Sparrow Files Privacy Notice

Effective as of October 20, 2026

What This Notice Covers

This Privacy Notice (the “Notice”) describes how Sparrow Files (“we,” “us,” and “our”) collects and processes personal data. The term includes information that identifies, relates to, describes, or could reasonably be associated with a particular person, directly or indirectly, as applicable law defines those concepts, including analogous terms such as “personal information” and “personally identifiable information” (together, “Personal Data”). Information that does not identify someone by itself is treated as Personal Data when combined with Personal Data, and remains so while the combined information is linked or reasonably linkable to that person. We collect and process Personal Data when you download, install, activate, access, or use the Product, and when you use the website from which you downloaded it (collectively, the “Product”). In this Notice, “you,” “your,” and “user” mean the individual who uses the Product and, where relevant, the company or other organization for which that individual uses it.

Certain features of the Product may interact with your browser’s search functionality, new tab page, homepage, default search settings, or similar browser features. Certain search-related functionality may be enabled, supported, or delivered with assistance from third-party providers.

Personal Data you submit, or that we otherwise handle in connection with the Product, is maintained in our systems and managed as this Notice explains. We do not disclose Personal Data to third parties other than as described here or as applicable law requires. You are not legally required to provide Personal Data. If you choose not to provide particular information, however, certain Product features may not be available, and we may be unable to respond to questions or complete requests. By downloading, installing, accessing, or otherwise using the Product, you acknowledge and agree that we may collect, use, disclose, and retain Personal Data as described in this Notice. If you do not agree to these practices, do not download, install, access, or use the Product.

For purposes of applicable data protection laws, we are the “data controller,” or the equivalent role recognized by the applicable law. We decide why and how Personal Data connected with the Product is processed.

We may revise this Notice from time to time to account for changes to the Product, our information practices, or legal requirements. We will publish each revised version on our website, and unless we say otherwise, it takes effect upon posting. Please review this Notice periodically.

This Notice identifies the information categories we process, explains why we process them, describes potential uses and disclosures, summarizes our safeguards, and outlines the choices available to you.

Residents of certain U.S. states should consult the “Supplemental Privacy Notice for Certain U.S. States” below for additional disclosures and rights that may apply. That portion also operates as our Notice at Collection and Privacy Notice under the CCPA.

The Product is not directed to children under 16, and we do not knowingly collect or process children’s Personal Data. If we learn that a child has supplied Personal Data, we will delete it as soon as reasonably practicable. Please contact us promptly if you believe a child has shared information with us.

For questions about this Notice, our treatment of Personal Data, or the Product generally, please email us at [email protected].

Personal Data Categories and Purposes

We handle Personal Data when you download, install, access, or use the Product, and when you contact us regarding the Product.

The Product is not intended to collect or process Sensitive Data and, to our knowledge, does not do so. Sensitive Data encompasses comparable concepts recognized by applicable law, including special categories of personal data, highly sensitive information, and sensitive personal information. You should not submit, transmit, or upload Sensitive Data through the Product. Depending on the applicable jurisdiction, examples may include racial or ethnic origin, religious or philosophical beliefs, sexual orientation, health information, and certain financial information.

The Personal Data and Non-Personal Data we process varies with the way you use the Product. The categories below are paired with the purposes for processing them and, when required, the applicable legal bases. We may additionally process Personal Data when necessary to investigate, identify, prevent, or respond to fraud, misuse, infringement, identity theft, security incidents, unlawful or prohibited conduct, or breaches of our End-user license agreement; to safeguard the Product and our systems; and to establish, exercise, or defend legal claims or otherwise limit legal risk. For these activities, where relevant, our legal basis is our legitimate interests.

The categories of Personal Data we may process depend on your use of the Product and may include the following:

• Information About Product Use: We may obtain information about your interaction with the Product, either from you directly or through service providers acting on our behalf. Examples include the features you use, timestamps, session duration, clickstream information, technical events, and error or troubleshooting logs. We use this information to assess performance, assist internal development, address issues, enhance functionality, and maintain security. This processing is based on our legitimate interests in operating and improving the Product.
• Search Information: Where the Product provides search-related functionality, we may process information about your use of that functionality and share it with relevant search providers and supporting third-party providers to deliver search services and related results. This information may include your search queries, search history, the search results displayed to you, and your interactions with those results. Although this information will not typically identify you directly, we process it in accordance with this Notice to the extent it constitutes Personal Data under applicable law.
• Device Details and Identifiers: We may process technical identifiers connected with your device or Product activity, such as your Internet Protocol (IP) address, device identifiers, browser identifiers, Google advertising ID (GAID), and similar online identifiers. Our legitimate interests support use of these identifiers to operate the Product, preserve functionality, secure it, and prevent fraud. When they are used for marketing, targeted advertising, or tracking technologies, we rely on your consent as described in this Notice.
• Support and Communications Data: When you seek support or otherwise communicate with us about the Product, we may process your contact details, the content of your inquiry, and any other information you elect to share. We use it to answer you, furnish support, communicate regarding your inquiry, and keep records of support interactions. We may also preserve these communications for later reference, service improvements, and training our support personnel. When support is necessary to provide the Product, processing is based on performance of our contract with you. In other circumstances, it rests on our legitimate interests in recordkeeping and improving support operations.
• User Content: We do not retain user content on our own servers or upload it to our systems for storage. After processing finishes and output is produced, we make that output available to you, and it remains stored locally on your device. To the extent you are authorized to do so, user content may include Personal Data about people other than you, including names or descriptions of other individuals (each, a “Non-User”). Do not upload another person’s Personal Data unless you have the necessary authority or consent. To the extent the Product processes a Non-User’s Personal Data, that processing relies on our legitimate interests in making the Product available and functional to users.

We use Personal Data and associated information for a range of operational, business, and compliance reasons, including the purposes set out below:

• Safeguarding the Product and Our Systems: We use information to preserve the security, integrity, and reliability of the Product, our systems, and our users. This includes identifying and stopping fraud, misuse, unauthorized activity, and other conduct that could violate our terms or applicable law, together with taking suitable steps to protect our services and infrastructure.
• Providing Product Features: We process information as needed to furnish the Product and give you access to its features and functionality.
• Managing and Enhancing the Product: We use information to run, support, maintain, evaluate, and develop the Product and its features. This includes analyzing performance, fixing problems, assessing usability and compatibility, learning how users experience the Product, and creating updates, improvements, or additional functionality consistent with our operational and business needs.
• Marketing, Personalization, and Communications: We may use Personal Data for personalization, promotional activity, advertising, and marketing, including to tailor content, communications, and advertisements to your interests and interactions with the Product.

How Long We Keep Personal Data

• Unless this Notice specifies otherwise, we retain Personal Data for the time needed to accomplish the purposes for which it was collected, subject to applicable law. A longer retention period may apply when needed to satisfy legal, regulatory, tax, or accounting obligations, maintain suitable business records, resolve complaints or disputes, or establish, exercise, or defend legal claims.
• Subject to applicable law, you may ask us to delete your Personal Data in certain circumstances. Except when law or a specific agreement requires retention, we are not obligated to keep Personal Data for a set period and may securely delete it, anonymize it, or limit access once it is no longer needed for legitimate business purposes.

Your Personal Data Rights

Privacy laws in the jurisdiction applicable to you may provide rights relating to the Personal Data we process. We will honor those rights whenever applicable law requires us to do so.

• Access to Personal Data. You may request confirmation of whether we process your Personal Data and, where applicable, access to or a copy of the Personal Data we maintain about you.
• Deletion of Personal Data. You may request deletion of certain Personal Data that we hold about you.
• Correction of Personal Data. You may also have the right to ask us to correct Personal Data that is inaccurate or incomplete, erase Personal Data in circumstances recognized by applicable law, or restrict our processing of Personal Data where applicable law grants that right.
• Portability of Personal Data. Where applicable law allows, you may object to certain processing of your Personal Data and ask us to provide it in a portable format or transmit it to another party when technically feasible.
• Where applicable, you may also appeal a decision or file a complaint with the appropriate authority.

To exercise any of these rights or raise a data-protection question, email us at [email protected]. Residents of certain U.S. states should also consult the “Supplemental Privacy Notice for Certain U.S. States” below for additional disclosures and rights that may apply.

Cookies and Similar Tools

When you access or use the Product, it may employ cookies and comparable technologies, including software development kits (“SDKs”). Depending on the interface, these tools may be stored on your device or associated with it as you browse, access, or use relevant Product features. Generally, cookies are text files used in web settings, while SDKs are application tools that provide similar capabilities in software settings.

These technologies help us operate the Product and make it easier to use. They support efficient navigation, automatically activate certain features, remember preferences, and make interactions with our services more seamless and responsive.

Disclosures and Cross-Border Transfers

We disclose Personal Data connected with the Product only in limited circumstances. Those circumstances include disclosures consistent with this Notice, necessary for our operations, or required by applicable law.

Service Providers, Affiliates, and Partners: We may share Personal Data with affiliates, subsidiaries, service providers, search feed providers, search engine providers, advertisers, and other third parties that help us operate, support, maintain, market, manage, or improve the Product, including where needed to provide search functionality and deliver search results.

Corporate Transactions: In connection with an actual or proposed merger, acquisition, financing, reorganization, sale of assets, consolidation, or other significant corporate transaction or change involving our business, we may disclose or transfer Personal Data.

Legal and Protective Disclosures: We may disclose Personal Data when we reasonably believe it is necessary or appropriate to comply with applicable law, legal process, subpoenas, warrants, court orders, or other binding demands, or to investigate or address unlawful activity, misuse of the Product, security incidents, or threats to the safety or rights of any person or entity.

Analytics and Reporting Partners: We may provide information to analytics providers and similar partners that help measure, evaluate, and understand Product performance, use, and effectiveness, including by producing aggregated or statistical reports.

International Transfers: Personal Data recipients may be located outside your jurisdiction, including outside the EEA where applicable. In that event, we take steps intended to require the recipient to follow privacy and security obligations consistent with this Notice and applicable law. When required, we use suitable safeguards for cross-border transfers, including contractual protections and other lawful transfer mechanisms intended to protect your Personal Data during international processing.

Information Security Measures

We maintain reasonable measures intended to protect Personal Data handled in connection with the Product and to support the confidentiality, integrity, and availability of our systems and services.

The measures we use reflect the nature and sensitivity of the information at issue. Our personnel apply generally accepted technical, administrative, and organizational practices intended to reduce the risks of unauthorized access, misuse, loss, alteration, or disclosure.

Our security program combines technical, administrative, and operational safeguards designed to protect information assets. No transmission method, storage system, or security control is completely secure, however, and we therefore cannot promise absolute security.

Contact Information

For questions, concerns, or requests concerning this Notice, our privacy practices, or the Product, please email [email protected].

Supplemental Privacy Notice for Certain U.S. States

This section adds to the remainder of this Notice and applies to residents of certain U.S. states. It supplies additional information about our collection, use, disclosure, and other processing of Personal Data when applicable U.S. state privacy laws require those disclosures.

Residents of certain U.S. states may receive specific Personal Data rights under the law of the relevant state when Personal Data is processed in an individual or household context. Unless applicable law excludes them, those rights generally do not extend to someone acting in a commercial or employment capacity, seeking employment, benefiting from a person acting in an employment capacity, or representing a business.

• Personal Data: Under applicable U.S. state privacy laws, “Personal Data” generally refers to information linked or reasonably linkable to an identified or identifiable individual. It generally does not include lawfully obtained publicly available information, de-identified information, aggregated information, or other information outside the scope of the applicable state law.
• Sensitive Data: “Sensitive Data” may consist of Personal Data revealing racial, ethnic, or national origin; religious beliefs; an individual’s medical history or mental or physical health condition, diagnosis, or treatment; neural data; transgender or non-binary status; sex life or sexual orientation; crime-victim status; citizenship or immigration status; genetic or biometric data; Personal Data collected from a known child; and precise geolocation data.

Certain U.S. state privacy laws call for a clear notice addressing, among other things, the Personal Data categories we process, processing purposes, third-party recipient categories, whether Personal Data is sold or used for targeted advertising, the third parties involved, consumer rights, how those rights may be exercised and appealed, and our contact information. This Notice and the disclosures below are intended to supply that information.

Personal Data Categories

The section titled “Personal Data Categories and Purposes” explains the Personal Data categories collected or processed in connection with the Product and the purposes for which we use, store, or otherwise process that information. We do not use collected Personal Data for materially different, unrelated, or incompatible purposes, and we do not collect additional categories without notice and consent when applicable law requires them, unless law otherwise permits or requires the collection.

Sales and Targeted Advertising Disclosures

Under certain U.S. state privacy laws, “sale” can include providing Personal Data to a third party in return for money or other valuable consideration, including for targeted advertising. We do not “sell” Personal Data in the ordinary sense of receiving money directly for information about you. Depending on the applicable legal definition, however, cookies, other tracking technologies, third-party advertising services, and certain related disclosures to third parties, including analytics providers, may be regarded as a “sale” or use for targeted advertising. The Personal Data at issue may include unique identifiers such as device ID and IP address; internet or other electronic network activity information, including engagement with our services; and geolocation data derived from IP address information.

Additional Privacy Rights for Certain U.S. Consumers

In addition to the rights described above under “Your Personal Data Rights,” residents of certain U.S. states may have further rights under applicable privacy laws, subject to each law’s scope, limitations, and exclusions. These rights may include the following:

You may have the right to obtain confirmation of whether we process your Personal Data and to receive that data in a portable format that is readily usable where technically feasible.

You may also be entitled to request correction of inaccurate Personal Data, deletion of Personal Data supplied to or obtained by us, and, in some cases, a list of the specific third parties to which we disclosed Personal Data about you or any Personal Data.

Where applicable law provides, you may opt out of certain processing, including the “sale” of Personal Data, targeted advertising, and profiling used to support decisions with legal or similarly significant effects. We do not conduct profiling for decisions producing legal or similarly significant effects.

If we decline to act on your request, applicable law may give you the right to appeal that decision. You may also be entitled to avoid discriminatory treatment for exercising privacy rights available under applicable law.

Additional information about California privacy rights is available from the California Office of the Attorney General at: https://oag.ca.gov/privacy/ccpa.

To submit a request under applicable U.S. state privacy laws, email us at [email protected].

Where applicable law allows, an authorized agent may make a request for another individual if the agent supplies evidence of authority to act for that person. We may also require the individual to verify identity directly and confirm the agent’s authority.

We will answer requests within the period applicable law requires. If permitted, we may extend that period, subject to any notice the law requires. If we decline to act, we will tell you, explain the reason, and, where applicable, describe how to appeal. We will review and answer an appeal within the period required by law. If the appeal is denied, applicable law may allow you to contact or complain to the appropriate supervisory authority, regulator, or Attorney General in your jurisdiction.