Your files.
Your connection.

Version 1.0 — 16 September 2026 · Last updated 16 September 2026

This policy explains what personal data we collect when you use DroppingSparks, why we use it, who processes it for us and what rights you have. It is written for the General Data Protection Regulation (GDPR) and Dutch data protection law.

Your files never reach us.

DroppingSparks sends file contents directly between the devices you approve, over an encrypted (TLS) connection on your local network. File contents, file names and transfer history stay on your devices and never reach our server. We cannot see, scan, store or recover anything you send or receive. Nearby discovery shares only a device name and local connection details — such as a local network address and the device’s identity key — with devices on the same network, so they can find each other and you can confirm the six-digit pairing code. The app keeps its device identity, your approved friends and your transfer history on your own device.

Who is responsible.

The controller of your personal data is Lux Splendore, KvK 76428931, Gielis Beijsstraat 27B, 4813 EM Breda, Netherlands. For anything about your data, write to luxsplendore@gmail.com. We have not appointed a data protection officer; your email reaches the person responsible.

What we collect.

Account data — your email address and your password. Your password is stored only as a salted hash by Supabase, our authentication provider; we never see it.
Account and licence records — your licence status, trial status and dates, the terms version you accepted and when, and the platform you activated on.
Activated devices — the device name you or your system provides and a device identifier, so your five-device limit can work and you can remove a device.
Purchase references — from Stripe for website purchases and from Apple for App Store purchases: a payment or transaction reference, the amount, the currency and the payment or refund status. We never receive your full card details.
Support correspondence — the emails you send us and our replies.
Technical logs — connection information processed by Cloudflare when you load the website or download an installer, including your IP address, the time, the page or file requested and your browser’s user agent, used to keep the service running and to prevent abuse.

We do not collect your name, address or date of birth, we do not profile you and we take no automated decisions that have a legal or similarly significant effect on you.

Why we use it, and on what legal basis.

To give you what you signed up for — creating and running your account, your trial, your licence, device activation, downloads and purchases, and answering your support email. Legal basis: performance of a contract (Article 6(1)(b) GDPR).
To meet our legal duties — keeping payment and invoice records for tax and accounting. Legal basis: legal obligation (Article 6(1)(c) GDPR).
To keep the service safe — preventing fraud and abuse, such as accounts created to obtain repeated trials, protecting against attacks, and keeping the site available. Legal basis: our legitimate interest in a secure and working service (Article 6(1)(f) GDPR).
Recording your acceptance of the terms — proving which version of the Terms of Use and Privacy Policy you accepted. Legal basis: legal obligation and our legitimate interest in being able to show what was agreed.

Who processes it for us.

Supabase — accounts, authentication, licence and purchase records, and the confirmation and password reset emails, as our processor.
Cloudflare — hosting of this website, the installers and our server code, and protection against attacks, as our processor.
Stripe — payment processing for website purchases. Stripe is an independent controller for the payment itself and for its own fraud prevention and legal duties.
Apple — for purchases made in the App Store, Apple is the seller of record and its own controller: Apple bills you, handles refunds and applies its own privacy policy. We receive only a transaction reference and its status.
Our email provider — for the support mail you send us and our replies.

We do not sell your data, and we do not share it with anyone else, except where we must by law or to establish, exercise or defend a legal claim.

Data outside the EEA.

Some of these providers are established in, or process data in, the United States. Where that happens, the transfer is covered by an appropriate safeguard under Chapter V GDPR — the European Commission’s standard contractual clauses, in combination with the provider’s technical and organisational measures, or the EU–US Data Privacy Framework where the provider is certified. You can ask us for details of the safeguard that applies.

How long we keep it.

Account, licence and device data — until you delete your account, after which it is removed from our records.
Payment and invoice records — seven years, the statutory retention period for accounting records under Dutch tax law. These survive account deletion because the law requires it.
Technical logs — kept briefly, normally no longer than 30 days, then deleted or aggregated.
Support email — for as long as needed to handle your question and a reasonable period afterwards.

Your rights.

You have the right to ask us for access to your personal data, to have it corrected, to have it erased, to restrict how we use it, to receive it in a portable form, and to object to processing based on our legitimate interest. Where we rely on your consent, you may withdraw it at any time without affecting what happened before. To exercise any of these rights, email luxsplendore@gmail.com from your account address; we answer within one month. You can delete your account yourself at any time from inside the app. If you think we handle your data wrongly, you may complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or to the authority in your own EU country.

Children.

DroppingSparks is not for children. You must be at least 16 years old to hold an account. We do not knowingly collect data from anyone under 16; if you believe a child has an account, write to us and we will delete it.

Cookies and tracking.

This website has no advertising trackers, no analytics and no third-party marketing scripts. Your sign-in session is stored in your own browser so you stay signed in; it is technical and necessary, and it is cleared when you sign out. The desktop and mobile apps store their account tokens in the operating system’s secure storage on your device.

Security.

Transfers between devices are encrypted with TLS and each connection is confirmed by a six-digit code that you check on both screens. Passwords are hashed, the website is served over HTTPS with a strict content security policy, and access to account records is limited to our server code. No system is perfect, so keep your password to yourself and your devices up to date.

Changes to this policy.

We may update this policy as the app or the law changes. Each version carries a version number and a date. If a change is material we will tell you by email or in the app before it takes effect. This page keeps the address droppingsparks.com/privacy/.

Contact.

Lux Splendore · KvK 76428931 · Gielis Beijsstraat 27B, 4813 EM Breda, Netherlands · luxsplendore@gmail.com

Version 1.0 — 16 September 2026. See also our Terms of Use, right of withdrawal and purchase details.

Your files.Your connection.