Privacy policy

SparkShare is run by SparkInc ("we"). It lets AI agents such as Claude and Codex publish posts to the social accounts you connect. This policy covers the SparkShare website, its API, the sparkshare-mcp server and agent plugins, and the SparkShare for X browser extension.

In short

• We keep what is needed to publish for you: your sign-in details, the accounts you connect, and the posts and files you send.
• We publish only what you or an agent you signed in sends us, only to the accounts you connected.
• We do not sell your data, show ads, use tracking cookies or third-party analytics, or train AI models on your content.
• You can delete your account and everything in it yourself, at any time, from the dashboard.

What we collect

Your SparkShare account

You sign in with Google. Google tells us your Google account ID, email address, name and profile picture. We do not get your Google password or any other Google data (no Gmail, Drive, Contacts or Calendar).

Accounts you connect

• LinkedIn (permissions: openid, profile, w_member_social): your member ID, name and an access token that lets us post on your profile. We do not read your feed, connections or messages.
• Facebook and Instagram (when available to you; permissions: pages_show_list, pages_read_engagement, pages_manage_posts, instagram_basic, instagram_content_publish, business_management): your Facebook user ID and name, the IDs and names of the Pages you choose, their access tokens, and the IDs and usernames of the Instagram professional accounts linked to them. We use these only to list those accounts for you and to publish to them. We do not read your friends, messages or personal profile.
• X: we do not connect to your X account and hold no X credentials. You send X posts yourself (see the browser extension below).

What you publish

The text and links of each post, the images and videos you upload, the accounts each post went to, and the result: published, failed (with the network's error message), or waiting for you on X, with the link to the published post.

Keys and sessions

API keys, including the ones created when you sign in an agent or the extension, and a session cookie for the website. We store only a one-way hash of each key and of the cookie, plus when a key was created and last used. The website session also keeps your sign-in tokens, encrypted, so the site can manage your keys for you.

Technical logs

Our servers and Cloudflare, which protects and delivers the site, record standard request data such as IP address, time and browser type. We use it for security and troubleshooting and keep it only for a limited time.

How we use it

• To sign you in and keep you signed in.
• To show you your connected accounts and post history.
• To publish each post to the accounts you or your agent chose, when you or your agent ask.
• To enforce usage limits, prevent abuse, and fix problems.
• To email you about your account or important changes to SparkShare. No marketing email without your consent.

What is public

Posts are public once a network publishes them. Your uploaded files are private: the networks, the browser extension and your dashboard get them through signed links that stop working after a few hours. A post sent to X with images also gets a share page on this site, so that X can show the image in its link preview; anyone with the link can see that page's text and image.

Who we share it with

• The networks you publish to (LinkedIn, Meta, X) receive the posts and files you send them, under their own privacy policies.
• Service providers that run SparkShare for us: our own servers and databases in the United States, Cloudflare (network protection, and file storage on Cloudflare R2), and Google for sign-in. They handle data only to provide their service.
• When required by law, or to protect the rights and safety of our users or others.
• If SparkShare is sold or merged, with the new owner, who must keep to this policy.

Your agent's provider (for example Anthropic for Claude or OpenAI for Codex) processes your conversations under its own terms. We receive only what the agent sends to a SparkShare tool, not the conversation.

The agent plugin and the browser extension

sparkshare-mcp runs on your computer. It saves its key in ~/.sparkshare/credentials.json and sends us only the posts and files your agent passes to it. Files are read from your computer only when the agent names them in a publish or upload request.

SparkShare for X (Chrome) keeps its key in the browser's extension storage. It shows the posts waiting for X, and when you choose Fill on X it opens X's compose page, puts in the text and files, and waits for you to press Post. When X confirms the post was sent, the extension reads that post's link from X's notice and reports it to SparkShare. It does not read other pages, your browsing history or your X account data, and it never presses Post for you. Its permissions: storage (the key), identity (signing in), scripting and access to x.com (filling in the post), access to this site (the API and the post's files) and to our sign-in service at hub.apimodels.app.

How we protect it

Everything travels over HTTPS. Network access tokens are encrypted at rest (AES-256-GCM); API keys and session tokens are stored only as hashes. Only our servers can reach the database. No system is perfectly secure; if a breach affects you, we will tell you.

How long we keep it

• Your account, connected accounts and post history: until you delete them.
• Uploaded images and videos: 30 days after upload, then deleted. Published posts keep their copies on the networks.
• Website sessions: 30 days. Agent and extension sign-in codes: 10 minutes, single use.
• An access token that a network revokes or that expires stops working; reconnecting replaces it.

Deleting your data

• Your whole account: in the dashboard, under Delete account. This immediately deletes your account, connected accounts and their access tokens, API keys, post history and uploaded files (removed from storage within minutes). Posts already published stay on the networks; delete them there.
• One network: choose Disconnect next to it in the dashboard. Its access tokens and accounts are deleted at once.
• On the network's side: you can also remove SparkShare there, which makes its tokens stop working. LinkedIn: Settings, Data privacy, Permitted services. Facebook: Settings, Apps and websites (or Business integrations). Then delete SparkShare's copy as above.
• On your computer: run npx sparkshare-mcp logout and remove the extension from Chrome.
• Cannot sign in? Email [email protected] from the address of your Google account and we will delete your data within 30 days.

Your rights

Depending on where you live (for example under the GDPR in Europe or the CCPA in California), you can ask to see, correct, export or delete your personal data, or object to how we use it. Most of this you can do in the dashboard; for anything else email [email protected]. We answer within 30 days. You can also complain to your local data protection authority.

Our servers are in the United States. If you use SparkShare from elsewhere, your data is transferred there and protected as this policy describes.

Google user data

SparkShare's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google only to sign you in.

Children

SparkShare is not meant for anyone under 16, and we do not knowingly collect their data.

Changes

If we change this policy, we update the date at the top. If a change matters, we tell you by email or in the dashboard before it takes effect.

Contact

Questions or requests: [email protected].