Version 2026-07-14 · Hexenkraft s.r.o.
Sparqle is made by Hexenkraft s.r.o., IČO 29665931, Prague, Czech Republic ("we", "us"). We are the data controller for the information described below. Contact: matic@hexenkraft.cz.
Your account (the parent/guardian): email address, a hashed password (we never store your password in plain text), and optionally a name. We log the time and version of the Terms and Privacy Policy you accepted, and your marketing-email preference.
Each child profile: a display name or nickname, a birth year (not a full date of birth), a language preference, and mastery records (which topics they've marked in-progress or mastered). We do not collect a child's full name, photo, school, or address unless a future feature explicitly asks for it and explains why.
Consent & request logs: a record of what you consented to and when (including IP address at the time), and a log of data export/deletion requests you make, kept as evidence that we honored them.
Your account data is processed to provide the service you signed up for (contract, GDPR Art. 6(1)(b)) and, where you opt in, to send you product updates (consent, Art. 6(1)(a), withdrawable any time). A child's data is processed on the basis of the explicit consent you give, as their parent or legal guardian, at the moment you create their profile (Art. 6(1)(a), read together with Art. 8's special protections for children's data).
Sparqle is a tool for parents/guardians to track a child's learning — children do not create their own accounts or give their own consent. When you add a child profile, you are asked to confirm you are 18 or older and the parent or legal guardian of that child, and to separately consent to Sparqle processing that child's learning data. You can withdraw that consent at any time, which deletes the child's profile and all associated records (see Section 6).
We deliberately collect the minimum needed to run the product: a first name or nickname (not a legal name), and a birth year rather than a full date of birth.
Account and child data is kept for as long as your account is active. If you delete a child profile or your account, that data is removed immediately (see Section 6 on what's retained for audit purposes). Consent and request logs are kept as evidence of compliance; the fact that a deletion happened is retained even after the underlying personal data is gone.
You can, at any time from your account page: export a full machine-readable copy of your and your children's data (Art. 15/20), delete an individual child's profile, or delete your entire account (Art. 17, right to erasure). You can also withdraw marketing consent from the same page. If you believe we've mishandled your data, you have the right to lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.cz) or your local supervisory authority.
We use four functional cookies, nothing more: a session cookie so you stay logged in, a CSRF-protection cookie to secure form submissions, a cookie that remembers which child you last viewed so the dashboard can preselect them, and — only if you choose to sign in with Google or Apple — a short-lived cookie that exists purely to secure that sign-in handshake (it holds no identity, is used only while you are being redirected to and back from the provider, and expires within about ten minutes). None is used for tracking or advertising, and no analytics or ad-tech cookies are set by this scaffold as shipped. Because every cookie here is strictly necessary for the service to function, no cookie-consent banner is shown or required.
Data is stored on infrastructure we operate in the EU. If the optional AI quiz feature is enabled, generating a quiz sends the topic's name, description, and target age band (never your child's name, birthdate, or any other identifying information) to Anthropic (Claude API) to write the questions; Anthropic's processing of this data is governed by its own data processing terms. If this feature is not enabled, no data leaves our infrastructure for this purpose. If the sign-up bot-check is enabled, the sign-up page loads a small challenge from Cloudflare (Turnstile) to confirm you're a person rather than an automated script; Cloudflare does not use this for advertising or cross-site tracking, and its processing is governed by its own data processing terms.
If we make a material change, we'll update the version date at the top of this page and, where required, ask you to re-consent.
Questions or requests: matic@hexenkraft.cz.