Privacy Policy

Account data

• Your email and/or phone number, whichever you sign up with.
• A bcrypt-hashed password — never the password itself. If you sign in with Google, GitHub, or Apple instead, we store that provider’s account identifier, not a password.
• Your plan, AI credit balance, and billing status.

Your sites and content

• The pages, sections, products, and settings of every site you build, so they can be edited and published.
• Images and video you upload are stored via Firebase Storage (Google).
• Orders, discount codes, gift cards, and reviews belonging to your store(s).

Payments

Card payments (subscriptions, credit packs, product checkout, gift cards, and marketplace site purchases) are processed directly by Stripe — your card details go to Stripe, never to SiteSpark’s own servers. On iOS, plan and credit purchases instead go through Apple’s In-App Purchase system; we verify the resulting receipt with Apple server-side to credit your account, and never see your Apple ID payment details. If you sell through your own store, Stripe Connect handles the payout to your bank account.

AI features

“Build with AI,” AI-assisted editing, AI product descriptions, the automatic visitor-language translator, and the in-app Help & Support assistant all send the relevant text (and any photos you attach, for AI Generate) to Anthropic’s Claude API to produce a response. Only what’s needed for that specific request is sent — not your account details, payment information, or unrelated site content.

Integrations you connect yourself

If you connect AliExpress (Settings > Integrations), we store the resulting OAuth access token so we can import products on your behalf. If you add a Printful API key, we store it to place fulfillment orders. If you search or register a domain (Settings > Domains), the domain name and your registration details are sent to Namecheap, our domain registrar partner, to complete that purchase. None of this happens unless you take that action yourself.

Shipping & location

If you set up local delivery with a pickup location (Settings > Shipping), the address you enter is sent to a geocoding service to place a pin on the map shown to your customers. Settings > Live view shows an approximate, IP-based location for people currently browsing your published store — this is about your store’s visitors, not you, and no visitor is ever identified by name.

Email

Transactional emails — order confirmations, shipping updates, password resets, gift-card delivery, and account notifications — are sent through Resend. We don’t send marketing email, and we don’t sell or share your email address with anyone for their own marketing.

Cookies

One cookie: a session token that keeps you signed in. It’s httpOnly (not readable by page scripts) and used for nothing besides authenticating your requests. No third-party analytics or advertising cookies, on SiteSpark itself or on the sites it builds.

Published sites

Publishing a site makes its content — and any products, prices, and images on it — publicly viewable at its assigned URL, by design; that’s what publishing means. Password-protecting a site (Settings > Store) restricts viewing to people with the password. Unpublishing takes a site back down immediately.

Who we don’t share data with

We don’t sell your data, and we don’t share it with advertisers. Data only ever goes to the specific service providers named above (Stripe, Apple, Anthropic, Firebase/Google, Resend, Namecheap, AliExpress, Printful), and only for the specific purpose described — processing a payment, generating content you asked for, sending an email you triggered, and so on.

Deleting your data

Settings > Account has a real, self-service Delete my account button — it permanently deletes your account and every site, product, order, and file attached to it. This isn’t a deactivation; it’s real deletion, and it can’t be undone. You can also reach the Help & Support assistant or contact us directly with any question about your data.

Children

SiteSpark isn’t directed at children, and accounts require someone old enough to enter into these terms and process real payments.