Privacy policy

The app has no account, registration or log-in, and it never asks for your name, email address or phone number. It contains no analytics, advertising, tracking or crash-reporting tools. The only information that reaches us from the app or your controller is the technical data described below, which we use only to provide badge designs and firmware updates, and to keep our servers secure and working (see Server logs in Part 3). We never sell it, and share it only as described in this policy.

The app connects only to our own server, api.sparkbadge.com, and only to read public information:

• When you connect a controller, it downloads the current list of supported badge designs.
• To check for firmware updates, it sends your controller's firmware and hardware version numbers. Nothing else is sent.

Like every internet request, these reach our server with your phone's IP address and standard technical details, such as the type of app making the request. The app sends no identifier for you, your phone or your controller, and we do not use these requests to identify or track anyone.

The app talks to your SparkBadge controller directly over Bluetooth. Colors, effects, presets and other settings travel only between your phone and your controller, and are never sent to us. Badge names stay on your phone.

While powered, your controller broadcasts a Bluetooth name that includes its network hardware address (MAC address), so the app can find it. Phones and other Bluetooth devices nearby can see this name, but it contains no information about you.

To show you a list to choose from, your controller scans for nearby Wi-Fi networks and sends their names, signal strength and security type to the app over Bluetooth. The list appears on your phone only and is never sent to us.

You pick a network and enter its password. The app sends them only to your own controller, over Bluetooth, and never to us. With current firmware, the controller keeps them in memory only, never in its permanent storage, and they are gone when it restarts.

During an update you start, the controller connects through your Wi-Fi to our update server (iot.sparkbadge.com). It sends its hardware and firmware versions, its network hardware address (MAC address) and how long it has been powered on, then downloads the new firmware. Like any internet request, this also reaches our server with the public IP address of the network you chose. Our server uses only the hardware version, to pick the right firmware, and does not store your controller's MAC address, firmware version or power-on time. Like all requests to our servers, the update request appears in our standard request logs (see Part 3). Current controller firmware does not connect to the internet at any other time.

• Bluetooth and nearby devices: to find, connect to and control your controller. While scanning, the app looks only for SparkBadge controllers.
• Location (Android only): the app asks for it together with Bluetooth. On Android 11 and earlier, Android also requires it for Bluetooth scanning. On all versions, the app uses it to read the name of the Wi-Fi network your phone is on, so that network appears first in the update list. The app never reads your GPS position or tracks where you are.

On iPhone, the app asks only for Bluetooth. You can turn any permission off at any time in your phone's settings, but features that need it, such as finding your controller, will stop working.

The app keeps these on your phone only: the controller you paired (its Bluetooth name and identifier) and when it last connected, your presets, last look and badge names, favorite effects, display settings, install guide progress, and the last Wi-Fi network you saved (Remember on this phone is on by default). None of it is uploaded, so we have nothing to keep or delete.

When you enter a Wi-Fi password, Remember on this phone is checked, so the app saves the password in your phone's secure storage (the iOS Keychain, or on Android, encrypted with a key held in the Android Keystore) and the network's name in the app's own storage, and you do not have to type the password again. Uncheck it before connecting if you do not want it saved. The app keeps one saved network and replaces it when you save a different one.

Tapping Disconnect removes the paired controller's name and identifier. Its presets, last look, badge name and last-connected time stay on your phone until you uninstall the app, which deletes them.

The app and your controller talk to our servers only over encrypted HTTPS connections. Our servers' standard request logs are covered in Part 3.

What you send us through a form or by email:

• Orders: your name, email, phone number, delivery method, shipping address (when shipping), province, payment choice, order notes and the items in your cart.
• Support requests: your name, email, topic, order number (optional) and message.
• Badge requests: your email, the badge you want, where it goes and, optionally, your vehicle and a reference link.
• Emails: anything you send to customerservice@sparkbadge.com, including photos you attach.
• Interac e-Transfers: the sender name, email address, amount and memo that your bank sends us with the payment.

With each order, support request or badge request, our server also receives your IP address and technical details from your browser: browser type, version and maker, language settings, operating system, screen and window size and pixel density, time zone, the page you were on, the page that linked you there, the time you sent it, how long the form was open before you sent it, and whether you passed the bot check. We use these details only to block spam and fraud and to fix problems with the forms, and we keep them with your order or request for the same period.

You do not need an account to shop, and we do not offer one.

• To confirm, invoice and deliver your order, or arrange pickup.
• To handle warranty claims and returns.
• To answer your questions.
• To decide which badges to build next and plan their design.
• To email you when a badge you requested ships, and only about that badge.
• To tell you when shipping to the USA opens, if you asked us to.
• To protect our forms from spam, bots and fraud.
• To keep the business records that Canadian tax law requires.

We do not send newsletters or marketing emails, and we never sell or rent your information.

We do not keep a customer database. Our server briefly queues each order, support request or badge request in its database, sends it as an email to our order or support inbox, and then removes it from the queue. That email is our record. If an email cannot be sent, the submission stays in the queue until we resend or delete it.

These service providers help us:

• Amazon Web Services (AWS): hosts this website, our servers and product images, and delivers the form emails.
• Our email provider: hosts the inbox where orders, requests and emails are kept.
• Canada Post: receives your name and address when we ship your order.
• Cloudflare: its Turnstile check confirms that a real person, not a bot, is submitting. It loads when you open the checkout, support or badge-request page, runs in your browser and receives your IP address and information about your browser and device. Our server sends Cloudflare your IP address again when it checks the result.
• Google Fonts: this site's fonts load from Google, which receives your IP address and browser details when your browser downloads them.

AWS, our email provider and Canada Post handle your information only on our behalf, to provide their service to us. Cloudflare and Google also process what they receive under their own terms; see Cloudflare's privacy policy and Google's privacy policy. We share information with anyone else only when the law requires it.

We do not accept card payments yet, and this website never collects payment card details. You can pay by Interac e-Transfer from your own bank, or in person at pickup (cash or e-Transfer). An e-Transfer shows us the sender's name, email address, amount and memo.

We do not use analytics, advertising cookies or tracking pixels, and our site sets no cookies. Your cart is saved in your browser's local storage so it is still there when you come back, and a copy is kept in session storage while you check out, which your browser deletes when you close the tab. Both are removed when you place the order, and you can clear them yourself at any time. Cloudflare Turnstile may use its own browser storage to check that you are not a bot.

When you tap +1 Request on a badge, we store a scrambled one-way code (a hash) made from your IP address and a secret key, along with the badge and the date and time. This lets each internet connection (for example, one household) vote once per badge. The vote record does not include your IP address itself or anything else about you.

• Orders: up to 7 years, for tax and warranty records.
• Support requests and other emails: up to 2 years, unless they are part of an order record.
• Badge requests: up to 2 years, or sooner once we have told you the badge has shipped.
• Vote records: until that badge's demand-board entry is deleted from our system.

After that, we delete the information.

Every page and form on this site is served over HTTPS, so what you send is encrypted in transit. Only the people on our team who need your information can access it. No system is perfectly secure, but we take reasonable steps to protect what you share with us.

We are based in Alberta, Canada. Our servers (including api.sparkbadge.com and iot.sparkbadge.com, which the app and your controller use) are hosted by Amazon Web Services in the United States (Northern Virginia), and this website is delivered through Amazon's worldwide network. Our email provider, Cloudflare and Google may also store or process information in the United States and other countries outside Canada. There, it may be accessible to courts, law enforcement and national security authorities under local law.

Our servers keep standard request logs: the IP address, browser, app or controller details, the time and the address requested. We use them only for security and troubleshooting, never to identify or track anyone, and keep them only as long as those purposes need.

You can ask to see the personal information we hold about you, correct it or have it deleted, unless the law requires us to keep it, as with order records for tax purposes. You can also withdraw your consent at any time; if you do, we may not be able to complete an order or answer a request. Email customerservice@sparkbadge.com and we will reply within 30 days.

If you are not satisfied with our answer, you can contact the Office of the Information and Privacy Commissioner of Alberta, the Office of the Privacy Commissioner of Canada or, if you live in Quebec, the Commission d’accès à l’information du Québec.

The app and this website are not directed at children under 13 (under 14 in Quebec), and we do not knowingly collect their information. If you believe a child has sent us information, email customerservice@sparkbadge.com and we will delete it.

If we change this policy, we will post the new version on this page, update the revision date and add a short note at the top describing what changed.

SparkBadge is a brand of EctoIT Inc., a Canadian corporation based in Edmonton, Alberta. Our Privacy Officer is responsible for how we handle personal information and answers all privacy questions, requests and complaints.

Privacy Officer, EctoIT Inc., Edmonton, Alberta, Canada
customerservice@sparkbadge.com (subject: Privacy)