Trust

Security

Last updated November 4, 2026

Your couple space holds some of the most personal things you'll ever write down. Here's how we protect it, organized around the six functions of the NIST Cybersecurity Framework 2.0.

Govern

• Security and privacy are part of how every feature is designed, reviewed and released.
• Clear written policies: this page, our Privacy Policy, Terms and Child Safety Standards.
• We choose providers that meet recognized security standards (Google Cloud and Firebase, Apple, Cloudflare, RevenueCat) and limit what each one receives.

Identify

• We keep track of what personal data we hold, where it lives and why, and collect only what features need.
• Sensitive data (intimate content, religious beliefs, location) is opt-in and limited to the features that use it.

Protect

• End-to-end encryption for chat messages and Notes: encrypted on your phone, readable only on your two phones.
• Encryption in transit (TLS) for everything between the app and our servers, and encryption at rest on Google Cloud.
• Calls are encrypted end to end in transit (WebRTC, DTLS-SRTP) and never recorded.
• Passwords are never stored. Firebase Authentication keeps only a salted, slow hash. You can also sign in with Apple or Google.
• Access rules on our database and file storage let only you and your partner read your couple space, enforced on our servers, not just in the app. They're covered by automated tests.
• App integrity checks help make sure requests come from the real OurSparks app.
• Least-privilege admin access: staff tools use roles, so people only reach what their job needs, and admin actions are recorded in an audit log.
• Call relay credentials are short-lived and issued by our servers for each call.
• App Lock lets you protect OurSparks with your phone's Face ID, fingerprint or passcode.

Detect

• Crash and error reporting (with your permission) and server monitoring help us spot problems quickly.
• Automated screening of images posted to the Couples feed, and reporting tools for people.
• Sign-in protections, including limits on repeated attempts.

Respond

• We have an incident response process for investigating, containing and fixing security issues.
• If a breach affects your personal information, we'll notify you without undue delay, and notify regulators as the law requires (for example, within 72 hours under the GDPR where it applies).

Recover

• Our data is stored on Google Cloud infrastructure built for durability, with backups kept for up to 90 days.
• After an incident we review what happened and improve our safeguards.

Report a security problem

If you find a vulnerability, email security@oursparks.app with the details and steps to reproduce it. Please don't access other people's data, disrupt the service, or share the issue publicly before we've fixed it. We'll confirm we got your report, keep you updated, and won't take legal action against good-faith research that follows these rules.

Protect your account

• Use a unique password, or sign in with Apple or Google.
• Turn on App Lock in the app's settings.
• Keep your phone's software up to date.
• OurSparks will never ask for your password by email or message.