Privacy & data
Last updated: September 20, 2026
Account and access
Sparkles shares identity and Credits with CF Mail. After CF Mail verifies your identity, a one-time authorization code establishes your Sparkles session. Model keys and database credentials are never sent to your browser. You can only access your own conversations, tasks and private artwork.
AI conversations
When you send a message, relevant history is sent through the privately operated NewAPI service to the configured AI provider. Conversations are encrypted in the operator's NAS database, with processing on privately operated servers. We request that models do not store conversations, but providers may retain security or billing records under their policies. Avoid submitting unnecessary passwords, keys or other sensitive information.
Conversation attachments
Images and files you upload are stored privately in R2 for 7 days. Filenames and conversation metadata are encrypted. Access requires sign-in; download tickets are single-use. Sending a message sends selected attachments to the model provider. Older or expired files may be omitted from the current context; upload them again when needed.
Image storage and sharing
Generated images are private and stored in Cloudflare R2 for 7 days after completion. Permanently saved images do not expire automatically. Each account has 1 GB of permanent storage by default, adjustable by the administrator. Downloads require authentication and a short-lived, single-use ticket.
Anyone who receives a link you explicitly share can view that image. You can revoke sharing. The link does not include conversations, prompts, emails or account information.
Deletion and retention
You can delete conversations without deleting generated artwork. Removing images from permanent storage revokes sharing; images past their temporary retention period become inaccessible. CF Mail and the Credits service manage account, billing and email data. Request account deletion in CF Mail privacy settings. This blocks access here; the administrator completes cleanup of related conversations and sessions across services.
Service scope
The assistant currently uses question and image-creation tools. It does not automatically read email, other conversations or other users' data. Cloudflare and model providers may process data outside your country or region. Consider your data requirements before submitting content. Network and third-party services may affect availability.
Your analytics preferences
Only with your consent, the Sparkles main website loads Google Analytics 4 and uses browser identifiers to measure visits, devices, approximate regions and feature usage. We do not send names, email addresses, account IDs, prompts, conversations, attachment names or artwork links. Conversation URLs are anonymized and URL query parameters are excluded. Google processes this data, which may involve international transfers. You can withdraw consent here at any time. Declining does not affect creative features.