Privacy
First-party measurements explain which pages and contact paths help visitors. Project inquiry information is separately collected only to review technical suitability, acknowledge the request, and manage the resulting business decision.
Where you can inquire
The homepage, Replacement Parts, Flagship Models, Part Rescue, Production, and Nylon pages use the same secure inquiry system. The page context helps Sergey understand your request; it does not determine suitability or qualification.
Inquiry fields
Name, email, and a short description of what you need are required. Company, quantity or repeat need, needed-by date, phone, preferred response, additional technical details, and one private upload are optional. This information is not used for automated suitability decisions.
One private upload
One JPG/JPEG, PNG, PDF, STL, STEP/STP, or OBJ file up to exactly 15,000,000 bytes may be stored in a private Spark-owned R2 boundary. It has no public object URL, is downloaded only through protected owner review, and is treated as untrusted. Engineering files receive bounded structural validation only; they are not rendered, executed, extracted, converted, or used to fetch referenced resources. Archives and every unlisted format are rejected.
Abuse controls
Turnstile, same-origin and CSRF checks, a honeypot, limits, and short-lived HMAC source digests protect the form. Application code does not store raw IP addresses, full user agents, Turnstile tokens, or fingerprints.
Separate durable state
Spark-owned D1 records track inquiry, upload, submission, notification, conversion, owner review, qualification, acknowledgment, transfer, rate-window, and deletion states. Inquiry contents, files, and contact details do not enter Signal Machine, DSWR, general analytics state, Google Ads, model prompts, public logs, or public proof.
Human communication
A fixed owner notification may be attempted only after durable acceptance. Customers receive no automatic email. Sergey manually acknowledges the request and records that state after the external effect is observed.
Attribution and events
Allowlisted UTM values, the canonical landing route, referring host only, and timestamps may be retained with the inquiry. First-party diagnostics and one deduplicated accepted-submit event contain no inquiry text or contact details.
Retention
Rate/invalid-attempt digests: 7 days. Unconverted inquiry metadata: 180 days. Unconverted uploads: 90 days. Failed staged uploads: reconciled after 15 minutes. Owner access: 7 days or earlier. Preview/test state: end of session or within 7 days.
Projects and deletion
After verified transfer, normal owner business-record policy applies and redundant Part Rescue state is deleted within 30 days. Content-free deletion evidence is retained for 400 days. Owner-requested deletion uses the same journaled private-object and D1 path.
What is not done
Spark does not sell inquiry data or build advertising profiles from inquiries. No remarketing, customer-list upload, call recording or forwarding, enhanced conversion, customer auto-email, automatic quote/order/production, or automatic AI interpretation of submissions or files. Inquiry content is not sent to Google.
Optional Google Ads measurement
On public production pages, Google Ads measurement loads only after you accept advertising measurement. Before a choice or after declining, Spark does not load the Google advertising tag or send advertising measurement requests, including cookieless pings. Accepting lets Google use cookies and ad-click information to connect advertising visits with a server-accepted project inquiry. Opening email, calling, starting a form, or a rejected request is not a submitted lead.
Google receives the measurement event, a non-identifying transaction identifier for duplicate prevention, and network/device information such as your IP address and browser information. This is not anonymous measurement. Spark does not send your inquiry contents, contact details, uploaded files, filenames, receipt, or private links to Google. Personalized advertising remains disabled.
Accept and decline are equally available. Use “Cookie settings” in the footer to change your choice. The choice is stored on this browser for up to 180 days; clearing browser storage may prompt you again. Withdrawal reloads the page to stop the loaded Google tag. It does not erase information already received by Google. Submitting a form is not consent; declining or blocking Google does not prevent an inquiry or receipt. Browser restrictions and lack of consent may limit attribution.
First-party site analytics
Allowlisted page views, meaningful email/telephone clicks, and 30-minute site sessions are measured without inquiry content, email addresses, or retained IP hashes. Raw events, sessions, and weekly browser digests are retained for 35 days; final daily and weekly aggregates are retained for 400 days.
Cloudflare
Cloudflare provides hosting, security, aggregate visits, page views, performance information, Turnstile verification, and the bound application infrastructure. Its privacy-focused Web Analytics uses no analytics cookies or local storage and does not create a remembered visitor profile. Cloudflare performance data is not used in the site’s first-party weekly reporting. Substantive customer communication remains human-reviewed and human-sent.
Estimated weekly unique browsers is an estimate of participating browsers, not people. Multiple devices or browsers, private windows, and cleared storage can increase the count; shared browsers can reduce it. A site-specific first-party random identifier is stored locally only for the current Eastern reporting week, rotates when the week changes, and is immediately converted server-side to a site-and-week-specific digest. The raw identifier is not retained server-side.