Privacy Policy

Last updated: June 22, 2026

This Privacy Policy explains how Folsom Holdings, LLC, which owns and operates the SparkVibeAI platform at sparkvibeai.com (the "Platform"), collects, uses, and protects your information. References to "SparkVibeAI," "we," "us," or "our" in this Policy mean Folsom Holdings, LLC. Folsom Holdings, LLC is the data controller (or, where applicable, the data "business") with respect to the personal information described below.

1. Information We Collect

Account information: When you create an account, we collect your email address, username, a hashed password (bcrypt), and your plan or subscription tier.

Your work requests and specs: We collect the work requests you submit and the specifications and other outputs the Platform generates for you ("Your Content"), so we can produce, score, store, and deliver them to you.

Usage, device, and security information: We collect information about how you use the Platform and — for security and abuse prevention — your IP address, browser and device information (user agent), approximate location derived from your IP, and device or client identifiers. We use these signals to detect fraud and to enforce our one-account and one-time-trial rules (for example, to identify attempts to create multiple accounts for additional free trials).

Payment information: Payments are handled by our third-party payment processor. We do not receive or store full card numbers; we receive limited billing metadata such as your plan, subscription status, and the processor's customer reference.

Communications: Messages you send through the contact form, including your email address and message content.

Push notification data: If you enable browser push notifications, we store your push subscription endpoint and encryption keys.

2. How We Use Your Information

• To provide and maintain the Platform and to generate, score, store, and deliver specifications from your work requests
• To authenticate you and secure your account
• To process payments and manage your subscription
• To detect, prevent, and investigate fraud and abuse — including enforcing our one-account and one-time-trial rules using IP, device, and usage signals
• To send transactional notifications and emails about your account (such as security, billing, and usage events)
• To improve the Platform based on aggregate usage patterns
• To enforce our Terms of Service and comply with legal obligations

3. Information Sharing

SparkVibeAI is a single-tenant service: your work requests and specs are private to your account and are not shown to other users. Folsom Holdings, LLC does not sell your personal information. We share information only in the following circumstances:

• AI model providers: To author and score your specifications, the content of your work requests and specs is transmitted to and processed by third-party AI model providers — currently xAI, Anthropic, and OpenAI — under their respective terms, which return model outputs to us.
• Infrastructure and other service providers: We use Amazon Web Services for hosting and data storage, a third-party payment processor for billing, and Google Analytics for aggregate site-usage measurement. Each provider receives only the data necessary for the service it performs.
• GitHub (only if you connect it): If you connect a GitHub account and choose to push a spec, we use your authorization to create a repository in your account, and we store your GitHub access token (encrypted) until you disconnect.
• Legal requirements: We may disclose information if required by law or to protect the rights, safety, or property of Folsom Holdings, LLC, its users, or the public.
• Business transfers: If Folsom Holdings, LLC undergoes a merger, acquisition, financing, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you in advance via the Platform or email.

4. Data Storage and Security

Your data is stored on Amazon Web Services in the US East (Ohio) region (us-east-2). We use industry-standard security measures including:

• HTTPS/TLS encryption for all data in transit
• Encryption at rest, with AWS KMS used to encrypt sensitive tokens (such as a connected GitHub access token)
• Bcrypt password hashing (passwords are never stored in plain text)
• JWT-based authentication with token expiration
• CORS restrictions limiting API access to sparkvibeai.com
• IAM role-based access controls for infrastructure

5. Cookies, Analytics, and Local Storage

SparkVibeAI uses browser localStorage to store:

• Your authentication token (JWT) for session management
• Your email and plan for UI personalization
• An unsubmitted work request you typed, so it isn't lost if you sign in before submitting

We use Google Analytics to understand aggregate site usage, such as page views, device/browser information, and general interaction patterns. Google Analytics may use cookies or similar identifiers for measurement. We do not use analytics data to sell personal information.

6. Your Rights

• Access and portability: You can view your data through the dashboard and account pages, and export your specs (markdown export, or via the GitHub push integration on eligible plans).
• Correction: You can update your account information through the account page.
• Deletion: You can request account deletion by contacting us. We will delete your account data, except for limited records we are required to retain (such as billing records and security or admin logs) and routine backups, which are purged on a rolling basis.
• Notification preferences: You can disable push notifications through your browser settings at any time.
• Regional rights: Depending on where you live (for example, the EU/UK or California), you may have additional rights — such as to object to or restrict certain processing, to data portability, or to lodge a complaint with a regulator. Contact us to exercise any of these rights.

7. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we will remove your personal data within 30 days, except where retention is required for legal or operational purposes (for example, billing records, and security or admin-action logs).

8. Children's Privacy

SparkVibeAI is not intended for users under 18 years of age. We do not knowingly collect information from children. If we learn that we have collected information from a child under 18, we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated date. Continued use of the platform after changes constitutes acceptance.

10. Contact

Questions about this Privacy Policy? Contact Folsom Holdings, LLC at support@sparkvibeai.com or through the contact form.

Folsom Holdings, LLC is the entity responsible for the SparkVibeAI Platform and the personal information described in this Policy.