Privacy Policy

At a glance

It times the reminder. It does not watch your work.
We never collect raw keystrokes, screenshots, websites, documents, messages, application names, or meeting content.

Team totals are counted without identifying anyone.
The app sends a weekly count, with no code or personal ID attached, so an organization can see whether its team is using SparklingTreat.

Detailed usage sharing is your choice.
The core reset experience works the same whether or not you share optional usage data.

Your organization receives protected team totals, not individual activity.
We never provide an organization with code-level information or an identified employee's resets, skips, ratings, or timing.

We do not sell personal information or use it for advertising.

1. Scope

This Policy covers the SparklingTreat website, Windows app, team access, billing, and support.

It does not cover:

• The Microsoft Store. Microsoft's own privacy statement applies when you use the Store or download the app.
• Your organization's practices. If you use SparklingTreat on a computer or network managed by an employer or another organization, its device-management, security, and monitoring practices are governed by its own policies.

2. Information you give us

We may receive:

• Team inquiries: contact name, work email, organization, number of people you plan to invite, work setting, and anything else you choose to provide
• Billing information for organizations: billing contact, organization name, billing address, and transaction details. Card or bank information goes directly to Stripe. SparklingTreat does not receive or store full card numbers
• Support and feedback: messages, survey answers, interview responses, and other information you choose to provide

3. Information used by the app

A. Enrollment and access information

To provide organization-sponsored or other coded access, SparklingTreat processes:

• The access code, stored on our servers only as a one-way hash and stored encrypted on the user's computer
• A coded participant identifier, such as T-014
• The team, organization, or access program associated with the code
• Whether the code is active, and its creation and expiry dates
• The date the code first connects to our service

SparklingTreat does not collect an employee's name, email address, or device identifier as part of coded enrollment. An organization distributes its own codes and may know which code it gave to a particular employee. SparklingTreat does not receive that name-to-code list and does not give the organization code-level or individual activity data.

B. Computer-activity information used to time reminders

SparklingTreat measures how long someone has been using their computer so it can offer a reset at a sensible time. Moment-to-moment input timing and device states used for reminder timing are processed on the user's computer.

These signals may include time since keyboard or mouse input and whether the computer is locked, asleep, presenting, full-screen, or using supported focus settings. SparklingTreat does not record what is typed or what appears on screen.

SparklingTreat does not determine whether someone is physically sitting or standing.

C. Weekly team counts

So that an organization can see whether SparklingTreat is being used, the app sends one weekly count for each person using it. The count contains only:

• That the app was active that week
• How many resets were completed
• How many better, same, and worse answers were given, when the user chose to answer

The count is linked only to the team. It does not carry the access code, the coded participant ID, or any other identifier for the person. It is sent at a varied time, separately from the app's other service requests, and SparklingTreat adds it into team totals. SparklingTreat does not attempt to identify anyone from these counts, and it requires organizations not to attempt it either.

Weekly team counts are sent for everyone using SparklingTreat with an access code. Answering better / same / worse is always optional.

D. Optional usage data

Optional usage sharing is off until the user chooses it. If a user chooses to share, SparklingTreat receives a record of how the app is used under a coded participant ID rather than a name. This may include:

• When a reset was offered and whether it was taken, put off, switched, skipped, dismissed, or left to expire, plus a reason if one was selected
• Which reset was used, including the category selected from the tray, format, length, and how much was completed
• A better / same / worse response, when provided
• Accumulated detected computer-work time, time since the last keyboard or mouse input, and whether the computer was locked when a reset was offered
• The work setting selected in the app, such as home or a shared office
• App version, installation source, content-catalog version, event time, and local time-zone offset

This information is pseudonymous, not anonymous. SparklingTreat can use the coded ID to locate records if the user supplies it in a privacy request.

The user can change this choice at any time in Settings → Usage data. Turning optional sharing off stops future optional usage uploads immediately. Information already shared remains subject to the retention and deletion provisions below.

E. Information stored locally

The app stores settings, reminder state, the encrypted access code, and a local event log on the user's computer. The user can open the local log from Settings.

Deleting local app data removes data stored on that computer. It does not delete information previously shared with SparklingTreat.

F. Technical, diagnostic, and service information

Whether or not optional usage sharing is enabled, our systems and service providers process limited information needed to operate, secure, and troubleshoot the Service:

• Connection records: when the app contacts our service, Microsoft Azure Application Insights temporarily processes the IP address to derive an approximate location, such as city, state, and country. Under SparklingTreat's current configuration, the full IP address is discarded rather than stored. The request time and approximate location are kept for 90 days
• App version, sent with service requests
• Error information when something fails, such as a reset that could not play

SparklingTreat does not collect the operating-system version or a device or installation identifier. Reset videos stream from Microsoft Azure Storage using short-lived links.

G. Website information

The SparklingTreat website does not currently use analytics, advertising pixels, tag managers, or cross-site tracking technologies.

Our website host may process standard server information, such as IP address, browser type, requested pages, and access times, to deliver and secure the website.

Because we do not track visitors across other websites, our website behaves the same whether or not a browser sends a Do Not Track signal.

H. What SparklingTreat does not collect

SparklingTreat does not collect:

• Raw keystrokes, typed content, passwords, or clipboard contents
• Mouse positions or click coordinates
• Screenshots or screen recordings
• Websites, documents, messages, or email content
• Application names or meeting content
• Camera or microphone recordings
• Precise location

4. What organizations receive

When an employer or another organization provides SparklingTreat:

• The organization never receives code-level information or anything about an identified employee, including whether a particular person enrolled or uses the app
• The organization does not receive an individual's resets, skips, ratings, timing values, optional feedback, or wellness responses
• SparklingTreat does not provide productivity scores, employee rankings, health-risk ratings, or individual compliance records

An organization may receive deidentified aggregate statistics, subject to these safeguards:

A result is also withheld if the reported value itself is small enough to risk singling someone out. Reports based on optional usage data state that they cover only people who chose to share.

SparklingTreat treats these reports as deidentified statistics, does not attempt to identify anyone from them, and requires recipient organizations not to attempt reidentification.

SparklingTreat does not require or enforce participation. An organization decides how to introduce SparklingTreat under its own workplace policies. Whatever those policies are, an organization must not require a person to share optional usage data, provide a wellness response, or disclose individual SparklingTreat activity, and each person can always put off, skip, or pause resets.

5. How we use information

We use information to:

• Provide the app and deliver reset content
• Validate enrollment and manage access codes
• Manage subscriptions, payments, and billing
• Prepare protected team-level statistics
• Keep the Service reliable, diagnose problems, secure the Service, and prevent misuse
• Understand which resets and prompt timings people use when they choose to share optional usage data
• Improve SparklingTreat
• Communicate about access, support, the Service, or billing
• Meet legal obligations and enforce our agreements

We do not use app information to evaluate anyone's work or productivity.

6. How we disclose information

We may disclose information to:

• Microsoft: Azure hosting, storage and diagnostics; and email
• Stripe: payment processing. SparklingTreat does not receive full payment-card numbers
• Our website host: website delivery and security
• An organization providing SparklingTreat: only the deidentified aggregate statistics described in Section 4
• Authorities or other parties for legal and safety reasons: when required by law or reasonably necessary to protect rights, safety, and security
• A successor in a business transaction: in connection with a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets, subject to applicable law
• Others at your direction or with your consent

Service providers may process information only to provide their contracted services to us.

We do not sell personal information, and we do not share it for targeted or cross-context behavioral advertising.

7. Data retention

We normally complete verified deletion requests within 30 days and always respond within applicable legal periods. If information is stored in archived or backup systems, deletion from those systems may take longer where applicable law permits.

8. Security

• Access codes are stored encrypted on the user's computer, while our servers keep only a one-way hash
• Information is encrypted in transit
• Microsoft Azure provides encryption at rest for stored information
• Access is restricted to people and service providers that need the information for the purposes described in this Policy

No system can be guaranteed completely secure. We maintain administrative, technical, and organizational safeguards appropriate to the nature and amount of information we process.

9. Your choices and rights

• Resets are your call. A user can take, put off, switch, skip, or pause reminders
• Optional usage sharing is always your own choice, whatever your organization's policies, and can be changed at any time in Settings → Usage data
• Local app data can be deleted from Settings. This does not delete information already shared with SparklingTreat
• Previously shared data can be deleted by request. Email hello@sparklingtreat.com with the access code or coded ID. Because we do not store names alongside optional usage data, we may not be able to locate the records without one of those identifiers
• Weekly team counts carry no identifier, so they cannot be traced back to a person or deleted individually. Uninstalling the app stops them
• Uninstalling the app stops future app collection from that computer

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a copy of certain personal information. We may take reasonable steps to verify a request.

10. Consumer health data

Washington residents and other people covered by Washington's My Health My Data Act can read our separate Consumer Health Data Privacy Policy. It explains applicable consumer-health-data categories, purposes, disclosures, rights, appeals, and deletion procedures.

11. Adults only

SparklingTreat is intended for people aged 18 or older. We do not knowingly collect personal information from anyone under 18. An organization must invite only people who are at least 18.

12. Where information is processed

Information is processed in the United States, where SparklingTreat and its service providers operate.

13. Changes to this Policy

We may update this Policy as the Service changes. We will post the revised version and update the effective date. If a change materially affects how we handle personal information, we will provide additional notice where appropriate, such as in the app or by email.

If a change affects the categories or purposes of optional usage data, SparklingTreat will request a new choice before beginning the additional collection or use when required by law.

14. Contact us

SparklingTreat LLC
hello@sparklingtreat.com