1. What we collect

We collect the minimum needed to run Firefly Spark safely and reliably.

Account and profile

• Name, username, date of birth or age range (to confirm 18+ or 19+)
• One profile photo that you upload
• Pronouns (optional)
• Languages (optional)
• Contact info such as email and, if you provide it, phone
• Verification status

App usage and preferences

• Spark categories you select
• Distance or radius per category
• Time windows and availability
• Age or gender group preferences and group size comfort
• Spark actions such as holds, joins, cancels, late or no show outcomes
• Lumins deposits and refunds

Location (with permission)

We collect device location when you allow it. We use it to:

• show nearby Sparks
• auto confirm arrival at or near the venue around start time
• provide simple proximity signals to your Spark group shortly before start

We do not show your exact coordinates to other users.

Device and technical

• Device identifiers
• Operating system, app version, language, time zone
• Crash logs and performance events
• IP address for security and anti abuse

Communications

• Messages you send to us (support, safety reports)
• In app messages where storage is needed to deliver the service and support safety and moderation

Payments, subscriptions and Lumins purchases

• We receive purchase confirmations from Apple or Google, including product identifier, currency and amount
• We do not receive or store your full payment card details
• For auto renewing subscriptions, Apple or Google also processes your payment and their privacy policies apply

Website cookies

If you visit our site, we may use strictly necessary cookies and optional analytics cookies (with consent).

We do not knowingly collect from children

Firefly Spark is for adults 18 and older.

2. Face data and verification

What face data we collect

• A single profile photo that you upload
• When you choose to verify, a one time selfie captured during verification

We do not collect facial data from your camera on a continuous basis. We do not collect face data for advertising.

Why we collect it

We collect and process face data in order to:

• verify that your verification selfie matches your profile photo
• prevent impersonation and fake accounts
• detect obvious fraud
• maintain community safety so that people are meeting real users

This matches the purpose stated in our Terms (safety and integrity).

Where it is stored and processed

• We do not share face data with advertisers or other third parties for marketing
• Storage and processing is handled by Amazon Web Services (AWS) in the United States
• Profile photos are stored in Amazon S3
• Verification selfies are processed one time using Amazon Rekognition to compare the selfie to your profile photo. After the comparison, the verification selfie is discarded

This means the comparison happens on AWS infrastructure and the result is what we keep.

How long we keep it

• Verification selfie: deleted immediately after the one time comparison is completed
• Profile photo: retained until you replace it, delete it, close your account, or request removal

We honor deletion requests for profile photos within 30 days.

We still keep a small verification record (for example date, success or failure, and the reason code) so we can defend the integrity of the platform.

3. Why we collect information

We use your information to:

Provide the service

Create and manage your account, show nearby Sparks, process holds and auto joins, manage Lumins deposits and refunds, reveal profiles 1 hour before start, auto confirm arrival by location, and unlock paid participation features if you have an active subscription.

Safety and integrity

Verify accounts, detect and prevent fraud, impersonation or duplicate accounts, investigate safety reports, and enforce our Terms of Service.

Improve the product

Troubleshoot, analyze features, measure reliability, and develop new features.

Communicate with you

Send transactional notifications such as invites that match your settings, roster changes, auto join, late or no show outcomes, account changes, and support responses.

Marketing (consent based)

Send optional tips and updates. You can opt out at any time.

Legal compliance

Comply with law, respond to lawful requests, and protect our rights and users.

We do not sell your personal information.

4. What we share and with whom

We share only what is needed to operate Firefly Spark.

Service providers (processors)

• Cloud hosting and storage: AWS (including S3 and Rekognition, located in the United States)
• Maps and location: Apple or Google Maps
• Notifications: Apple and Google push services
• Analytics and crash reporting: standard mobile analytics
• Payments and subscriptions: Apple App Store and Google Play Store

These providers are contractually required to use the data only to provide services to us.

Your Spark members

Your name and photo are shown only to other members of your Spark starting about 1 hour before the start time. They are not shown to everyone on the platform.

No sharing of face data for ads

We do not share face data, selfies, or profile photos with advertisers or ad networks.

Legal and safety

We may disclose information if required by law or if we believe it is necessary to protect the rights, safety, or property of Firefly Spark, our users, or the public.

Business transfers

If we are involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will continue to protect your data and notify you of material changes.

We do not share your exact live location with other users. If we show pre start proximity, we show it as simple distance bands to confirmed members.

5. How long we keep information

We keep information only as long as needed for the purposes above, then delete or de identify it.

• Profile photo: kept until you replace it, delete it, close your account, or ask us to delete it. We aim to honor deletion requests within 30 days.
• Verification selfie: deleted immediately after the one time comparison in AWS Rekognition.
• Verification record (pass/fail): we keep a small record of the verification result and timestamp for fraud prevention and audit.
• Account and profile: for your account’s life. Deleted on account deletion, subject to legal retention.
• Location pings for attendance: detailed arrival pings up to 30 days. De identified analytics may be kept longer.
• Spark metadata (holds, joins, penalties): while your account is active plus up to 2 years for fraud prevention and audit.
• Support tickets and safety reports: 2 to 7 years depending on type and legal hold.
• Logs and analytics: 90 to 365 days depending on type.
• Backups: periodic backups roll off on a set schedule (typically 35 days or less).

If law requires longer retention, we retain only what is necessary.

6. Where we store and process data

Firefly Spark and its service providers may store or process information outside your province and outside Canada, including in the United States. This includes storage in AWS in the United States for profile photos and for the one time verification comparison.

We use contractual and technical safeguards to protect personal information when it is transferred across borders. By using the service you understand your information may be processed in other countries and may be available to local authorities under their laws.

7. Security

We use industry standard safeguards to protect personal information. This includes encryption in transit and at rest where appropriate, access controls, and least privilege access. No system is perfectly secure. If we learn of a breach that creates a real risk of significant harm, we will notify you and the appropriate regulators as the law requires.

8. Your rights under Canadian law

Under PIPEDA you have the right to:

• access the personal information we hold about you
• correct inaccurate information
• withdraw consent for future processing where processing is based on consent
• challenge our compliance with PIPEDA
• file a complaint with the Office of the Privacy Commissioner of Canada at https://www.priv.gc.ca

To exercise your rights, contact us at hello@fireflyspark.io. We may need to verify your identity. If we cannot fulfill a request, for example because it would reveal another person’s information or is subject to legal privilege, we will tell you why.

You may also have rights under provincial privacy law if it applies.

9. Marketing and CASL

We comply with Canada’s Anti Spam Legislation (CASL). We send transactional messages that are required to run the service. We send marketing messages only with your consent or as permitted by law. You can unsubscribe at any time in app or by emailing hello@fireflyspark.io.

10. Children

Firefly Spark is for adults 18 and older. We do not knowingly collect personal information from individuals under 18. If we learn an account belongs to someone under 18, we will delete the account and its information.

11. Automated decision making

We use basic automation to match Sparks to your preferences, to run auto join when a Spark hits its minimum, and to detect obvious abuse. We do not make decisions that produce legal or similarly significant effects solely by automated means. You can change your settings at any time.

12. Third party links and services

The app may link to third party sites or services such as venues, ticketing, or maps. Their privacy practices are governed by their own policies, not ours.

13. Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will notify you in app or by email and update the effective date. If you continue to use Firefly Spark after the changes take effect, you agree to the updated Policy.