FirstSpar
Privacy Policy
Last updated . Applies to the FirstSpar mobile app and this website.
The short version. Your voice is never recorded. What you say is transcribed so the app can score it and so your logbook exists; that transcript is stored under your account, readable only by you, and kept until you delete it. There is no advertising, no ad identifiers, no tracking across other apps or websites, and nothing is sold or shared with data brokers. The app does report anonymous usage events and crash reports so we can see where it breaks and where people get stuck — never the words you type or say.
Who we are
FirstSpar is operated by Phileo Solutions ("we",
"us"), the developer of the FirstSpar iOS app
(com.phileosolutions.firstspar). We are the controller of
the personal data described below.
Questions, requests, or complaints: contact us.
What the app collects, and why
FirstSpar asks for as little as it can and stores less. Every item below exists because a specific feature needs it.
| What | Why | Where it lives |
|---|---|---|
| An anonymous account identifier | So your practice history belongs to you without requiring you to create an account. Made automatically the first time you open the app. | Firebase Authentication |
| Your name, your role, and how long you have been managing | So the counterpart addresses you by name and the coaching is pitched at the right level. All three are optional. | Your account, on Google Cloud Firestore |
| What you tell us about a conversation you are preparing for — the situation, the facts, and who you are facing | So the app can build a counterpart with something specific to defend. This is the material the simulation is made from. | Your device, and — once a scenario is built from it — your account |
| Your microphone audio, while a spar is running | So the counterpart can hear you and answer. Streamed live and never stored — see below. | Nowhere. It is not written down. |
| A transcript of what was said | So the debrief can score the conversation and quote your own strongest sentence back to you, and so you can reread it later. | Your account |
| Your debrief scores and confidence ratings | So your logbook, your confidence trend, and the app's suggestion of what to practise next can exist. | Your account |
| The times you started a spar | To apply the weekly limit on the free tier. | Your device and your account |
| Your settings — captions, chosen voice | So the app behaves the way you set it to. | Your device only |
| Your subscription status | So the app knows whether Pro features are unlocked. We never see your card details; Apple handles payment. | RevenueCat and Apple |
| Your email address and name, only if you choose to sign in with Apple or Google | So your practice history survives a new phone. Signing in is optional and the app works fully without it. | Firebase Authentication |
| Anonymous usage events and crash reports — which screens you reached, that a spar started and how long it ran, and the technical details of a crash | So we can see where the app breaks and where people get stuck. These carry counts and fixed labels only. Nothing you typed or said is ever attached, and there is no advertising identifier. | Google Analytics for Firebase, Firebase Crashlytics |
Your voice is never recorded
This is the most important sentence in this policy, so it is worth being exact about it. While a spar is running, microphone audio is streamed directly to Google's Gemini model so the counterpart can respond in real time. It is not written to your device, not uploaded to storage, and not retained by us in any form. When the spar ends, the audio is gone.
This is not a policy we have chosen to keep — it is how the app is built. There is no field in our database that could hold a recording, and an automated test fails the build if one is ever added.
A text transcript is a different thing, and we do keep that. Without it there is no debrief, no logbook, and no way to show you what you said.
What we never do
- We do not sell or rent your personal data. Ever.
- We do not show advertising, and there are no ad identifiers.
- We do not track you across other apps or websites. The app contains no advertising SDK and no ad identifier (no IDFA), and we do not build advertising profiles.
- We do not send your content to our analytics. Usage events carry counts and fixed labels — that a spar started, how long it ran, which button was tapped. Your situation, the names you use, your transcripts and your debriefs are never attached to one, and the app filters every value before it is sent so that they cannot be.
- We do not use your transcripts to train AI models. Content sent to Google's Gemini models through Firebase AI Logic is processed to return a response, not to improve the model.
- We do not ask for your gender, your employer, your contacts, your location, or your photos.
- Nobody at FirstSpar reads your transcripts. Access is restricted to your own account by database rules.
Who processes data on our behalf
We use a small number of established providers. Each is bound by its own agreement to process data only on our instructions, and each provides protections equal to the ones stated in this policy — we do not share your data with anyone who offers less.
- Google (Firebase) — authentication, database storage, remote configuration, and app attestation. Data is stored on Google Cloud infrastructure.
- Google (Firebase AI Logic / Gemini) — generates the counterpart's speech and your debrief. Receives your audio while a spar is running, and the text of your scenario and transcript. Google processes this under the Firebase AI Logic terms and the Google Cloud data processing addendum, which hold it to the same commitments made here: the content is used to return a response, not to train models, and the audio is not retained. The app asks for your permission before any of it is sent, and names Google when it asks — you can read that disclosure again at any time under Settings → Data & AI.
- Google (Analytics for Firebase and Crashlytics) — records anonymous usage events and crash reports. Receives a device-generated app instance identifier and your account identifier, never your practice content.
- RevenueCat — manages subscription entitlements. Receives your account identifier and purchase status, not your practice content.
- Apple — processes payments and, if you choose it, Sign in with Apple. We never receive your payment details.
These providers may process data in the United States and other countries. Where data leaves the UK or the EEA, transfers rely on the providers' standard contractual clauses.
How long we keep it
Until you delete it. There is no automatic expiry on your sessions, transcripts or debriefs, and that is deliberate: the confidence trend and skill profile are the point of the product, and quietly erasing them after a few months would delete the evidence that your practice worked.
If you would rather it did not persist, deleting your account removes everything at once — see below.
Your choices and your rights
Deleting everything
Settings → Delete account removes your account and every session, transcript, debrief, confidence rating, built scenario, weekly usage record, onboarding answer and setting belonging to it. It happens immediately and it is not reversible. Audio is not on that list because none was ever kept.
Access, correction and portability
Depending on where you live — including under the UK GDPR, the EU GDPR, and the California Consumer Privacy Act — you may have the right to access a copy of your data, correct it, delete it, restrict or object to its processing, and complain to a regulator. Deletion is built into the app; for anything else, contact us and we will respond within 30 days.
UK and EU residents may complain to their national data protection authority. In the UK that is the Information Commissioner's Office.
Permissions
FirstSpar asks for microphone access, and only for that. You can revoke it at any time in iOS Settings; the app will simply be unable to run a spar until you grant it again.
Children
FirstSpar is a professional tool for working managers and is not directed at children. It is not intended for anyone under 16, and we do not knowingly collect data from them. If you believe a child has provided us with personal data, tell us and we will delete it.
Security
Data is encrypted in transit and at rest by our providers. Access to your practice content is enforced by database rules that permit reads and writes only from your own signed-in account, and the app attests that requests come from a genuine build using Firebase App Check. No system is perfect, but the design principle here is simple: the app holds as little as it can, for as few people as possible — one.
This website
This site sets no cookies, runs no analytics, and does not track visitors. It loads the Manrope typeface from Google Fonts, which means Google receives your IP address in order to serve the font file. Nothing else on this page contacts a third party.
Changes to this policy
If we change how the app handles your data, we will update this page and the date at the top. Material changes will be surfaced in the app rather than left here to be discovered.
Contact
Reach us through the support page. We read everything, and we will respond to any request about your data within 30 days.