Privacy policy
Most of what Sparkplot Studio does happens in your own browser. This page explains exactly what leaves your device, who receives it, and how long we keep it.
“We” and “us” means [TO DECIDE: company legal name and address], the operator of Sparkplot Studio. Questions: [contact email].
1. What stays in your browser
These features run on your device. The file or data is not uploaded to our server to make them work:
- Opening CSV and Excel files. Files are read and profiled in the browser.
- Drawing charts, maps and tables, and exporting PNG, SVG and ZIP files.
- PDF reports (made with your browser’s print dialog) and the LinkedIn carousel PDF.
- Chart videos (MP4/WebM) and their soundtracks.
- Tableau workbooks and Power BI kits.
- Google Sheets in the Studio. Your browser reads the sheet as CSV directly from Google. The sheet’s contents don’t pass through our server when you connect or refresh it in the Studio. (Scheduled report emails are different; see section 2.)
- The “Palette from logo” tool. Your logo is analyzed in the browser.
- “Sketch to chart” without AI. The instant rule-based reader runs in the browser.
If you use the Studio without an account, your current project and brand kits are kept in your browser’s own storage (IndexedDB and localStorage) on your device, not on our server. Clearing your browser data removes them.
2. What we store on our server
Your account
- Email address, the name you give us (optional), your plan (Free or Pro) and when you signed up.
- Your password, stored only as an argon2id hash. We can’t read your password.
- A session: when you log in we set a cookie that keeps you logged in for 30 days. On our side we keep only a hash of that cookie, with its expiry date.
- AI usage counts: how many AI requests you made each day, so we can apply the daily limit.
Saved projects
When you’re logged in, your projects save automatically. A saved project currently includes your data (the rows from your file or sheet), along with your charts, edits, report, story and, if connected, the Google Sheet link. Only you can open your projects: every request is checked against your account. If you don’t want a dataset stored with us, use the Studio while logged out.
Brand kits
Brand kits are saved to your account, including any logos and font files you upload and any font or logo picked up by “Build my kit from my website”. Fonts and logos are private to your account.
Scheduled report emails
If you schedule a report for a project connected to a Google Sheet:
- We store the schedule: frequency, time zone, recipient email addresses, subject line and your note.
- At send time our server reads the sheet from Google (unlike the Studio, where your browser reads it) and rebuilds the charts. We don’t keep a copy of the sheet.
- We store the chart images (PNG) used in each email for 180 days, so the email can display them. They are served from a hard-to-guess link, so anyone who has the email can see them. After 180 days they are deleted.
- We store the latest numbers for each chart so the next email can say what changed.
- We keep a short send log (when, status, how many emails) and a list of recipients who unsubscribed.
Published charts, stories and embeds
When you click Publish, the page is stored on our server and is public to anyone who has the link, including anywhere you embed it. A published chart contains the numbers it shows and a “Get the data” download of those values. A scrolling story contains its charts and the text you wrote. Publishing works without an account too; pages published while logged out can’t be linked back to an account.
3. AI features (Anthropic’s Claude)
AI features are optional and only run when you use them. When they run, our server sends the following to Anthropic, the company that makes Claude, and returns the answer to you. We don’t send your email address or account details with these requests.
| Feature | What is sent to Anthropic |
|---|---|
| Ask AI for a chart | What you typed, and a summary of your columns: names, types, number of rows and distinct values, minimum and maximum of number columns, and up to 5 example values from each text, date or category column. Not the full rows. If a text column holds names or other personal details, those examples could include them. |
| Sketch to chart (AI reading) | The image of your drawing or photo (resized in your browser), plus the same column summary as above. Photos are sent when you upload them while logged in; drawings only when you press “Read with AI”. |
| Fix an ugly chart | The screenshot you upload. |
| Sharpen headlines | For each chart: its title and subtitle, the column names it uses, the labels and aggregated values it shows (for example monthly totals), and totals, highs, lows and changes. |
| LinkedIn carousel copy (Pro) | The same chart facts as headlines, plus the project name and the client name from your brand kit. |
| Build my kit from my website | The site name, its theme color and a list of candidate colors we found. Not the page text. |
| Chart roaster (free tool, no account) | The chart screenshot you upload. We don’t store roast images. |
Anthropic processes this data under its commercial terms. [TO DECIDE: confirm and state Anthropic’s data retention and training terms for our API account, and link them]
4. Other services we use
- Stripe handles payments and the billing portal. You enter card details on Stripe’s pages; we never see or store your card number. We store your Stripe customer ID, and Stripe tells us whether your subscription is active.
- Email delivery (Resend or Postmark), if we’ve set one up, receives each scheduled report email: the recipient’s address, subject and content including chart images.
- Website fetches for “Build my kit from my website.” Our server visits the web address you enter (and its stylesheets, logo and Google Fonts files) to find your logo, colors and fonts. Results are cached in memory for about 10 minutes.
- Google. Your browser reads Google Sheets directly from Google. Our pages also load fonts from Google Fonts, so Google receives your IP address and browser details when a page loads.
- Hosting. [TO DECIDE: name the hosting provider (e.g. Railway, Fly.io or Render) and what it logs]
5. Cookies and browser storage
sp_session: keeps you logged in for 30 days. It’s HttpOnly (page scripts can’t read it). This is the only cookie we set.- IndexedDB and localStorage in your browser hold your current project, brand kits and small settings (such as having dismissed a tip).
- We don’t use advertising or analytics cookies. Stripe sets its own cookies on its checkout and billing pages.
6. IP addresses and rate limits
To prevent abuse we use your IP address to limit sign-up attempts, website brand fetches and chart roasts, and your email address to limit login attempts. These counters are kept in the server’s memory and reset when it restarts. They aren’t written to our database.
7. Deleting your data
- You can delete any project from “My projects”.
- Delete account (in the account menu, needs your password) permanently removes your account, sessions, saved projects, brand kits (including uploaded logos and fonts), AI usage counts, report schedules, send logs and unsubscribe lists.
- Not removed by account deletion today: published pages (they stay online at their links) and chart images from report emails already sent (deleted after 180 days). To take a published page down, contact us. [TO DECIDE: whether account deletion should also take down published pages; this needs a code change]
- Backups: [TO DECIDE: backup schedule and how long deleted data stays in backups]
8. Your rights
You can see, change and delete your projects and kits in the app, and delete your account at any time. For anything else, such as a copy of your account data or a correction, email [contact email]. Depending on where you live (for example the EU, UK or California) you may have further rights under local law. [TO DECIDE: which laws we commit to, legal basis for processing, EU/UK representative if required, and how we transfer data internationally]
9. Children
Sparkplot Studio is a business tool and isn’t meant for children. [TO DECIDE: minimum age, e.g. 16 or 18]
10. Security
Passwords are hashed with argon2id, session cookies are HttpOnly, and every project request is checked against your account. No system is perfectly secure, and we don’t hold security certifications such as SOC 2 or HIPAA. Please don’t upload data you aren’t allowed to share with a service like ours.
11. Changes
If we change this policy, we’ll update the date at the top and tell account holders about significant changes by email or in the app. [TO DECIDE: notice period]