Privacy

Last updated November 10, 2026

Draft: This page is a working draft for the pilot.

MemberSpark is the shared sign-in for the MemberSpark family of services. MemberSpark, a BC non-profit, is the body responsible for the information this page covers, and its privacy officer is reached at privacy@memberspark.ca.

What MemberSpark keeps

MemberSpark keeps your name and email address, your passkeys (their public keys and the names you give your devices), your sign-in sessions and their device labels, and Google’s account id if you link Google. It keeps the Terms version you were shown, the products you use, your organizations, roles and invitations, “paid up until” dates, AI key names and fingerprints, and a log of important acts on your account. It does not keep your birth date, your address, your phone number or any payment details, and it keeps nothing of the work you do inside a product.

Why

Your name and email address are given to sign in; that is the purpose they are collected for. The rest is kept so your account works the same way in every product you use through MemberSpark.

Who else holds data

Cloudflare runs MemberSpark and holds everything in its database, which may store and copy data outside Canada. The shared mail service and the mail provider behind it hold the address and text of each email in order to send it. Google knows that you signed in with Google, only when you choose “Continue with Google”. An encrypted copy of MemberSpark’s daily export is kept in a backup store outside Cloudflare, readable only with the owner’s key.

What the products see

A product sees your name and email address only after you accept it, and you can take that back by disconnecting the product. Every product you use through MemberSpark can tell it is the same person. An organization’s member list — names, roles, membership status and “paid up until” dates — reaches a product only while the organization’s admin has connected that product, and members’ email addresses reach only the organization’s own dues product.

How long things are kept

Your account, name, email address and passkeys are kept while your account stands and are deleted with it. Sign-in and passkey links are deleted within a day of being used or expiring. Ended sessions are deleted after 30 days. Invitations are deleted 90 days after they are accepted, withdrawn or expired. A record of important acts is kept in two tiers: sign-ins and other security events for 90 days, and decisions such as role and membership changes for 2 years. Deleted data can stay restorable in backups for the backup window after it is deleted.

Your choices

You can download your own data from your account page at once, and you can delete your account, which deletes what this page lists as kept with it. MemberSpark then tells every product you used, and each product deletes or anonymises its own data for you within 30 days. Nobody at MemberSpark can sign in as you or reset your account.

If you have no account — you were only invited, or you are only on an organization’s list — you can still ask what MemberSpark holds about you: write to privacy@memberspark.ca and MemberSpark answers within 30 days.