Privacy Policy

• Account information — your username, optional display name, and a securely hashed password. We do not store your password in plain text.
• Learning activity — assessment answers, scores, progress, streaks, exam and Gauntlet results, and the learning paths you create.
• Coach conversations — the messages and commands you send to the AI coach, and its responses, so we can deliver and improve the feature.
• Your provider API key (BYOK), if you add one — stored encrypted and used only to call your AI provider on your behalf (see Section 5).
• Technical data — a session cookie to keep you signed in, plus standard log data such as IP address, browser type, and timestamps.
• Payment data — when you subscribe, billing is handled by our payment processor. We receive limited information such as your plan and payment status; we do not store your full card number.

• to provide, personalize, and improve the Service;
• to power assessments, courses, the AI coach, certifications prep, and progress tracking;
• to operate accounts, subscriptions, leaderboards, and team features;
• to maintain security, prevent abuse, and enforce our Terms;
• to communicate with you about your account or the Service.

To power the coach, the content of your coaching messages (and relevant context such as the track and lesson you’re on) is sent to a third-party AI model provider to generate responses. We do not sell this content. If you supply your own API key, requests are made using that key under your own provider account and are subject to that provider’s privacy practices.

We use a small number of cookies that are necessary to operate the Service—primarily to keep you signed in. We do not use third-party advertising cookies.

If you choose to add your own AI provider API key, we encrypt it at rest using authenticated encryption (AES-256-GCM) and use it solely to make requests to that provider on your behalf. We never display the full key back to you, and you can remove it at any time from your account settings, which deletes it from our records.

We do not sell your personal information. We share data only:

• with service providers that help us run the Service (for example, AI model providers, payment processing, and hosting), under appropriate confidentiality obligations;
• to comply with the law or respond to valid legal requests, and to protect the rights, safety, and property of sprkd and its users;
• in connection with a business transfer (such as a merger or acquisition), subject to this Policy.

We retain your information for as long as your account is active or as needed to provide the Service. You can delete your account at any time; we will delete or de-identify your personal data within a reasonable period afterward, except where we must retain it to comply with legal obligations or resolve disputes.

We use reasonable technical and organizational measures to protect your information, including hashed passwords and encrypted storage of sensitive secrets. No method of transmission or storage is perfectly secure, so we cannot guarantee absolute security.

Depending on where you live (for example, under the GDPR or CCPA/CPRA), you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. To exercise these rights, email support@sprkd.io. We will not discriminate against you for exercising them.

The Service is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it.

We operate the Service from the United States. If you access it from outside the U.S., you understand your information may be processed in the U.S. and other countries with different data-protection laws.

We may update this Policy from time to time. We will update the “Last updated” date above and, for material changes, provide additional notice where appropriate.

Questions or requests? Email support@sprkd.io.