← Nova Spark Collective · About Internal Tools

Privacy policy — NovaSpark Collective Internal Tools

Last updated: October 10, 2026
NovaSpark Collective LLC · Mailing address: 13303 W Maple St, Ste 139, PMB 1033, Wichita, KS 67235, USA · Contact: developer@novasparkcollective.xyz

This policy covers "NovaSpark Collective Internal Tools", the Google sign-in app used by NovaSpark Collective's own internal software. It is not the privacy policy for our consumer products: the THUNK app's policy is at thunk.novasparkcollective.xyz/privacy.

1. Who uses it

This is private software run by NovaSpark Collective on its own server. It is not offered to the public. It is authorized only by Google accounts that NovaSpark Collective owns or operates. Today that is two accounts: our operations account (used by our AI operations assistant, "Evan") and our owner's media account.

2. Google user data it accesses, and why

YouTube, for NovaSpark Collective's own channels only:

• youtube, youtube.upload, youtube.force-ssl: upload videos, schedule them and set their titles, descriptions and visibility on our own channels.
• youtube.readonly, yt-analytics.readonly: read our own channels' video status and analytics for internal reports.

Account identity (openid, userinfo.email): when an account authorizes our YouTube tools, we also receive its email address and basic profile identifier. We use them only to confirm that the right NovaSpark account signed in, and we refuse to save access for any other account.

Gmail, read-only (gmail.readonly), operations account only:

• What Google's permission allows: gmail.readonly lets the app read all mail in the authorized account. It cannot send, change, label or delete mail.
• What our software actually does: it searches only for messages addressed to our privacy contact, developer@novasparkcollective.xyz, from roughly the last 14 days. It reads those messages to sort privacy requests (for example deletion or access requests, complaints, security reports) and to track legal response deadlines for our Data Protection Officer.
• Other access: our maintenance checks may count messages containing a specific test code we sent ourselves, without reading them. No other mail is read by the software.
• How mail gets there: mail to developer@novasparkcollective.xyz is delivered to our owner's business mailbox at Zoho Mail. A Zoho mail rule sends a copy to the operations Gmail account; the original stays in Zoho. Zoho also forwards our owner's mailbox to his personal email. These routes are configured in Zoho, not by this app. The operations Gmail account also receives copies of our studio mailbox's mail; the software does not read those.

3. How the data is used and stored

• Sign-in tokens are stored only on NovaSpark Collective's own server, in files readable only by the account that runs the tools. They are not copied to backups.
• Privacy-request cases. For each privacy request we keep a local case record: case number, category, received time, deadlines, status, and the sender's email domain. We also keep a private internal brief holding the sender's address and the message ID, so our Data Protection Officer can find the original email. Message text is not stored by the software.
• Alerts. Our owner and Data Protection Officer receives short alerts through our Telegram bot. They contain the case number, category, received time, due date and the sender's email domain, never names, full addresses or message text. Telegram delivers these messages for us.
• Audit trail. A short audit trail records case numbers, categories and times. It contains no names, addresses or message text.
• YouTube uploads and analytics are used only to run our own channels and our internal reports.

4. Sharing, AI and Limited Use

• We do not sell Google user data or use it for advertising.
• We do not share it with third parties, except service providers acting for us (Telegram, for the short alerts described above), or where the law requires.
• Our software does not send Google user data to any AI service, and we do not use Google user data to develop, improve or train machine-learning or AI models.
• Our team sometimes uses AI assistants to help maintain these tools or draft replies to privacy requests. When we do, we share the minimum the task needs, removing names, email addresses and other identifying details wherever the task allows. We never share sign-in tokens or credentials with them.
• People see this data only to carry out the purposes above: our owner and Data Protection Officer, and the operators who maintain the tools.
• NovaSpark Collective Internal Tools' use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. How long we keep it

• Case records and private briefs are deleted automatically 24 months after a case is closed.
• The audit trail (no personal details) and Telegram alerts in our owner's chat are kept until we delete them.
• Original emails stay in the mailboxes where they arrived (Zoho Mail, the operations Gmail account and our owner's personal email). Those mailboxes' own settings govern how long they are kept. This app does not delete them.

6. Your choices

• An account that authorized this app can remove its access at any time at myaccount.google.com/permissions. The tools then stop working for that account, and our monitoring alerts us; we delete the unusable stored token when we see that alert.
• If you wrote to us at developer@novasparkcollective.xyz and want to ask about your request record, email us at that address.

7. Changes

We will update this page and its date when these practices change.