Privacy policy · Terms of service

Sparring Privacy Policy

Last updated: 2026-10-12. Version: draft-0.2.

DRAFT: NOT LEGAL ADVICE, NOT YET IN EFFECT. This is working draft text shown on the hosted demo and prepared by the product team. It has not been reviewed by a lawyer. It must be reviewed and revised by qualified counsel (covering U.S. federal and state privacy law, TCPA, CAN-SPAM, FEC data-use rules, FCRA, state data-broker and automatic-renewal laws, and any non-U.S. law that applies) before any commercial service launches. Where this draft describes behavior that is planned but not yet built, it says so in an [Implementation note].

This policy explains what Sparring ("Sparring", "we", "us") collects, why, who can see it, how long we keep it, and the choices you have. It applies to our website, the practice drills we send (email, text message and voice calls), and related support. The operator is Sparring (working name; legal entity not yet formed).

Contents

1. The short version
2. Who is involved: account holders and participants
3. The dual consent model
4. Information we collect
5. Optional research (external-data enrichment)
6. Voice calls and recordings
7. How we use information
8. What we never do
9. Who can see what
10. Service providers and other disclosures
11. Retention and deletion
12. Your rights and controls: revoke, stop, export, delete
13. Older adults, capacity and well-being
14. Children
15. Security
16. Cookies and similar technologies
17. U.S. state privacy rights
18. Visitors outside the United States
19. Changes to this policy
20. Contact us

The short version

Who is involved: account holders and participants

• Account holder. Usually an adult child who signs up, pays, and invites a family member. The account holder must be at least 18.
• Participant. An adult (usually an older parent) who receives practice drills. A participant does not need an account; they act through a private link we send them.
• Operator staff. A small number of Sparring staff with an operator role can view account and drill records to run the service, investigate safety reports and answer requests. Operator views of a person's records are logged.

The dual consent model

Drills require two consents, and each is recorded separately:

1. The account holder's own consent, given while signed in, per channel (email, text message, voice).
2. The participant's own consent, given by the participant on their own private, single-use confirmation link (valid for 7 days), per channel. The account holder cannot give this consent for them, and we do not accept consent "on behalf of" a participant, including from someone holding a power of attorney.

A drill can be scheduled or sent on a channel only while both consents for that channel are active and the family is not paused or canceled. This rule is enforced by our servers and by the database itself.

Each consent act records: the consent document version and a cryptographic hash of its exact text, the time, the IP address and browser user-agent of the device that gave it, who enrolled it, the channels, and the scopes granted. Consent records are written to an append-only ledger: they are never edited. A withdrawal is recorded as a new entry.

Consent has two separate scopes:

• Drills (receiving practice drills on the chosen channels), and
• Research (optional; see section 5).

A participant can say yes to drills and no to research. Research is never a condition of receiving drills. Choosing practice phone calls also needs a separate, explicit yes to call recording (see section 6); email and text drills do not.

Information we collect

Information the account holder gives us

• Name, email address, optional mobile phone number, and a family display name.
• For each participant they invite: the participant's name, relationship (for example "parent"), email address and/or phone number, and which channels to ask about.
• Plan choice and billing status (see Billing information).

Before a participant confirms, we use their contact details only to deliver the invitation link. The link is single-use and expires after 7 days. [Implementation note: automatic deletion of an invited participant who never confirms is planned but not yet built; today the account holder can remove them, and canceling deletes them.]

Information participants give us

• Their consent choices (channels, whether recordings are allowed, whether optional research is allowed), and any later withdrawal.
• The device IP address and browser user-agent at the moment they consent or withdraw (kept as proof of consent).

Information created when a drill runs

• Which practice scenario was used, on which channel, when it was sent, and what happened: delivered, opened, clicked, replied, caught (reported or ignored it), or fell for it (for example started typing into a fake form).
• What someone types into a fake form is never stored or transmitted. For a fake card, bank or ID field we keep only {type, digit_count, timestamp} (for example "card, 16 digits, 10:42"). For a fake password field we keep only that something was entered, never its length or content. The same rule applies to digits spoken on a voice drill.
• Replies to text and email drills are stored redacted: any run of four or more digits is removed, and the database rejects anything that is not.
• A coaching note and a running score so the family can see improvement over time.

Billing information

• Plan, subscription status, renewal and trial dates, and a log of billing events (checkout, payments, plan changes, cancellations).
• Card payments are handled by our payment processor (Stripe). We never receive or store your card number, expiry date or security code. _[Implementation note: Stripe is in test mode; the practice card form keeps only {type, digit_count, timestamp} and never submits card values.]_

Technical information

• A sign-in session cookie (see Cookies), and standard server logs (IP address, time, page requested) kept for security for a short period.

Optional research (external-data enrichment)

With a separate, explicit yes from the participant (never from the account holder alone, and never as a condition of drills), we may build a profile to make drills realistic, using public and licensed external sources. Depending on the source this can include: approximate age band and region, which phone carrier, banks, shopping services and devices someone is likely to use, notable life events, and public political-donation records (for example U.S. Federal Election Commission filings) and inferred political or charitable interests.

Political and donation information is sensitive. We use it only to pick the kind of lure a real scammer might use against that person (for example a fake "campaign refund" or "tariff fee" message), never to persuade, target ads, or share with anyone. Each source query is logged with which source was queried and for whom.

• Withdrawal deletes it. If research consent is withdrawn, we immediately delete all externally-sourced records and clear the political, donation and other enriched fields from the profile. Drill consent can stay in place.
• We do not sell it or use it for any other purpose.
• [Implementation note: no real data source is connected. Every connector in this build returns clearly-labeled synthetic data. Each real source (especially political / donation data and data brokers) must be cleared by counsel, including FCRA, state data-broker and sensitive-data rules and FEC restrictions on using contributor information, before it is enabled.]

Voice calls and recordings

Practice calls are not announced as practice when they start (the participant agreed to unannounced calls in advance). Every call ends with a fixed spoken reveal ("This was a practice drill..."), which is not improvised by software. Saying "stop" (or showing distress) ends the act immediately.

• Recording needs its own yes. A call is recorded only when the participant separately agreed to recordings (required to receive practice calls) and the drill is configured to record. Recordings are used for quality checks and scoring. Where state law requires all-party consent, the call opens with a recording notice.
• Open question for counsel: does signup recording consent satisfy all-party-consent state laws without an in-call notice? (Founder decision 2026-10-07: no per-call disclosure; consent covers unannounced drills. Whether that is legally sufficient for recording in all-party-consent states is not settled; this policy does not claim it is.)
• Recordings may contain anything said aloud, so they are kept only as long as needed to show the family the result: by default 30 days, never more than 365 days, and 7 days for unsuccessful or unanswered calls. Live transcripts used to run the call are not stored.

How we use information

• To deliver the invitation, record consent and run drills only on consented channels.
• To reveal each drill immediately, coach the participant, and show the family progress (caught vs. fell-for, improvement over time).
• To bill the account holder, prevent abuse, keep the service secure, and comply with law.
• To produce aggregate, de-identified statistics (for example signups, activation, how often drills are caught) that help us improve the product.

What we never do

• Send a drill to anyone who has not personally consented to that channel.
• Store or transmit what is typed into a practice form (card numbers, passwords, account numbers, codes).
• Sell personal information, or "share" it for cross-context behavioral advertising.
• Use political or donation information for advertising, persuasion or anything other than choosing a realistic practice lure.
• Collect or process money through a drill. Some separately consented realism drills may simulate a scammer asking a participant to send money (for example, by gift card or payment app); that request is part of the scenario, not a payment to us. Any subscription charge is separate from drills and shown at checkout.

Who can see what

• The account holder sees their family's participants, consent status, and drill results and progress. They do not see enriched research details beyond what is needed to explain a drill.
• The participant can see and change their own consent at any time from their private link, and download their consent history.
• Operator staff (admin role only) can view records to run the service and handle safety reports. Those views are logged.

Service providers and other disclosures

We use service providers that process data on our behalf under contract:

• Hosting and database: Vercel (web hosting) and Supabase (Postgres database and authentication), hosted in the United States.
• Email delivery: Resend (magic-link sign-in emails, consent notifications, drill emails).
• Text messaging and voice calling: Twilio (SMS drills and voice drill calls).
• Speech services for voice drills: local speech-to-text and text-to-speech services run on our own voice-bridge machine (no third-party speech API receives call audio in the current build).
• Payments: Stripe (checkout and subscriptions). Stripe receives your payment details directly; we never see or store card numbers.

We may disclose information if required by law, to protect someone's safety, or as part of a merger or acquisition (subject to this policy).

Retention and deletion

Canceling deletes your family's data. When a family cancels immediately (or a paid plan ends), we stop all drills, revoke every consent, and delete accounts, participants, consent records, drills, results, recordings and research data. What remains is one anonymous "family deleted" entry with a count, and the anonymous billing events above. Retention jobs run automatically.

Your rights and controls: revoke, stop, export, delete

• Stop any drill: reply or say STOP. Drills on that channel stop immediately.
• Revoke consent: the participant (from their private link) or the account holder (from the dashboard) can withdraw consent per channel or entirely, at any time, with no penalty. Pending drills that lose consent are canceled at once.
• Withdraw research only: removes all enriched data immediately while keeping drills. [Implementation note: a one-click research-only control is planned; today revoking a consent removes it whole, and the participant can then re-confirm drills without research from a new link.]
• Export: download a person's full consent history (every grant and withdrawal, with time, document version and audit trail) as a JSON file from the dashboard or the participant's link.
• Delete: cancel immediately from Billing to delete all family data, or email privacy@sparring.example.
• Pause: the account holder can pause drills at any time. [Implementation note: today this is a pause / resume control per participant's drill schedule; a single family-wide pause button is planned. A STOP or distress signal already pauses the whole family automatically.]

Older adults, capacity and well-being

The service is designed for older adults, so we take extra care:

• The participant decides. We require the participant's own consent; an account holder, caregiver or power of attorney cannot consent for them. We do not knowingly enroll anyone who lacks the capacity to understand and agree, and we ask account holders not to invite such a person.
• Gentle by design. Routine email and text drills carry a PRACTICE DRILL label. Standard voice calls disclose the practice at the start. A separately consented, allowlisted realism test may omit the email/text label or voice opening and may simulate a scammer asking the participant to send money. The drill does not collect or process that money. Every drill ends with a reveal; drills never impersonate a real government agency. Fake credential forms do not store or transmit what is typed. Timing stays inside a local-time window the family chooses.
• Distress ends it. Stop words and signs of distress end a call immediately. Families can pause or stop at any time, and either side can withdraw.
• Not a real-fraud service. If you think a real scam is happening, contact your bank and local law enforcement, and in the U.S. report it at reportfraud.ftc.gov or call the AARP Fraud Watch helpline (877-908-3360).

Children

The service is for adults only. We do not knowingly collect information from anyone under 18, and drills may never be sent to a minor.

Security

Sign-in uses one-time email links, rate-limited (5 per email per 15 minutes, 20 per IP per hour). [Implementation note: sign-in state is currently kept in each hosting instance's memory rather than a shared store; a production session store is required before launch.] Session and invitation tokens are random and stored only as hashes. Access to family data is enforced by the server and by database row-level security. Consent records are append-only. No system is perfectly secure; we will notify affected people of a breach as required by law.

Cookies and similar technologies

We use one essential sign-in cookie (HttpOnly, 7 days). We do not use advertising or cross-site tracking cookies. Product analytics are computed from our own database in aggregate. [Implementation note: error tracking (Sentry) and product analytics (PostHog) are planned but not yet active; this section will be updated when they are.]

U.S. state privacy rights

Depending on where you live (for example California, Colorado, Connecticut, Virginia and other states), you may have rights to know, access, correct, delete and port your personal information, to limit use of sensitive personal information (which may include political opinions inferred from donation records), and to opt out of sale, sharing and profiling. We honor these rights through the controls above or by email at privacy@sparring.example, and we will not discriminate against you for using them. Authorized agents may submit requests with proof of authority, but cannot give drill consent for someone else.

Visitors outside the United States

The service is offered only in the United States. [Implementation note: if offered elsewhere, counsel must add GDPR / UK GDPR terms, including the lawful basis for processing special-category (political) data.]

Changes to this policy

We will post any change here with a new date and version, and for material changes we will notify account holders and participants and, where required, ask for consent again (consent records are tied to the version of the text that was agreed to).

Contact us

Sparring (working name; legal entity not yet formed) · Privacy: privacy@sparring.example · Support: help@sparring.example