Last updated September 26, 2026
Privacy Policy
This policy explains what AppSpark collects, who else touches it, and how you stay in control. It covers this website at appspark.ai and the AppSpark web app at web.appspark.ai.
The short version
- We collect what we need to run AppSpark: your account details, what you tell us about your app, the content you create, and usage and technical data.
- There are no passwords. You sign in with a one-time link we email you, or with Google.
- If you connect TikTok, we use its data only to publish the posts you approve or schedule and to show how they perform. We never sell it or use it for advertising.
- We do not sell personal information, and we do not let AI providers train their models on your content where we control that choice.
- You can access, correct, export or delete your data, and disconnect TikTok at any time.
This summary is for convenience. The full text below is what applies.
1. Who we are
AppSpark ("we", "us") operates the AppSpark website at appspark.ai, the AppSpark web app at web.appspark.ai and related services (together, the "Service"). We are the controller of the personal information described in this policy, except where we process information on behalf of a workspace (for example, content your team creates), in which case the workspace owner decides how it is used and we act as their processor.
Contact us about privacy at privacy@appspark.ai.
2. Information we collect
| Category | Examples | Source |
|---|---|---|
| Account details | Name, email address, profile photo, time zone, sign-in method | You, or Google if you sign in with Google |
| Workspace and team | Workspace name, members, roles, invitations | You and your team |
| App information | App Store, Google Play or website links, the public listing (name, description, screenshots, icon), public reviews, the brief and strategy you approve | You, and the public store or website you point us to |
| Your content | Hooks, captions, slides, templates, uploaded images and screenshots, generated posts and images | You, and content generated for you |
| TikTok data | See section 3 | TikTok, when you connect an account |
| Billing information | Plan, billing contact and address, invoices, the last four digits and expiry of your card | You and Stripe (Stripe holds your full card details, not us) |
| Usage and device data | Pages and features used, actions taken, IP address, browser and device type, approximate location from IP, error logs | Your browser and our servers |
| Communications | Support requests, feedback, email delivery and open events for essential emails | You and our email provider |
| Try-before-signup data | The link or description you enter and the sample results, before you create an account | You |
No passwords. AppSpark accounts do not have passwords, so there is no password for us to store. You sign in with a one-time link we email to you, or with your Google account.
3. Information we receive from TikTok
TikTok is the only social platform AppSpark connects to. If you connect a TikTok account, you sign in with TikTok and choose to grant us specific permissions. We request only the permissions needed to publish your posts and show their performance:
| Permission | What it lets us do | Data we receive |
|---|---|---|
| user.info.basic | Identify the account you connected and show it in AppSpark | Your TikTok open ID and union ID, display name and avatar |
| video.upload | Send posts you create to your TikTok inbox as drafts, which you finish and publish in the TikTok app | The status of each upload |
| video.publish | Publish posts directly to your profile when you choose direct posting, and show TikTok's posting options (such as privacy settings, interaction settings and posting limits) before you post | Your account's current posting options and limits, the status and ID of each post |
| video.list | Show the performance of posts published through AppSpark and check account health | The IDs, links, cover images and counts (views, likes, comments, shares) of your public videos |
We also store the access and refresh tokens TikTok issues, encrypted, so that scheduled posts can be published while you are away.
How we use TikTok data. Only to:
- connect and identify your account in your workspace;
- upload drafts and publish the content you created, approved or scheduled, with the settings you chose;
- show you the posting options and limits TikTok requires us to display before posting;
- show analytics for posts published through AppSpark, and protect your account (for example, pausing automations if a post gets zero views).
What we never do with TikTok data. We do not sell it, rent it, use it for advertising, share it with anyone outside your workspace (other than the service providers that host our systems), combine it with data from other sources to profile you, or use it to train AI models.
Retention and deletion. When you disconnect a TikTok account, we revoke our access with TikTok and delete its tokens. Post statistics are kept while your workspace exists (for up to 24 months) so your analytics stay complete, and are deleted with your workspace or on request. You can also revoke AppSpark's access at any time in the TikTok app under Settings and privacy, Security and permissions, Apps and services permissions.
4. Information we receive from Google
If you sign in with Google, we receive your name, email address and profile photo, and use them only to create and secure your account. AppSpark's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
5. How we use information
| Purpose | Legal basis |
|---|---|
| Provide the Service: accounts, workspaces, scans, strategy, writing, rendering, publishing, analytics | Performance of our contract with you |
| Process payments and manage subscriptions | Performance of contract; legal obligation (tax and accounting) |
| Send essential emails: sign-in links, security, billing, posting alerts | Performance of contract; legitimate interests |
| Send product updates and tips (you can opt out at any time) | Legitimate interests, or consent where required |
| Keep the Service secure: bot protection, rate limits, fraud and abuse prevention, spending limits on AI | Legitimate interests; legal obligation |
| Understand and improve the Service with analytics and error monitoring | Legitimate interests, or consent where required |
| Comply with the law and enforce our Terms | Legal obligation; legitimate interests |
6. How AI processing works
- To write and illustrate posts, we send the information a task needs (such as your app's description, your brief, hooks and instructions) to the AI model providers listed below. We do not send your email address or payment details.
- Providers process this data to return a result to us, under agreements that restrict their use of it. We use API offerings whose terms do not allow the provider to train models on the data we send, and we do not allow your content to be used to train third-party models where we control that choice.
- We keep short-lived samples of AI requests and responses (up to 14 days) to investigate quality and safety issues. Generated content may be screened automatically for harmful material.
8. Service providers
| Provider | Purpose | Data involved |
|---|---|---|
| DigitalOcean (United States) | Hosting, databases, file storage and content delivery | All Service data |
| Stripe | Payments, subscriptions and invoices | Billing details and payment method (held by Stripe) |
| Resend | Sending emails | Email address and email content |
| Cloudflare (Turnstile) | Bot protection on sign-in and free tools | IP address and browser signals |
| AI model providers (such as OpenAI, Anthropic, Google, Cerebras and fal) | Writing text and generating images | App details, briefs and the content you ask us to write or edit |
| Pexels | Stock photo search | Search keywords only |
| PostHog | Product analytics (when enabled) | Pseudonymous user ID and usage events |
| Sentry | Error monitoring | Technical error data and a pseudonymous user ID |
| TikTok | Publishing and post statistics, at your direction | Content you publish and your account tokens |
| Sign-in with Google | Your Google identity |
For the current list of providers and their locations, email privacy@appspark.ai.
9. International transfers
We are based in, and our main systems are hosted in, the United States. Some providers process data in other countries. When we transfer personal information from the EEA, UK or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and their UK equivalent.
10. How long we keep information
| Data | How long |
|---|---|
| Account and workspace data | While your account is active, then deleted within 30 days of deletion or termination |
| Deleted content (posts, images, templates) | Removed from the app straight away and permanently deleted within 30 days |
| TikTok tokens | Until you disconnect the account, then deleted |
| Post statistics | While the workspace exists, up to 24 months |
| Sign-in links | Expire within minutes; records deleted after 7 days |
| In-app notifications | Up to 180 days |
| Email delivery records | Up to 400 days |
| AI request samples | Up to 14 days |
| Invoices and payment records | As long as tax and accounting laws require (usually up to 7 years) |
| Backups | Overwritten on a rolling basis |
11. Security
We protect data with encryption in transit (HTTPS) and at rest, encrypted storage of platform tokens, private file storage with short-lived signed links, role-based access within workspaces, and restricted, logged access for our staff. No system is perfectly secure; if you find a vulnerability, please report it to security@appspark.ai. If a breach affects your personal information, we will notify you and the authorities as the law requires.
12. Your rights and choices
Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict certain processing, to withdraw consent, and to not be discriminated against for exercising these rights. California residents may also ask what categories of personal information we collect, use and disclose. We do not sell or share personal information as those terms are defined under California law.
- In the app: edit your profile, change notification and email preferences, disconnect TikTok accounts and delete content at any time. Under Settings, Profile you can download a copy of your data (a ZIP of your account and the workspaces you own) and delete your account; a workspace owner can delete the workspace under Settings, Workspace. Deleted workspaces are permanently removed after 30 days.
- By email: send any request to privacy@appspark.ai, including account deletion and data export. We will verify your identity and respond within 30 days (45 days where California law applies).
- Marketing emails: use the unsubscribe link in any non-essential email.
- Complaints: you can complain to your local data protection authority, though we would appreciate the chance to help first.
14. Children
AppSpark is a business tool for people aged 18 and over. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact privacy@appspark.ai and we will delete it.
15. Changes to this policy
We will post any changes on this page and update the date above. If a change is significant, we will also tell you by email or in the app before it takes effect.
16. Contact
Privacy questions and requests: privacy@appspark.ai. Everything else: support@appspark.ai.