Privacy policy

1 Who is responsible

Sparks is an unofficial app, not affiliated with Renault. It shows information about your Renault, Dacia or Alpine electric or hybrid car (battery, charging, trips, location) and sends a few remote commands (air conditioning, horn, lights, charge scheduling). It runs on iPhone (with widgets, Apple Watch and a Live Activity on the lock screen), on Android (with 23 home screen widgets and an app for Wear OS watches) and on the screen of some cars (Android Automotive). All these versions go through the same Sparks server. When iPhone and Android behave differently, this page says so.

The controller is Astella Agency, a sole trader business, SIREN (French business registration number) 903 483 030, near Orléans, France (full address in the legal notice).

For any question about your data: privacy@sparksapp.fr.

Sparks has not appointed a data protection officer: the controller personally answers messages sent to this address.

Renault remains responsible for its own data. Sparks only reads it at your request, and what Renault does with it is covered by Renault’s own privacy policy.

2 How your data travels

Three things to remember:

• The app never talks to Renault directly. Everything goes through the Sparks server, including your My Renault, My Dacia or My Alpine email and password when you sign in.
• The server keeps working when the app is closed. It queries Renault regularly to reconstruct your trips and charging sessions (§ 3.4). On Android, if a widget is on your home screen, the app also wakes itself up about every 30 minutes (§ 3.6).
• A few outside services receive pieces of data (weather, maps, notifications). They are all listed in § 8.

3 What Sparks keeps on its server

3.1 Your My Renault, My Dacia or My Alpine account

• Email and password: sent to the Sparks server, which passes them straight to Renault to open the session. The password is not stored anywhere, neither on the server nor on the phone. With Renault two-factor authentication, they are sent a second time along with the code you received.
• Email in the server log: it is no longer written there, not even masked. The log only records a code that links the lines of the same account without revealing the address. Until 20 October 2026, it kept a masked version (for example val***@gmail.com): these lines disappear at the latest 90 days later.
• Renault sign-in token: the session key Renault issues after you sign in. It lets Sparks read your car without asking for your password again. It is kept in the keychain of your iPhone and your watch, and on the Sparks server, encrypted (§ 13).
• Your brand account ID: to check that the car really belongs to you.

3.2 Your car

• Serial number (VIN): the identifier of all the data for a car.
• Model, as Renault names it: also used for the per-model statistics (§ 14).
• Battery capacity: to calculate the energy of charging sessions.
• Contracts and warranties provided by Renault: kept for display.

3.3 Battery and charging

For each tracked car, the server reads the battery level, range, charging status and odometer. From these it derives:

• your charging sessions: start, end, starting and finishing levels, and intermediate points to draw the charging curve;
• the range shown by the car: one value per day;
• the commands sent (air conditioning, horn, lights, charging settings), kept until it is known whether Renault carried them out.

3.4 Trips

In shortThis is the most sensitive data. Renault does not provide any trips: Sparks reconstructs them by comparing two successive readings of your car.

• When it starts: automatically, as soon as the app shows your car’s status, once the server has checked with Renault that the car belongs to your account. You cannot refuse it yet (§ 12).
• When it stops: when you sign out, on both iPhone and Android (§ 12). In any case, it stops after 30 days without hearing from the app (no opening, no widget, no watch). Trips already recorded remain.
• How often: every 4 minutes when the car is moving, up to every 25 minutes when it has been parked for a long time, whether the app is open or not.
• What is kept for each trip: date and time of departure and arrival, precise GPS position of departure and arrival (rounded to about 1 km after 90 days), odometer, battery levels, and what is calculated from them (distance, consumption, average speed). The car’s last known position is also kept while tracking is active.

In plain terms: for 90 days, the start and end points are enough to guess your home, your workplace and the places you go often. After that, they are rounded to about 1 km: this makes it harder, but not impossible where there are few houses.

If you sell your car: each account only sees what was recorded after it proved it holds the car (the car appears in its garage). The buyer therefore does not see your trips, and you lose access at the latest 24 hours after the car leaves your garage. One exception: if the car was already tracked by Sparks before this rule was introduced, the account that was tracking it at that time keeps all of that history, including a previous owner’s. To have your period of ownership erased, write to us (§ 17).

3.5 The car screen (Android Automotive)

Only if you have installed Sparks on your car’s screen (OpenR Link). There is no account, no brand account login and no password in the car: the screen is linked to your account by scanning the QR code it shows with your phone (pairing). Unlike the phone app, the data does not come from Renault: the car measures it itself, with its own GPS.

When the car records

• Nothing is recorded until the screen is linked to your account, not even with demo access. Before pairing, the “Live” tab shows live readings without writing anything.
• Only the car profile where the screen was linked records. If the person driving switches to another profile of the car, Sparks does not record their trips.
• Recording starts at pairing, then resumes each time the car starts. A permanent “Sparks is active” notification shows it.
• Before asking for location access, an “Access to your location” screen explains what is recorded, including other drivers’ trips. It comes back at each new pairing.
• Recording stops if you turn off “Automatic trip tracking” in the car’s settings, or if you unpair the screen. This setting is on by default. Refusing location access does not stop it: only the GPS is missing.

What it records and sends

• While driving (ignition on): the GPS position once per second (latitude, longitude, altitude, accuracy, speed, heading, number of satellites), and the car’s readings once per second.
• When stationary, as long as the screen is on (during charging, for example): the car’s readings every 5 seconds, without GPS.
• The readings: battery level and capacity, charging or discharging power, plug and charging status, fuel, range, speed, odometer, wheel rotation, outside temperature, gear selected, parking brake, ignition, tyre pressure, air-conditioning temperature, night mode.
• Some live values are calculated in the car, for example cornering acceleration from the GPS: they are displayed, nothing more is recorded.
• A description of each trip and each stop: make, model, year and specifications of the car, manufacturer, model and Android version of the screen. It does not include the car’s serial number or the full fingerprint of the screen’s system.
• The files are sent at the end of each trip; without a connection, they are sent as soon as the connection returns. They are deleted from the car as soon as the server has received them. A file refused by the server is kept in the car for 7 days, then deleted. A trip that is too large (over 32 MB) is not sent: it is kept in the car for 30 days, then deleted. Each upload also carries the app version and a few technical counters (attempts, pending files). The server also sees the car’s IP address.
• If the car’s storage is almost full, readings are written less often when stationary, then not at all.
• On the server, each trip is calculated from these files: distance, consumption, and a simplified track (500 points at most) for the map. The files themselves are kept for 90 days, the calculated trips for 24 months (§ 10). The energy, distance, duration and outside temperature of these trips also feed into the fleet statistics (§ 14).

App versions before 1.0.0 took readings up to 10 times per second and also recorded GPS when stationary: files already received follow that rate. The oldest ones (0.31 and earlier) could also write the car’s serial number and the system fingerprint into the description: since 17 October 2026, the server removes them on receipt, and it has removed them from files already received.

At pairing, the car sends its model, its battery level and, if you have allowed location access, its last known position (less than 30 minutes old), to check that it really is your car. The QR code only contains a temporary code. This information is kept for about 24 hours. Along with the link, the server also keeps your brand account ID and a fingerprint of your session, from which the session cannot be recovered: they are used for one thing only, unlinking the screen when your brand account no longer lists the car, after a sale (§ 12).

Charging station search has been removed from the car app. In the versions that offered it (0.31 and earlier), the car’s position was sent to the server to find nearby stations, without being stored there: the Sparks log never recorded that position. The hosting provider’s access log, however, records the full URL requested, position included. It is deleted after a few hours, its archives are deleted every day, and older archives were deleted on 17 October 2026. A car still on version 0.31 or older still sends its position, which the server refuses: update the car app.

Tags: from your phone, you can create your own tags for these trips, with a name of your choice (32 characters at most) and a colour, up to 20 per car. The server keeps them, with the name encrypted, and never writes it to its log. Choose a name that says nothing sensitive. As with trips, the buyer of your car does not see your tags.

Journeys: if you group several trips into one journey, the server keeps that link. If you dismiss a suggestion, it notes this so as not to suggest it again. This information disappears with the trips.

A screen that has not been heard from for 90 days loses its access: it has to be paired again.

In demo mode (the access given to Google Play reviewers), the car records and sends nothing, and the server refuses any upload.

3.6 Your phone and notifications

• Notification token: the address provided by Apple or Google to send notifications to your phone. On both iPhone and Android, the app sends it to the server even if you refuse notifications. On Android, it is sent with the list of your cars’ serial numbers.
• Device information: platform, app version, language and region (on iPhone, also your preferred languages). Neither the phone model nor the system version.
• Your notification preferences: per car (charging, low battery and its threshold, security, charging reminder with its time and your time zone) and per phone (Sparks announcements, Tempo alert).
• Delivery history: which event, for which car, to which phone, with what result.
• Live Activity (iPhone): during charging, model, level, power, range and charging target are sent to the server, even if the option is turned off in the app.

Widget updates work differently:

• on iPhone, the server sends invisible notifications (silent wake-ups) asking the widgets to update;
• on Android, the app wakes itself up about every 30 minutes, only if a Sparks widget is on your home screen and the phone has a connection. If you are signed in, each wake-up reads your car’s status again, which re-registers it for tracking on the server: with a car widget on your home screen, tracking never stops by itself, even if you never open the app. The Tempo widget on its own only reads the colour of the day, without restarting tracking.

Tempo on Android (Tempo is a French EDF electricity tariff whose price depends on the colour of the day: blue, white or red) is off by default. If you turn it on, the app reads the colours for today and tomorrow, which is public information. The Tempo alert is tied to your phone, not to your account or to a car: no car number is sent with it. It is read again when you sign back in, and then turns itself back on.

3.7 Technical data

• Server log: each request is recorded with the time, the URL requested and your IP address. Your car’s number is replaced by a code, calculated with a key specific to your car. Passwords, tokens, email, brand account ID, charging times and Renault’s responses are removed from it. The log stays linked to your car through this code: it is not anonymous. Lines written before 21 October 2026 keep the number unmasked until they are deleted, at the latest 90 days later.
• Anti-abuse: IP addresses and car numbers are used to limit sign-in attempts and commands sent too close together. An IPv6 address is only kept truncated.
• Internal dashboard: a limited number of IP addresses per day, to monitor that the service is working properly.
• Technical summaries: a daily summary of the log is kept for 90 days, on the server and in a private GitHub repository. The car number is replaced by a code, and IP addresses and emails are masked.

Tempo colours (EDF, the French electricity supplier) and the list of charging stations are read from public sources (RTE, the French grid operator, and data.gouv.fr, the French open data portal): Sparks sends them no data about you.

4 What stays on your phone

This data is never sent to the Sparks server:

• the prices and rates you enter (price per kWh, trip rates, combustion-engine car for comparison on Android);
• charging session tags (and, on iPhone, tags of reconstructed trips);
• the PIN code and the Face ID or biometric setting of the app lock (on iPhone, with a fingerprint of the Face ID state calculated by iOS, without any biometric data);
• the weather of trips already displayed;
• CSV exports, created only when you ask for them and shared only by you (a trip export contains GPS coordinates);
• on Android, a troubleshooting log (passwords, tokens, emails and coordinates masked), visible in the app’s settings, which you can copy yourself. Released versions of the iPhone app, the widgets and the watch do not write one; one from a previous version is deleted at launch.

The phone also keeps a copy of what it received: last status of the car (position included), specifications, lease contract, charging history and curves. On iPhone, this also includes the list of your cars with their registration plates, the addresses of your trips and the map images of the widgets; the app keeps no copy of the server’s responses. On Android, the app also keeps, for the widgets, your car’s last address, a summary of your last 4 trips from the car screen (towns, distances, consumption, no coordinates), your consumption over the last 30 days, your last charge schedule and, if Tempo is on, the Tempo colours. Other addresses and the troubleshooting log stay in memory and disappear when the app is closed.

Backups and changing phones

• iPhone: excluded from backups are your car’s position and last status, addresses, widget and watch summaries, map images, the registration plate, the list of your cars, Renault contracts and trips from the car screen. The rest follows the normal behaviour of iOS and ends up in your iCloud or computer backups if you have turned them on: serial number, car details, charging history, tags and prices. A backup made before this update keeps its old copy until iOS replaces it. The sign-in token, the PIN code and the count of wrong codes are never transferred to another device.
• Android: the app’s data does not go into the Google Drive backup. However, a direct transfer to a new phone (by cable or during setup, Android 12 and later) carries the app’s data: car position, serial number, history, prices, tags. The sign-in token and the PIN code are carried too, but remain unreadable on the new phone: you have to sign in again.

Sparks does not use any cloud sync service.

Watches

The iPhone sends the Apple Watch the status of your cars, without their position, the last trip (departure and arrival towns only), the specifications and the Renault sign-in token, so that it can update and send commands by itself. The watch does not keep the car’s position, even when it reads it itself. Each command asks for confirmation there, but not for a code (§ 12).

On Android, your phone sends your Wear OS watch the status of your selected car (serial number, name, level, range, charging, air conditioning, plan, last trip) and, if Tempo is on, the colours for today and tomorrow. The watch receives no token and talks neither to the Sparks server nor to Renault. It keeps the last status received, which is deleted when you sign out.

In the car

The car screen app keeps in the car:

• summaries of your last 20 trips (with their track) and your last 50 charging sessions, calculated in the car and never sent. They are visible to anyone using the screen: the car app has no lock. They are deleted at each new pairing, or with “Unpair and erase the car’s data” (§ 11);
• files not yet sent, until they are sent; files already sent are deleted from the car. A file refused by the server is kept for 7 days, a trip too large to be sent for 30 days;
• a technical log (server responses, crashes, free space), without position or identifier. Its dates show when the car was used. It stays in the car and is not sent for now. It is deleted at each new pairing; only the cause of the last unlinking, without a date, is kept;
• map images already displayed (300 at most), deleted at each new pairing, your settings, and the screen’s token (encrypted).

Nothing goes into a Google backup, and the car app offers neither export nor sharing.

5 Your phone’s location and your car’s location

In shortYour phone’s location is only requested while you are using the app, never in the background, to show the distance between you and your car. It is never sent to the Sparks server, and is not stored.

• On iPhone, it is read once, to within 100 metres.
• On Android, the app only asks for approximate location (to within about a hundred metres), when it shows your car’s position. As with any Android app, this position is calculated by the phone’s Google location services.

Your car’s location comes from Renault, via the Sparks server. It is used to:

• show your car on the map (Apple Maps on iPhone, Google Maps on Android);
• find its address, and the addresses of the start and end points of your trips: the exact coordinates are sent to Apple’s map service on iPhone, and to Android’s geocoder (Google) on Android;
• show the weather where the car is: coordinates rounded to about 1 km, sent to Open-Meteo. For the weather of a past trip: the starting point, rounded (about 1 km), with the date. On Android, you can turn off the weather in Settings › Privacy › Weather (on by default): nothing is sent to Open-Meteo any more, and the stored weather is deleted. On iPhone, this setting does not exist yet;
• open the car in a maps app, only if you tap the button (or, on Android, the “Where is my car” widget): the maps app you choose then receives the coordinates.

In demo mode on iPhone (the demo account open to Apple reviewers), nothing is sent to the Sparks server or to Renault: only fictitious positions (central Paris) are sent to the weather and map services.

On the car screen, the location comes from the car’s GPS. It is used to draw your trips (once per second, while driving), to check the pairing (only if you have accepted the “Access to your location” screen, and if the last position is less than 30 minutes old), and to draw the base map of trips (CARTO, § 8). It is also requested in the background, so that the GPS works when recording resumes by itself when the car starts.

6 Permissions requested

None of them is mandatory.

On Android, the app also uses permissions granted at installation, without a prompt: internet access, receiving notifications, and rescheduling widget updates and the Tempo widget’s midnight alarm after a restart.

Other readings (plug, ignition and gear, tyres, parking brake, units) are granted or not by the car’s system, without a prompt. None of them is mandatory, but without them the app shows or records almost nothing. The car app uses neither microphone, nor camera, nor contacts.

Sparks never asks for access to Bluetooth, contacts, calendar, photos and files, Health, the microphone, motion or physical activity, nor, on the phone, for precise location (Android) or background location. It does not ask to track your activity in other apps and does not use the advertising ID.

7 Why, and on what legal basis

8 Who else receives data

Donation links (PayPal, Revolut) open in your browser: Sparks sends them nothing.

PromiseNo data is sold, rented or used for advertising.

Transfers outside the European Union: Apple, Google, GitHub and CARTO (CartoDB Inc.) may process data in the United States. These transfers are covered by the EU–US Data Privacy Framework, which these four companies state that they adhere to. Open-Meteo is a Swiss company (OpenMeteo GmbH): Switzerland benefits from an adequacy decision of the European Commission, and Open-Meteo deletes its logs, which may contain the coordinates received, after 90 days. Tally is a Belgian company that stores data in the European Union.

9 What Sparks does not do

• No analytics or tracking tools in the app: no Google Analytics, Firebase Analytics, Crashlytics, Sentry, Mixpanel… On iPhone, the app only uses Apple components. On Android, the only Google components are Firebase messaging, needed for notifications, Google Maps and the geocoder, location services and the link with the watch.
• No advertising, no advertising ID.
• No data ever sold.
• No speeding records, no driving rating, no eco-driving score.
• Your prices and rates never leave your phone.
• Your phone’s location is never sent to the Sparks server.
• Your sign-in password is never stored.
• On Android and on the car screen, nothing sensitive is written to the system log. The car app uses neither Firebase nor Google Play services.
• Your car’s privacy mode at Renault is respected: if it is on, Sparks tells you so instead of showing the data.

10 How long everything is kept

On your phone, almost everything stays as long as the app is installed, until “Delete my account”. What signing out erases is detailed in § 11; on iPhone, it erases in particular the car’s position, addresses and map images. On Android, the weather is kept for the last 300 trips viewed, and the CSV export until the next export.

11 Deleting your data

The labels below are those of the Android phone app and the car screen. The iPhone app is only available in French for now: there, “Sign out” is « Se déconnecter », “Delete my account” is « Supprimer mon compte », and “Settings” is « Réglages ».

“Sign out”

On iPhone

• erases the token on the phone and the watch, this phone’s notification registration, CSV exports, notification history, the Live Activity, the Tempo cache, car screen trips kept on the phone, the last status of your cars with their position, the addresses of the car and of trips, the widgets’ map images; on the server, this phone’s Renault session: tracking stops and the current trip is closed;
• does not erase the charging history, tags, prices, the list of your cars and their specifications; nor, on the server, the data already recorded. If you sign back in, tracking resumes.

On Android

• erases the token, the PIN code and the biometric setting, the selected car, its last status (the widgets empty out), the notification registration, the troubleshooting log, what the app keeps for the widgets (address, trip summaries, consumption, charge schedule), the Tempo copy and your Tempo settings, and the status kept by the watch; on the server, your car’s tracking and the links between your account and this phone: Sparks stops reading it;
• does not erase the charging history and curves, tags, prices, specifications and contract, trip weather, the last CSV export, the car’s pictures, your Weather setting; nor, on the server, the data already recorded.

If you sign out without a connection, the server is not notified and the app does not retry: tracking continues until 30 days without hearing from the app, and your phone stays registered for notifications (it may keep receiving the Tempo alert).

If your Renault session expires, the app returns to the sign-in screen. On Android, the server is notified as for a sign-out; the app then keeps the PIN code, your Tempo settings, the selected car and its last position, which a widget on your home screen keeps showing.

“Delete my account” (in Settings)

After a confirmation, Sparks asks the server to erase your cars’ data: trips and positions, tracking and token, charging sessions and curves, range, notification preferences and history, pending commands, pairing and GPS files from the car screen, the brand account kept with the pairing, trip tags and journeys, the key of the car’s code in the log, recent readings and trial copies from the new readings system, counters and caches. The data is actually overwritten, not just marked as deleted.

On both iPhone and Android, all the cars in your garage are erased. If Renault does not allow all your garages to be read at that moment, or if there have been too many requests, nothing is erased and the app offers to try again.

If the server confirms, the phone then erases everything it keeps (data, preferences, token, PIN code, images, exports; on Android, the stored weather, but a Weather setting that was turned off stays off), notifies the server of the sign-out and, on iPhone, asks the watch to do the same. If the server does not respond, nothing is erased and the app offers to try again. If your session has expired in the meantime, the app returns to the sign-in screen, without erasing anything.

“Delete my account” does not affect your brand account or what is stored at Renault (the charge schedule, for example). The other limits are described in § 12.

Other actions

• Deleting a trip from the car screen, from your phone: erases the trip, its files and its tag on the server. A “deleted” marker remains, so that it does not come back, until the car is fully erased. The car keeps its summary (its files have already been deleted when they were sent).
• Deleting a tag: it is erased from the server and removed from all your trips. The hosting provider’s backups keep it, encrypted, for 30 days.
• Unlinking the screen from your phone: it loses access to the server immediately, and nothing the car records reaches your account any more. The car finds out at the next trip upload or when the app is opened; if the server does not tell it clearly, it waits for a second refusal, at least half an hour later, and keeps recording until then. It then stops recording and erases the link; whatever had not yet been sent is no longer sent.

In the car

• “Unpair” (Settings › “Unpair this screen”): the car first tries, for one minute at most, to send pending files to your account. Then it stops recording, erases the link with your account and notifies the server, which immediately cuts off the screen’s access. Trips already received stay on the server, attached to the car. Whatever could not be sent stays in the car, neither displayed nor sent, and the next pairing erases it before any upload. Without a connection at that moment, the server is not notified: then unlink the screen from your phone.
• “Unpair and erase the car’s data”, after confirmation: the same thing, then the car erases the trip and charging summaries, everything that could not be sent, the technical log, map images and the battery capacity entered.
• Turning off “Automatic trip tracking” stops recording immediately, without erasing anything. Files already recorded are still sent at the next upload.
• Uninstalling the app or resetting the car erases everything the app recorded there, including its token. The server is not notified: unlink the screen from your phone.
• Before selling your car, use “Unpair and erase the car’s data”, with a connection (otherwise, also unlink the screen from your phone). If you don’t, the screen stays linked to your account as long as the car is in your garage: it keeps sending the new owner’s trips to your account, which you both see, and the new owner sees your last 20 trips in the car (§ 12).
• Uninstalling the phone app: erases the phone’s data (on Android, including the key that protects the token and the PIN code). On iPhone, the token stays in the keychain until the first launch of a new installation, which clears it, PIN code included. Uninstalling does not notify the server: tracking continues until 30 days without hearing from the app. Remember to sign out first, or to delete your account.

Getting a copy of your data

You can export your charging sessions and trips as CSV from the app. For a copy of everything the server keeps about you, write to privacy@sparksapp.fr.

12 What Sparks cannot promise you yet

HonestlyWe would rather tell you what does not work yet than promise you the opposite.

What stops tracking today:

• signing out, on both iPhone and Android, with three limits: if another phone still signed in tracks the same car, tracking continues with its session; if you sign out without a connection, the server is not notified and the app does not retry; if you uninstall the app without signing out, it continues until 30 days without hearing from the app;
• “Delete my account”, which stops tracking of the erased cars.

As long as you stay signed in on Android with a car widget on your home screen, the app restarts tracking by itself about every 30 minutes.

“Delete my account” erases your cars, with these limits

• the server log and technical summaries are not erased: they disappear at the end of their retention period (§ 10). The log replaces your car’s number with a code; on erasure, the key of this code is destroyed, and the remaining lines can no longer be linked to your car. Two exceptions, until they are deleted: lines from before 21 October 2026 keep the number unmasked, and those from 21 to 23 October 2026 can still be linked. Summaries leave the GitHub repository after 90 days, but the history of this private repository keeps them;
• the monthly totals of the fleet statistics already published remain: they are sums over at least 5 cars, from which nobody can be identified any more (§ 14);
• the hosting provider’s backups keep a copy until they expire themselves (30 days);
• a car that is no longer in your garage is not erased, as it cannot be proved that it is still yours: write to us to have your period erased (§ 17);
• your phone may stay on the notification list (with no link to your cars).

After signing out, your phone keeps part of your data: on iPhone, the charging history, tags, prices and the list of your cars; on Android, the charging history, prices, tags and trip weather. Everything disappears with “Delete my account”.

On the Apple Watch, each command asks for confirmation, but not for a code: a watch without a passcode, or a borrowed one, can command your car. On Android, the command widgets (horn, lights, air conditioning) act without the app’s PIN code.

On the car screen

• the car’s readings are also taken when stationary, not only the position during trips (the “Access to your location” screen says so);
• if you unpair without a connection, the server is not notified: also unlink the screen from your phone. Otherwise, it keeps its access until it has not been heard from for 90 days;
• after a sale, if you do nothing, the screen unlinks itself when your brand account no longer lists the car: Sparks has to notice this twice, at least an hour apart. This often takes several hours, with no guaranteed time frame, and nothing is cut off if Renault does not respond or if your session has expired. As long as the car stays in your garage, or if the screen was paired before 21 October 2026, it keeps sending the new driver’s trips to your account, and you both see them;
• if the screen is paired to another account, the previous holder is not notified; in some cases, a fake screen can also take the place of the real one without you being notified;
• other drivers’ trips are recorded like yours, unless they switch to another profile of the car;
• the trip summaries kept in the car are visible to anyone using the screen.

On the other hand, unlike the phone, the car has a switch to stop tracking: “Automatic trip tracking”.

On Android, a direct transfer to a new phone copies the app’s data (car position, history, prices), even if you did not expressly ask for it (§ 4).

13 How your data is protected

• All communications are encrypted (HTTPS); on Android, the app refuses any unencrypted connection.
• On iPhone, the token and the PIN code are in the iOS keychain, inaccessible until the phone has been unlocked once, and never transferred to another device.
• On Android, the token and the PIN code are encrypted with a key stored in the Keystore, the phone’s hardware vault, which it cannot leave. Other data is in the app’s private storage, which other apps cannot read.
• In the car, the screen’s token is encrypted with a Keystore key. It does not change as long as the screen stays paired, and is only sent to the Sparks server. The car’s other data is not encrypted, but stays in the app’s private storage, and files that have been sent are deleted from it.
• You can lock the phone app with a PIN code, with Face ID or biometrics as a shortcut. On iPhone, after five wrong codes, the app enforces a pause of 30 seconds to 15 minutes, which changing the time or restarting does not lift, and a privacy screen hides the app in the app switcher. If you add a face or a fingerprint on the iPhone, only the code opens the app afterwards. The car app has no lock.
• On iPhone, a security alert only shows “Sparks security alert” on the lock screen, unless notification previews are set to “Always”. On Android, a security alert does not appear at all on a screen locked by code, pattern or fingerprint: you read it once the phone is unlocked. A watch that relays your notifications may show it in full.
• The server checks with Renault that the car belongs to you before showing you its data and before sending a command. If Renault does not respond at that moment, data is still shown, but commands are never sent.
• On the server, databases and files can only be read by the account that runs the service. Renault tokens are encrypted there. The key is stored separately, but on the same server: someone who gained access to the hosting, or to a full backup, would have both. Backups from before 20 October 2026 keep the tokens in plain text until they expire, 30 days at most.
• Notifications no longer carry your car’s number, on iPhone or on Android. In the server log, it is replaced by a code.
• The server log and the Android app’s log remove passwords, tokens and keys.
• The internal dashboard is password-protected, and sending an announcement to all users also requires a one-time code.

14 Public statistics

The website shows totals for the Sparks fleet, month by month: kilometres driven, consumption per model, by outside temperature and by average speed (trips measured by the car screen), energy charged, breakdown of charging sessions by power, share charged on Tempo days and between 10 pm and 6 am.

• No car number and no position is published, and no date more precise than the month.
• A figure is only published if it is based on at least 5 cars (20 trips for a consumption figure), and if no car accounts for more than half of the total. Models that are too rare are grouped together.
• Each month is calculated only once, two days after it ends, then frozen. These frozen totals are kept with no time limit and are not recalculated when someone deletes their data: they are sums from which nobody can be identified any more.
• You can object to your trips being counted: write to privacy@sparksapp.fr. They are no longer counted from the following month; months already published remain.

15 The sparksapp.fr website

• The website sets no cookies and uses no audience measurement tool. Its fonts are served by the site itself, without calling any outside service.
• The web server’s logs (IP address, date, page requested) are kept by the hosting provider for security, for 12 months at most.
• To show whether the service is working, the “Sparks server” indicator at the bottom of every page asks the Sparks server, hosted by o2switch in France: when the page opens, then at most once a minute while it stays on screen. Like every request, it is recorded in the Sparks server’s log with the time, the address requested and your IP address. The log is kept for 90 days.

16 The beta testing programme

The “Become a tester” form is hosted by Tally. It asks for your first name, your email, your type of phone and your car, so that you can be invited to test versions (TestFlight on iPhone, alpha version on Android and on the car screen). These sign-ups are kept until the end of the test programme, and at most 12 months after your last participation.

On iPhone, test versions go through TestFlight, Apple’s service. Apple then passes on to the publisher your invitation email address and, if you agree, crash reports and feedback. TestFlight is also covered by Apple’s privacy policy.

17 Your rights

You can ask at any time for access to your data, its rectification, its erasure, its portability or the restriction of its processing, and object to its use in the public statistics. You can withdraw your consent to notifications in the settings, and set instructions for what happens to your data after your death.

Write to privacy@sparksapp.fr. We will reply within one month.

Previous owner of a car that has been sold: you no longer see your data in the app, but we can erase your period of ownership on the server. Write to privacy@sparksapp.fr, giving the car’s serial number (VIN) and attaching, in your name, your former vehicle registration certificate (French “carte grise”) or the certificate of sale. You can also ask for a copy of your period: trips, charging sessions, car screen files, your tags (names in plain text) and an explanatory note, without any sign-in key. It is given to you in an encrypted archive, whose password is sent to you separately, by text message. It contains positions: it is deleted from our servers once delivered, and your supporting documents once your request has been handled.

If you believe your rights are not being respected, you can lodge a complaint with the CNIL, the French data protection authority: cnil.fr/fr/plaintes.

Minimum age: Sparks is intended for people aged 15 and over.

18 Changes to this policy

This policy follows the app as it evolves. The date and version number are shown at the top of the page. In the event of a significant change, you will be notified in the app.

19 Glossary

Sparks server

The computer, hosted by o2switch in France, that the app talks to. It is the one that talks to Renault.

VIN

Your car’s unique serial number, engraved on the windscreen.

Token

A session key issued by Renault after you sign in. It lets Sparks act on your behalf without asking for your password again, until Renault revokes it.

Keychain

The iOS vault for secrets.

Keystore

The Android vault for encryption keys: a key created there cannot be extracted from it.

Firebase installation ID

A number Google assigns to each installation of the Android app, needed for notifications.

Geocoder

The service that turns coordinates into an address.

Device-to-device transfer

Copying apps and their data from an old phone to a new one, by cable or during setup.

Notification token

The address, provided by Apple or Google, used to send a notification to a specific phone.

Silent wake-up

An invisible notification asking the app to update in the background, for the widgets.

Live Activity

Charging progress shown on the lock screen and in the Dynamic Island.

Log

The file where the server notes what it does, so that faults can be fixed.

Pseudonym

A code that replaces an identifier, but which can, with some effort, be linked back to the person. It is not anonymity.

Pairing

The link between the car screen and your account, made by scanning a QR code.

Android Automotive

The Android system built into the screen of some cars (OpenR Link at Renault).

Map tile

A small square image of the base map; its number tells which area it covers.

Tempo

An EDF (French electricity supplier) tariff whose price depends on the colour of the day: blue, white or red, announced the day before.