Name: Aeira
Brand: Sparcle

1. The short version: Sparcle has no server that receives your data

Bolt runs entirely on your own computer. It is a desktop application, not a cloud service. Your mail, files, clipboard, chats, notes, documents and prompts are read, indexed, encrypted and stored on your device. There is no Sparcle account to create, no Sparcle cloud to sync to, and no Sparcle endpoint that any of it is sent to. We do not hold your data, because it never reaches us. That is an architectural fact, not a promise about how we behave: there is nothing on our side to read, retain, subpoena, breach, or sell.

Four things are true alongside that, and we would rather state them plainly than let you find them:

The AI model you choose is not us. When you ask Bolt a question, only the specific content you direct it to send leaves your device, and it goes from your device straight to the AI provider you selected, under your own contract with that provider and that provider's own retention terms. Clear secrets such as keys and card numbers are caught before they leave, and masked when you or your company choose. Sparcle does not operate an inference gateway and is never in that request path.
Bolt checks for updates. It asks our GitHub release channel, and sparcle.app if GitHub cannot be reached, whether a newer version exists. It carries nothing from your device beyond the fact that a computer at your IP address asked, and for which platform. It contains none of your content.
An organisation can run its own Bolt server, and it is theirs, not ours. Bolt ships with its engine bundled on the device. A company may instead point its installs at a central Bolt server it deploys in its own infrastructure. That server belongs to the company, is operated by the company, and is still not Sparcle: we neither host it nor receive anything from it.
Your licence is verified offline. A Bolt licence is a signed token checked on your own machine against a public key. Installing, activating or running Bolt does not call home, and we cannot see whether or how you use it.

Everything below is the detail behind those statements, plus what this website collects, which is a separate and much more ordinary matter, described in section 8.

2. Who we are

Sparcle Inc. ("Sparcle," "we," "our," or "us") makes the Bolt desktop application and the Aeira enterprise data plane, and operates the website at sparcle.app. Contact us about privacy at privacy@sparcle.app; for anything else, write to bolt@sparcle.app.

It is worth being precise about the three, because they have very different privacy properties. Bolt is software you install and run; we operate no servers for it. Aeira is software our enterprise customers deploy inside their own infrastructure; we operate no servers for it either. sparcle.app is a website we do operate, and it behaves like a website.

3. Bolt desktop app: what stays on your device

Everything Bolt touches on your behalf is processed and stored locally: the content you paste or drop into it, the connectors you link, the files it indexes, the conversations you have, and the history it keeps so you can search it later. Bolt's local databases are encrypted at rest, with the exceptions described below, and its stored credentials are sealed with authenticated encryption.

On a signed release build the device key is held in your operating system's keychain and gated by your login; a copy of that same key, together with the keys that seal Bolt's own credential and pseudonymization stores, is also kept as a file in Bolt's data directory at mode 0600, so that a keychain Bolt cannot reach never locks you out of your own data. Those key files therefore sit beside the data they protect, and your account's file permissions are what separate them. The same is true of the small index of fields such as subjects, short facts, names, dates, file paths, and URLs that Bolt keeps readable on the device so local search can answer without decrypting everything. If Bolt cannot save its key, conversation and memory bodies are stored unencrypted, with a warning in its log, rather than sealed under a key that would be lost on restart; and its logs are scrubbed of personal data rather than encrypted. We recommend enabling FileVault or BitLocker so that the whole directory is covered by full-disk encryption; that, rather than the keychain, is what protects a copy taken off the machine. None of it is ever transmitted to Sparcle.

If you turn on Secure Sync, your notes, settings, bookmarks and open tabs are sealed on your device and stored in your own drive. Sparcle never receives them and cannot read them.

Because the data is on your device, deleting it is also on your device: removing Bolt's data directory removes it, and there is no copy of it with us to ask about.

4. Built-in browser, password vault and Secure Sync

Built-in browser. Bolt's own browser keeps what a browser keeps, on your device: history, bookmarks, open tabs and a list of downloads. None of it is sent to Sparcle. Private tabs write nothing to history, cache or any log on disk. You can delete browsing data for a time range from the browser. The pages you visit are run by third parties, and what those sites store or collect is covered by their own policies.

Password vault. Your saved logins and passkeys are encrypted on your device under your master password, with a key of their own that is separate from the key that protects sync. Sparcle never receives your master password or your vault, and cannot reset or recover a lost master password. Passkeys saved in Bolt stay on the device where you saved them and do not sync between devices. If your organisation uses device policy, it can lock the vault and pause sync on a device.

Secure Sync. Secure Sync is optional. When you turn it on, what it syncs is sealed on your device before it leaves, and is stored in storage you choose, such as your own cloud drive. Sparcle does not host that storage and cannot read it. Settings lists what syncs, today your notes, settings, bookmarks and open tabs. Browsing history is separate and does not sync unless you turn that on. Your company can turn note sync off.

5. Google user data (Bolt desktop app) and Limited Use

The Bolt desktop application ("Bolt by Sparcle") can connect to your Google Account, at your request, using Google OAuth. When you connect, Bolt accesses only the data covered by the scopes you approve, which may include: your account email address and basic profile to identify the account, reading your Gmail messages (gmail.readonly), your calendars and events (calendar.readonly), your contacts (contacts.readonly, contacts.other.readonly), your tasks (tasks.readonly), your Drive files so you can search and open them (drive.readonly), and, only if you turn on Secure Sync to your own Google Drive, a private Bolt folder in it (drive.appdata). All of these are read-only except that private folder. If your organisation connects Bolt to its own Google project instead, your administrator chooses the scopes, and they can include write access. Sparcle still receives none of that data.

This data is processed entirely on your own device. Bolt fetches your Google data directly from Google to your computer and uses it locally to power features such as search, context, drafting, and scheduling. Your Google user data is never transmitted to, stored on, or logged by Sparcle's servers. Any copy Bolt retains is stored only on your device, under your control, and can be deleted by you at any time, protected as described in section 3.

We do not sell your Google user data, do not use it for advertising, do not allow humans to read it, and do not use it to train generalized or AI/ML models. If you choose to ask an AI model a question, only the specific content you direct Bolt to send is transmitted, from your device directly to the AI provider you selected, under that provider's own retention terms. Clear secrets such as keys and card numbers are caught before they leave, and masked when you or your company choose. Sparcle is never in that request path.

Bolt's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Bolt's Google data path was assessed by an authorized third-party lab against Google's CASA requirements. What that assessment covers, and what it does not.

6. Bolt browser extension

The Bolt browser extension connects your browser to the Bolt app. It sends data only to the Bolt app on your own computer, or to your organisation's own Bolt server if your organisation has configured one. Sparcle receives none of it. The extension has no telemetry, needs no account, and does not sell or share data.

It uses the data it handles only to provide its features to you:

What you are about to send to an AI site. Text and files you are about to send are checked on your device and, if you or your company's policy chooses, masked there before they are sent.
Your open tabs. Tab titles and addresses, so you can search your tabs in Bolt.
Your logins. Logins, passkeys and one-time codes that you save to, or fill from, your Bolt vault.
What you send to Bolt. Your selection, or a page you choose to send to Bolt.
Page capture, only where your company turns it on. A company can enable page capture by policy. It is off otherwise, and it never runs in incognito windows.

Bolt's use of information received from browser APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

7. Enterprise customer data (Bolt and Aeira deployments)

Bolt and Aeira are deployed on-premises or in the customer's own VPC, and are designed so that customer data remains within the customer's environment. Sparcle does not host, receive, or process that data, and operates no data plane on the customer's behalf; where a deployment is nonetheless governed by a Data Processing Agreement (DPA), that DPA controls.

When Bolt is pointed at an external LLM, prompts are checked under the company's masking policy before they leave the customer's perimeter, and they go to the customer's own model provider, never to Sparcle infrastructure. Sparcle does not operate an inference gateway; you bring your own LLM under your own provider contract. Aeira enforces per-user ACL filtering: users only see data accessible under their own identity token.

8. What this website collects

This section is about sparcle.app only. It does not describe Bolt, and nothing here reaches into the application on your machine.

Like most websites, this one collects some data, and we would rather name it than hide behind "usage data":

No analytics or tracker. This site runs no analytics product and no third-party tracking script. We removed Google Analytics rather than disclose it, because a tracker on the site that tells you no Sparcle server receives your data is the one place that claim would not hold. We read traffic from our CDN's aggregate logs instead.
Things you type into a form. If you contact us, request a design-partner conversation, or ask for a checklist, we receive what you submit (typically your name, email address and message) and it is emailed to us so we can reply. Submissions pass through Cloudflare Turnstile, a bot check.
Download counts. When you press a download button on this site, we count the press. We store the platform you chose, the day, your country, the site that referred you (hostname only), and any campaign tag on the link you arrived by. To count one person once a day, we make a one-way hash of your IP address, the day, and a secret key we keep. We store the hash, not the address, and it cannot be matched from one day to the next. Your browser's identification is read only to discard bots and is not stored. We use the count to size demand and to see which links work, not to profile you. Links that carry a campaign code send you straight to GitHub today and record nothing; if that changes, this policy will say what is recorded.
Ordinary server and CDN logs kept by our hosting provider for security and abuse handling.

We do not run advertising, and we do not sell or rent any of this.

9. Cookies

The website sets essential cookies only, such as your theme preference. There are no analytics cookies, no advertising cookies, and no cross-site tracking cookies, because there is no analytics or advertising script on the site to set them. The Bolt desktop application does not use cookies for tracking of any kind.

We do not sell your personal data, and we have no Bolt user data to sell. For the website data described in section 8, we use a small number of service providers for hosting and CDN, email delivery, and bot protection, under confidentiality obligations and only to operate the site. We may disclose data if required by law; in practice, a legal demand for the contents of your Bolt installation is one we cannot satisfy, because we do not have it.

11. Data retention

Data held on your device is retained for as long as you keep it, and is deleted when you delete it; Sparcle holds no copy and therefore retains nothing. For website data, we keep contact-form correspondence as long as needed to handle your enquiry and meet our legal obligations, and CDN log data for the limited period our hosting provider retains it.

12. Your rights

Depending on your jurisdiction, you may have rights to access, correct, delete, or export your personal data. For anything in Bolt, those rights are exercised directly on your own machine, because the data is yours and is already in your possession. For website data, contact us at privacy@sparcle.app and we will action it.

California and other U.S. states. We do not sell or share personal information as those terms are defined in California law, and this site runs no advertising or cross-site tracking. You may ask to access, correct or delete the personal information we hold from this website by writing to privacy@sparcle.app. We will respond within 45 days, and we will not treat you differently for asking.

13. Children

Bolt and this website are not meant for children under 18, and we do not knowingly collect personal data from them. If you think a child has sent us information through a form on this website, write to privacy@sparcle.app and we will delete it.

14. Security

The strongest security property of this product is that the data is not in our custody. Beyond that: Bolt encrypts its local stores as described in section 3; traffic between your device and the services you connect it to is TLS-encrypted; and our website and internal systems use access controls and audit logging.

15. Changes to this policy

We may update this policy periodically. The "Last updated" date at the top reflects the most recent revision. Continued use of the site constitutes acceptance of the updated policy.

16. Contact

For privacy-related questions: privacy@sparcle.app

Privacy Policy.