Privacy Policy

This policy describes only the data flows that exist in our code: which columns land in our database, which requests are forwarded to third parties, and which computations never leave your browser. We do not write disclaimers for features we do not have.

1. What we store in the database

• The account: e-mail (your login name), nickname, avatar URL, and an optional phone number. Passwords are stored as one-way bcrypt hashes (cost 12) — nobody, including our own support, can recover them; they can only be reset.
• Login security: the IP address of your most recent sign-in.
• Usage traces: favourites, tool history, and data you explicitly saved inside a tool (seating plans, timetables). These are linked to your account only after you sign in.
• Money: point balance and ledger, membership tier and expiry, orders (your phone number, nickname, payment QR and remark code) and the automatic reconciliation logs that include text recognised from payment screenshots.
• Abuse prevention: when a referral link is opened we record the visitor IP, its SHA-256 digest, User-Agent and the page visited, to detect self-referral.
• Support and administration: ticket contents and screenshots you attach; admin action logs including source IP.

We do not collect: precise geolocation (IP geolocation is city-level inference, not device positioning), contacts, photo library, clipboard contents beyond what a tool pastes inside its own page, or anything readable from browser extensions.

2. What is sent to third parties

Every item below is a real outbound request in our code. When you use these tools, what you typed leaves this site and reaches the named service.

• Baidu Analytics: its script is loaded site-wide to count visits and sources. It sends Baidu your visit information (page, referrer, device/browser characteristics) and sets its own cookies. This is the only analytics third party on the site.
• IP geolocation (My IP / IP lookup / IP map): the IP you query — your own by default — is sent to ipwho.is, falling back to ip-api.com. Results are also shown as an OpenStreetMap embed, so the coordinates you looked up appear in requests to OpenStreetMap for the frame and tiles.
• Phone number registry: the number you type is forwarded by our server to a third-party lookup API. Do not query numbers that are not yours.
• Currency conversion: only currency codes and dates are sent (open.er-api.com, api.frankfurter.dev). No personal data.
• Domain and network tools: WHOIS sends the domain to public whois servers; DNS lookups go through public resolvers (AliDNS, Google DNS); the SSL checker connects directly to port 443 of the host you name; the link-preview tool fetches the URL you supply as Spark8Bot.
• Fully local, nothing sent anywhere: text-to-speech (browser speech synthesis), Chinese script conversion (bundled OpenCC dictionaries), PDF work (pdf-lib in the browser), grade analysis, fake-data generation, date/BMI/tip math, encoding and hashing tools.

3. Cookies and local storage

• Session: one sealed cookie signed by the server, with built-in CSRF protection. It is the only proof that you are signed in — never send it to anyone, and do not keep the session on shared machines.
• Preferences and attribution: spark8_lang (language) and spark8_ref (referral source, written only when present and cleared on sign-up/sign-out).
• localStorage: some tools keep drafts and recents in your own browser so you do not retype (conversion draft, recent emojis). Clearing browser data removes them; we never read another site’s storage.

4. Retention

Account data is kept while the account exists. Orders and reconciliation logs are kept longer for accounting and dispute handling. History and tool drafts disappear as soon as you clear them. We run no automatic purge job today, which is why "delete everything on cancellation" still needs a support request (see 6).

5. What you can do yourself

• Profile: change nickname, avatar and password.
• Favourites: remove entries one by one.
• History: clear all in one action.
• Data saved inside a tool: delete it on that tool’s page.

6. Things that still need a human

Changing your e-mail or phone number, exporting all your data, and closing the account with removal of everything listed above have no self-service entry yet. Please file a request through the support bubble at the bottom-right (signed in). We act on such requests under applicable law after verifying identity.

7. Security

One-way password hashing; server-signed session cookie with CSRF checks; parameterised SQL everywhere; the database credential lives only in server environment variables and never in the repository. Transport is HTTPS. To be straight with you: no site can guarantee it will never be breached. If a breach affecting your data happens, we will say so on this page and in a site notice.

8. Children

The site is not directed at children under 14 and has no account features designed for them. If such an account was created without parental consent, ask us via support to delete it.

9. Changes

This page tracks feature changes and carries its revision date at the top. Material changes (a new third-party data flow, or different payment and refund rules) are additionally announced on the site.