Privacy Policy

1. Controller and contact

Ágota Téti, Arsenalstraße 8/0305, 1100 Wien, Austria, operates MoodSpark at moodspark.today and is the controller for the processing described in this policy. Email privacy or support questions to hello@moodspark.today or call +43 681 10681310.

2. Data we process

• Account data: email address, display name if supplied, authentication credentials handled by our authentication provider, and account/session identifiers.
• Your context: goals, lifestyle, care preferences, limitations, improvement areas, and any optional onboarding note.
• Check-ins and suggestions: mood, energy, available time, intent, context tags, recommended activities, ranking information, and reasons shown for recommendations.
• Your responses and rituals: completed, skipped, or unhelpful signals; optional reflections and follow-up context; personal ritual titles, instructions, durations, preferred time, links, and daily dismissals.
• Membership data: plan, status, trial and billing-period dates, access-code grants, and Paddle customer, subscription, price, and transaction-related references. MoodSpark does not receive or store full card details.
• First-party usage data: account or session identifier, event name, time, and limited event context used to understand whether key product steps work. Some event context may reflect broad check-in selections; optional reflections and ritual content are not intended to be included.
• Collaboration and support data: messages you send and, if you use the collaborator form, name, email, role, link, method description, sample content, and consent.
• Technical data: information normally generated when using a web service, such as IP address, browser or device information, timestamps, request and security logs, and error details.

Check-ins and reflections can reveal personal wellbeing information. MoodSpark uses them to provide a self-care experience, not to diagnose or provide medical care. Please avoid entering information you do not want stored, especially in optional free-text fields.

3. Purposes and legal bases

• Providing MoodSpark and your account, including tailored suggestions, feedback learning, rituals, free usage limits, memberships, and support: GDPR Art. 6(1)(b), performance of a contract or steps at your request.
• Operating, securing, troubleshooting, and improving the service, preventing misuse, and measuring whether core journeys work: Art. 6(1)(f), our legitimate interests in a safe, reliable, useful service. We balance these interests against your rights and limit the data used.
• Payment, accounting, legal claims, and compliance: Art. 6(1)(b), Art. 6(1)(c) where law requires processing, and Art. 6(1)(f) for protecting legal rights.
• Marketing measurement through Meta: Art. 6(1)(a), consent. The Meta Pixel remains off unless you accept marketing tracking, and you may withdraw consent at any time.
• Responding to collaborator submissions: Art. 6(1)(a) where the form asks for consent and Art. 6(1)(f) for reviewing and responding to the submission.

4. Recipients and service providers

• Supabase provides hosted database and authentication infrastructure used by MoodSpark.
• Lovable and its hosting/infrastructure providers provide application hosting, operational tooling, and the secured connector used for Paddle service requests.
• Paddle is the Merchant of Record and authorised reseller for purchases processed through Paddle. Paddle handles checkout, payment methods, tax, invoicing, orders, subscriptions, returns, refunds, and related buyer support under its own terms and privacy notice. MoodSpark receives the membership and order information needed to provide access. See Paddle’s privacy notice (opens in a new tab).
• Meta Platforms Ireland Limited receives website and permitted conversion events only after marketing consent. MoodSpark does not intentionally attach your email, internal account ID, check-in answers, reflections, activity content, or ritual content to these events.
• Google Fonts (Google Ireland Limited / Google LLC): every MoodSpark page loads its typefaces from Google’s font servers. When your browser downloads the fonts, Google receives technical request data such as your IP address, browser and device information, and the requested font files. No account, check-in, or ritual data is sent. This is based on Art. 6(1)(f), our legitimate interest in consistent, readable presentation. See Google Fonts privacy information (opens in a new tab) and the Google Privacy Policy (opens in a new tab).
• Google Search Console (Google Ireland Limited / Google LLC): we use this service to verify ownership of moodspark.today, submit a public sitemap, and view how the website appears in Google Search. It works through a static verification tag in the page code; it does not load a script, set cookies, or send your visits or personal data from MoodSpark to Google. The reports we see are aggregated search statistics that Google compiles from its own search service. MoodSpark does not use Google Sign-In, Google Analytics, or Google advertising tags.
• Professional advisers and public authorities may receive data where reasonably necessary for advice, legal claims, or compliance with law.

We do not sell your personal data.

5. International transfers

Some providers may process data outside Austria or the European Economic Area. Depending on the provider and processing location, transfers are protected by an adequacy decision, the European Commission’s Standard Contractual Clauses, or another safeguard permitted by GDPR. Provider locations and subprocessors can change; contact us if you would like information about safeguards relevant to your data.

6. Storage on your device and marketing tracking

Essential browser storage keeps you signed in, retains your privacy choice, prevents duplicate first-party event counting, remembers interface state, and temporarily keeps the current day’s check-in so the experience can continue. These items are needed for the requested service or our limited first-party operation and measurement.

The Meta Pixel loads only on MoodSpark’s production domains after explicit marketing consent. Before consent, MoodSpark does not request Meta’s Pixel script or send Meta a PageView. After consent, Meta may use cookies or similar storage under its own policies. Rejecting or withdrawing consent keeps future Meta tracking inactive. Cookie settings.

7. Retention and account deletion

Account, context, check-in, feedback, and ritual records are generally retained while your account remains open. You can request deletion in Account; an active paid subscription must first be cancelled through Paddle so billing is not left detached from the account. Deleting the account removes account-linked application records under our control. Limited first-party statistics may remain after the account identifier is removed. Paddle keeps its own order, tax, and payment records under its policies and legal obligations.

Collaboration and support correspondence is kept while needed to evaluate or answer it and for a reasonable follow-up period. Security logs, consent evidence, and records needed for legal claims or compliance are kept only as long as reasonably necessary for those purposes. Backup copies may remain for a limited operational cycle before deletion. We review retention and delete or anonymise data when it is no longer needed.

8. Security

We use reasonable technical and organisational safeguards appropriate to the service, including HTTPS in transit, provider-managed password protection, account-scoped database access rules, restricted privileged operations, and signed verification of Paddle billing events. No online service can guarantee absolute security.

9. Your GDPR rights

Subject to the conditions in applicable law, you may request:

• access to your personal data and information about its processing;
• rectification of inaccurate or incomplete data;
• erasure of your data;
• restriction of processing;
• data portability for applicable data;
• objection to processing based on legitimate interests; and
• withdrawal of consent at any time, without affecting earlier lawful processing.

Contact hello@moodspark.today to exercise a right. We may need to verify your identity. You may also complain to the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), dsb.gv.at (opens in a new tab), or another competent supervisory authority.

10. Changes and related pages

We may update this policy when the service or legal requirements change and will update the date above. See the Terms of Service, Refund & Cancellation Policy, and Imprint.