Spark

    Learning doesn't start with training, it starts with safety.

    Safety here doesn't just mean protecting data or technical architecture. It protects your ability to think, try, learn and decide for yourself what you bring into a shared space. You choose what to share.

    Psychological and social safety

    When people feel safe, they dare to think in drafts. When they dare to be unfinished, they dare to ask. When they dare to ask, they dare to experiment. And when they dare to experiment, space for learning is born.

    Safety → Courage → Experimentation → Learning

    AI does not change this equation – it makes it even more vital. The more AI, agents and automation enter organizations, the more important it is to ask: what are we protecting?

    Our answer is clear: we protect the human space to be unfinished. The space to try, ask questions and fail safely.

    Information stays where you put it

    • A wish only for you stays yours.
    • A team board is a closed home base: its introductions and wishes are visible only to that board's members and never move to your public profile or to other boards.
    • The public wall is open only when you choose it, and there you can also appear anonymously.

    Technical security

    Spark is an early prototype, yet it is built security-first on the technical level too (security by design). Security is never finished, but it has been part of the foundation from day one. Here is how we protect your data today.

    How We Protect Your Data

    • Row-Level Security (RLS): Every database table has access policies that ensure users can only read and modify data they're authorized to access.
    • Secure authentication: Sign-in uses Google or a one-time email code — we never see or store a password. The sign-in form does not reveal whether an account exists.
    • Closed boards: Personal and team boards are visible only to approved members, and their images are served through short-lived signed links.
    • Moderation: Every published or edited wish is checked on the server against a wordlist and an AI classifier. Two reports from different users hide a wish until it is reviewed. Rate limits bound publishing, editing and AI use.
    • Protected API keys: Only a public (anon) key is exposed to the browser. All sensitive operations happen server-side in secure backend functions.
    • Security Definer functions: Critical operations like updating spark counts use secure database functions that bypass direct table access, preventing unauthorized modifications.

    Editing a wish

    The owner can edit their wish. Once other learners have joined it, only a small correction is accepted; a bigger change should be published as a new wish. Edits go through the same content check, earlier versions stay visible, and joined learners are notified. The editor of an anonymous wish is never revealed.

    Administrator rights

    • Administrators can edit public wishes with the same limits as owners, delete wishes and regenerate images.
    • Administrators do not have these rights on closed team boards or personal boards.
    • Administrator deletions are recorded in an audit log.
    • Roles are stored separately from user profiles and checked on the server.

    Meetings: access rules

    • Visibility of sign-ups, introductions, private meeting details and feedback is enforced in the database (row-level access rules), not only in the user interface.
    • A host cannot cancel after the start or mark a meeting as held before it; completed and cancelled states are final. This prevents erasing a failed meeting.
    • Feedback requests are created only when you open your notifications — no background tracking.

    What We Don't Collect

    • No marketing cookies or third-party trackers
    • No IP address logging for profiling
    • No behavioral analytics or heatmaps
    • No data sold to third parties — ever

    Infrastructure & Data Location

    The service's database and file storage are located in the EU (Ireland). We build for portability: the code, database structure and AI layer are designed so that the service can be moved to another host or provider without being locked in.

    Security Auditing

    We maintain an internal security document (SECURITY.md) that tracks identified risks, their severity, resolution status and consciously accepted risks. Findings are reviewed and fixed continuously.

    Platform technical audit

    The hosting platform publishes an automatically generated technical audit of this service.

    Open the Trust Center

    Responsible AI

    Spark's Wish Wall is part of the SwarmMind World by Intunex Oy. We share the same commitment to responsible, human-centric AI — designed with the EU AI Act in mind from day one.

    Our Principles

    • Human decides, AI assists — AI generates inspiration and images, but you always choose what to post, share, or delete.
    • No profiling, no scoring — we do not evaluate, rank, or classify users in any way.
    • We don't train AI with your data — we never use your wishes or personal information to train or fine-tune models ourselves. Agreements also prohibit the model provider from training models on your text (see Privacy).
    • Transparency — AI-generated content is always clearly indicated (images, inspiration stories). You always know when AI is involved.

    EU AI Act — Risk Classification

    Under the EU AI Act, AI systems must be classified by risk level. Spark's Wish Wall is classified as a Minimal / Low-risk AI system.

    Why:

    • The system does not make decisions on behalf of people
    • The system does not affect users' rights, obligations, or legal status
    • The system does not use personal data for evaluation or prediction
    • No automated profiling (GDPR Art. 4(4))
    • No automated decision-making that affects people

    What Spark Does — and What It Doesn't

    ✅ Spark does:

    • Support learning wishes and reflection
    • Generate AI images and inspiration stories
    • Give users full control over their content
    • Allow appearing anonymously to others

    ❌ Spark does not:

    • Profile or score people
    • Predict behavior or performance
    • Make decisions on behalf of users
    • Train AI models with user data

    Prototype Stage — Honest Transparency

    Spark's Wish Wall is currently a prototype. We comply with EU legislation and European values in how we handle data and AI.

    For the full vision of our approach to responsible AI, see SwarmMind AI Safety & Trust.

    Roadmap

    • Ongoing review of European infrastructure and hosting options
    • Formal EU AI Act risk assessment document (PDF)
    • User data export (GDPR portability)
    • Content moderation transparency report
    • Accessibility audit (WCAG 2.1 AA)