole developer based in Spain.

Contact: privacy@sparkmtg.org

2. Information we collect

2.1 Match and gameplay data

When you play a game with Spark, we record:

• Match metadata: start/end timestamps, game duration, number of players, game mode (Commander/Normal), starting life total, winner.
• Per-player state: life totals, commander damage received, poison counters, energy/experience/radiation counters, eliminations.
• Player names: the names you assign to each player in the pre-game setup. These can be free-text or selected from your saved Friends list.
• Commander selections: the commander cards you assign to players (sourced from the public Scryfall database).
• Game events: a chronological log of life changes, combat phases, eliminations, and other in-game actions used to build the Battle Book timeline.

2.2 Friends and Playgroups

If you create Friends profiles or Playgroups, we store:

• Friends: the display names you provide.
• Playgroups: group name, ranking-enabled flag, list of member Friend IDs.

2.3 Subscription data

If you subscribe to Spark Pro or purchase the lifetime IAP, we receive from Apple a confirmation of your active entitlement. We do not receive your full payment information — Apple handles that. We use the entitlement only to unlock Pro features in your app instance.

2.4 Anonymous identifier

Spark assigns each app installation an anonymous Supabase user identifier (a UUID) used solely to associate your synced data with your device. This identifier is not linked to your Apple ID, email, name, or any other personally identifiable information.

Note for v1.0 with Cross-Account Linking: when Feature A (Cross-Account Player Linking) ships, Sign in with Apple replaces the anonymous identifier. We will receive only Apple's stable opaque user identifier and the display name you choose at sign-in. We will never receive your real Apple ID email unless you explicitly share it. This section will be updated when that feature is released.

2.5 What we do NOT collect

Spark does not collect:

• Your name, email, phone number, or any direct identifier.
• Your location.
• Contacts, photos, or any other on-device data outside the App.
• Advertising identifiers (IDFA).
• Health, financial, or biometric data.
• Browsing history or analytics outside Spark itself.

We do not use third-party advertising networks, tracking SDKs, or analytics providers that profile users across apps.

3. How we use your information

We use the information collected for the following purposes:

• Core functionality: maintain your Battle Book history, calculate stats, and compute Rankings (when applicable).
• Cloud sync (Pro feature): synchronize your match history, Friends, and Playgroups across your devices via Supabase, our backend provider.
• Commander artwork: fetch card images from Scryfall to display alongside your matches.
• Service delivery: validate your Spark Pro subscription via Apple StoreKit.

We do not sell, rent, or share your data with advertisers, data brokers, or any third party for marketing purposes.

4. Data storage and processing

• On-device: all your data is stored locally on your iOS device using Apple's SwiftData framework.
• Supabase (cloud sync, Pro only): if you have an active Spark Pro subscription, your data is also synchronized with Supabase Inc. (a U.S.-based hosting provider). Supabase processes data on our behalf under a Data Processing Agreement and stores it in encrypted form at rest and in transit (TLS 1.2+).
• Scryfall: when you search for or display commander cards, the App fetches card data from Scryfall.com (a public Magic: The Gathering database). Scryfall has its own privacy policy: scryfall.com/docs/privacy-policy
• Apple StoreKit: subscription transactions are processed by Apple under Apple's Privacy Policy: apple.com/legal/privacy

5. Data retention

• Local data: retained on your device until you delete the App or manually remove individual matches.
• Free tier: only the 5 most recent matches you create as a Free user are kept. Older Free matches are automatically deleted in LIFO order. Matches created while you held a Spark Pro entitlement are preserved indefinitely.
• Pro tier: matches you create while subscribed to Spark Pro are kept indefinitely (and preserved if you later cancel your subscription).
• Recently Deleted: deleted matches are kept for 90 days before permanent removal, allowing recovery.
• Cloud copies (Pro): synchronized data on Supabase is retained as long as you maintain an active Spark Pro subscription. Upon cancellation, cloud data is preserved for 90 days, then deleted.

6. Your rights

You have the right to:

• Access: view all your data directly within the App (Battle Book, Friends, Playgroups, Settings).
• Delete: remove individual matches, profiles, or playgroups from within the App. Deleting the App removes all local data immediately.
• Cloud data deletion (Pro users): contact us at privacy@sparkmtg.org to request full deletion of your synced cloud data. We will respond within 30 days.
• Data portability (Pro users): request a JSON export of your data via the Battle Book (Export option) or by emailing privacy@sparkmtg.org.
• GDPR / CCPA: if you are a resident of the European Economic Area or California, you have additional rights including objection to processing and lodging a complaint with your local supervisory authority.

7. Children's privacy

Spark is rated 4+ in the App Store. The App does not knowingly collect personal information from children under 13. The data we do collect (gameplay state, free-text player names) is created by the user during play and not analyzed or used for profiling.

If you believe a child under 13 has provided personal information to us, please contact privacy@sparkmtg.org and we will delete the information immediately.

8. Security

We protect your data using industry-standard measures:

• All cloud communication uses TLS 1.2 or higher.
• Cloud data at rest is encrypted by Supabase using AES-256.
• Local data is protected by iOS sandboxing and Apple Data Protection (encrypted when device is locked).
• We do not store or transmit passwords; authentication with Supabase uses anonymous session tokens.

No method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

9. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the latest revision. Material changes will be communicated through an in-app notice the next time you open Spark. Continued use of the App after changes constitutes acceptance of the updated policy.

10. Contact

For privacy questions, data deletion requests, or any other inquiry related to this policy:

Spark is not affiliated with, endorsed, sponsored, or specifically approved by Wizards of the Coast LLC. Magic: The Gathering, the Magic logo, and Commander are trademarks of Wizards of the Coast LLC. Card images and database information used in Spark are sourced from Scryfall, a fan-run service, in accordance with the Wizards of the Coast Fan Content Policy.