We open Spark on an Android or iPhone, add three accounts in two minutes, and find ourselves with push notifications, shared drafts, and AI suggestions enabled by default. Everything works, but several of these functions pass through Spark’s servers before reaching the screen. Understanding this mechanism changes how to configure the app, and especially what we choose to let transit through it.
Server-side processing on Spark mobile: what goes through the infrastructure
When we receive a push notification on Spark, the message does not come directly from the email provider. Push notifications pass through Spark’s servers to be delivered to the device. This process also applies to shared emails, collaborative drafts, sharing links, and scheduled messages.
In practical terms, this means that part of the data leaves the provider’s perimeter (Gmail, Outlook, iCloud) to be processed on Spark’s infrastructure. Data is generally processed on the device, but these specific functions are notable exceptions.
For strictly personal use, we can disable push notifications and collaborative features in the settings of each account. We lose comfort, but gain control over the data flow.
Before going further, it should be noted that we can use Sparh on mobile securely as long as we understand these trade-offs and configure the app accordingly.
Authentication and account protection: the provider first, Spark second
A common mistake is to look for security settings in Spark when protection primarily depends on the email provider. Multi-factor authentication, password management, and detection of suspicious logins are the responsibility of Gmail, Outlook, or iCloud, not the email client.
Enable OAuth instead of a direct password
Spark offers two methods to connect to an account: OAuth authorization and direct password entry. OAuth delegates authentication to the provider, which avoids storing a password in the app. This is the method to systematically prefer.
With a direct password, Spark retains the credentials to query the server. If the device is compromised, these credentials become accessible. With OAuth, only a temporary token is stored, and the provider can revoke it remotely.
Locking the app on the smartphone
Spark includes a locking option via code or biometrics (fingerprint, facial recognition depending on the model). This layer protects access to the inbox if someone unlocks the phone.
Steps to check during the initial setup:
- Enable 2FA (two-factor authentication) directly with the email provider, even before opening Spark
- Select OAuth as the connection method in Spark for each added account
- Enable biometric or code locking in Spark’s security settings
- Ensure that the smartphone’s screen lock itself is active (code, pattern, or biometrics)
Spark’s AI features: balancing comfort and privacy
Spark offers artificial intelligence features to summarize threads, suggest replies, or rephrase messages. These functions involve several external providers, including Azure OpenAI, OpenAI, Claude, or Vertex AI.
Spark states that it does not train its models on user data. However, some providers may temporarily retain inputs for abuse monitoring purposes. The nuance is significant: the content of an email processed by AI leaves the device to reach a third-party service, even if this processing is temporary.
Disable AI for professional accounts
On a phone where both a personal account and a professional account coexist, AI can be configured differently depending on the account. For professional use with sensitive data (contracts, client data, financial information), disabling AI suggestions avoids any transfer to an external provider.
Feedback varies on this point: some users believe that the time savings justify the transfer, while others prefer to reserve AI for exchanges without confidentiality stakes. The safest approach remains to start with complete deactivation, then activate features one by one with full knowledge of the implications.
Encryption on Spark mobile: concrete limitations to know
Spark protects data in transit (between the device and the servers) and at rest (on the servers). This double encryption covers the infrastructure, but Spark does not offer end-to-end encryption comparable to PGP. The content of messages remains readable by the intermediate infrastructure, not just by the sender and recipient.
For exchanges that require end-to-end encryption, Spark does not replace a dedicated solution. It can be used as the primary client for daily management and a PGP or S/MIME compatible tool reserved for the most sensitive messages.
Memory and local data on the smartphone
On both Android and iPhone, Spark stores a local cache to speed up display. This cache contains fragments of messages, recently viewed attachments, and metadata. Two useful reflexes:
- Regularly clear the app’s cache in the phone settings to limit exposure in case of loss or theft of the device
- Check that the smartphone’s storage is encrypted (enabled by default on recent models, but not always on entry-level Android devices)
- Remove unused accounts in Spark rather than leaving them connected in the background
The protection of an email account on mobile relies on a stack of layers: provider, client, operating system, device. Spark manages part of this chain, but the strength of the whole depends on the weakest link. Configuring each layer separately remains the only way to achieve a consistent level of security on a daily basis.
