Privacy Policy

1. Scope & Data Controller

This Privacy Policy explains how BeBulbed Spark ("Spark," "we," "us," or "our") collects, uses, and protects information in connection with Spark's website and application (the "Service"). Spark is the entity responsible for information collected through the Service. See Section 2 for who "Spark" refers to during our current Beta period.

Spark is operated independently of BeBulbed's corporate holding entity, which is not a co-controller or processor of Spark's user data and does not have standing access to it. If you are looking for BeBulbed's own Privacy Policy for the bebulbed.com corporate website, it is published separately, on bebulbed.com.

If you are located outside Australia, please also review the applicable page in our Regional Disclosures hub, which supplements - but does not replace - this Policy.

2. Pre-Incorporation & Beta Notice

This Beta service is operated by BeBulbed Spark (ABN 79 434 618 910) pending formal ASIC company registration. Upon ASIC registration, all contracts, user terms, intellectual property licenses, and data controller obligations under this Policy will automatically assign to the newly registered proprietary limited company without requiring additional user notice or consent.

3. Information We Collect

We collect the following categories of information:

Account information you provide, such as your name, email address, and password (stored as a salted hash, never in plain text);
Content you post, including posts, comments, and Trusted Circle collaboration content, handled according to the visibility-based rules described in Section 7 and in our Terms of Service;
Avatar images you choose to upload, handled according to the specific pipeline described in Section 4;
Device and usage information, such as IP address, browser or app version, and general usage patterns, used to operate and secure the Service; and
Organization and workspace information, if you join or administer an organization on Spark.

4. Avatar & Image Handling

Spark takes an unusually strict approach to profile photos, because ordinary phone photos routinely carry hidden metadata - including exact GPS coordinates - that most platforms never remove.

When you upload an avatar, the image is processed entirely in memory on our servers. We do not simply strip metadata as a configurable setting - our pipeline decodes your image, crops and resizes it, and then re-encodes it from scratch into a brand-new file. Because the intermediate format our servers use to represent your image has no concept of location, camera, or device metadata at all, none of that original metadata can survive into the file we actually store - it isn't filtered out, it's structurally incapable of coming along. Files that aren't genuine, supported image formats, or that declare unreasonably large dimensions, are rejected outright before any of your original file is processed further. We never store or transmit your original, unprocessed file, and the upload is never sent anywhere except directly to our own servers.

5. How We Use Information

We use the information above to operate the Service - including displaying your content according to the visibility you choose, powering peer evaluation, enabling organization workspaces, and keeping the Service secure. We do not use third-party advertising networks or third-party analytics trackers, and we do not use your content to sell advertising.

6. Cookies & Local Storage

Spark's marketing website (spark.bebulbed.com, outside the app itself) does not use cookies, third-party trackers, or advertising pixels of any kind. The only client-side storage it uses is a single, first-party preference - your Light / Dark / Auto display theme choice - which never leaves your device and is never used to identify or track you. Because there's no non-essential tracking technology to consent to, we don't show a cookie banner on the marketing site.

The Spark application itself does not use cookies for authentication - it uses header-based token authentication, with your session token held in your device's secure storage rather than a browser cookie. Any strictly necessary session-handling storage the app uses is limited to what's required to keep you signed in and is never used for advertising or cross-site tracking.

7. Trusted Circle Data

Content posted within a Trusted Circle is visible only to you and the collaborators you specifically invite. We exclude Trusted Circle content from public feed ranking, aggregate analytics, and any model training. Access to Trusted Circle content is limited to you, your named collaborators, and is logged for security purposes.

8. Australian Privacy Principles & Legal Bases

Spark's primary privacy framework is the Privacy Act 1988 (Cth) and the Australian Privacy Principles ("APPs") - Spark's home-jurisdiction privacy standard, applied to all users regardless of location. We also seek to align our practices with other major privacy frameworks, including the GDPR and CCPA, for the benefit of visitors from those jurisdictions, as detailed in our Regional Disclosures hub.

Where a specific legal basis for processing is required by applicable law, we rely on: performance of our contract with you (to provide the Service), our legitimate interests (such as security, abuse prevention, and improving the Service), your consent (where we ask for it, such as for optional communications), and compliance with legal obligations.

We do not sell your personal information. We share information only with:

Cloud infrastructure providers (Google Cloud Platform, including Cloud Run and Cloud Storage) that host the Service and process data solely on our behalf, under contractual confidentiality and security commitments;
Apple, solely as the Apple Push Notification service ("APNs") for iOS devices, to deliver a content-free "wake" signal that prompts the app to securely retrieve your actual notification content directly from our own servers. Apple never receives post content, comment text, sender identity, or any other content - only an opaque notification identifier, a generic alert unrelated to what happened, and the timing of a delivery attempt. We do not use Firebase Cloud Messaging, Google Cloud Messaging, or any other third-party push provider, and Android devices are not currently sent push notifications at all - the app instead refreshes notifications automatically while open;
Google and Apple, solely as identity providers, when you choose to authenticate using Sign in with Google or Sign in with Apple. In that case, the provider you chose confirms your identity and, depending on the permissions you grant during that sign-in, may share your name and email address with us to create or access your account. We do not use these providers to track you across other companies' apps or websites, and we do not share your Spark content or activity with them;
Other users, to the extent you choose to make content visible to them (public feed, organization workspace, or Trusted Circle); and
Law enforcement or other parties, where required by law or necessary to protect the rights, property, or safety of Spark, our users, or the public.

We do not use third-party advertising networks or data brokers.

10. Data Security

We maintain technical and organizational measures designed to protect your information, including: in-memory processing and re-encoding of uploaded images (Section 4); server-side validation of every uploaded file's actual content, not just its claimed type; independent, automated re-verification of stored files after upload, as a defense-in-depth measure; and administrative access to backend systems restricted to authorized personnel through a separately authenticated administrative system, isolated from the public-facing Service. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Data Retention & Deletion

We retain your information for as long as your account is active, and as needed to provide the Service. If you delete your account, we remove your profile and disassociate your identity from your past contributions. Where a contribution is part of a discussion thread others have built upon, we may retain the thread in anonymized form (with your authorship attribution removed) so the surrounding conversation remains coherent for other participants, rather than deleting content out from under other users' own contributions. Trusted Circle content you delete, or that is deleted upon account deletion, is removed from all circle participants' access.

12. Where We Process Your Information

Spark's home jurisdiction is Australia, and our production infrastructure is hosted on Google Cloud Platform's Australia (australia-southeast1) region - meaning the Service is, in practice, operated and your data processed within Australia by default, not routed offshore as a matter of course. One processor we rely on necessarily operates outside Australia by its nature: Apple's global Push Notification service (APNs), used only to deliver the content-free wake signal described in Section 9 to iOS devices - never notification content, sender identity, or academic data - under Apple's own contractual and technical safeguards as a data processor. If you are located outside Australia, transferring your information to us in Australia for processing may itself constitute an international transfer under your home jurisdiction's law - see the applicable page in our Regional Disclosures hub for jurisdiction-specific detail.

13. Children's Privacy

The Service is not directed to, and is not intended for use by, anyone under the age of 16. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact us using the details in Section 16 and we will take appropriate steps to delete it.

14. Your Rights

Consistent with the Australian Privacy Principles, you have the right to know how we collect, hold, use, and disclose your personal information, to access the personal information we hold about you, and to request correction of information you believe is inaccurate, out of date, incomplete, irrelevant, or misleading. You can exercise many of these rights directly within your account settings, or by contacting us using the details in Section 16. If you remain unsatisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC). Jurisdiction-specific statutory rights for visitors outside Australia - including how to exercise them and any applicable response timelines - are detailed in our Regional Disclosures hub.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated "Last updated" date, and where changes are significant, we will provide additional notice before they take effect.

16. Contact

Questions about this Privacy Policy, or requests relating to your personal information, may be directed to privacy@spark.bebulbed.com. This address is specific to Spark and is separate from BeBulbed's own privacy contact.