Privacy Policy
This privacy policy applies to Planespot, Trainspot, and Carsspot (the "Apps"), and the Spotapps website (the "Service"), operated by Spotapps ("we", "us", "our"). We take your privacy seriously. This policy explains what data we collect, how we use it, and what rights you have.
1. What we collect
Account information
When you sign in with Apple or Google, we receive your name, email (if provided), and a stable user ID from that sign-in provider. We do not see your Apple or Google password.
Profile data
You may set a display name, handle, bio, and avatar. These are public to other users of the Service.
Location data
When you create a "spot" (a logged catch), the app captures your GPS coordinates at the moment of capture, only if you grant location permission. You can use the apps without sharing location — spots will be saved without a map pin. You can also hide individual spot locations after creation.
Photos
Photos you attach to a spot are uploaded to our storage provider and associated with your spot. Photos are visible to other users if the spot is public. We strip EXIF location data from photos on upload by default.
Device and usage data
We collect basic device information (model, OS version, app version) for crash reporting and analytics. We use privacy-respecting analytics (Plausible) that does not track you across sites. We do not use Google Analytics, Facebook Pixel, or other third-party trackers.
2. How we use your data
- To display your catches in your collection, on the public feed, and in leaderboards (only public spots).
- To power social features (follows, profile pages, activity feed).
- To send you push notifications (only if you opt in). You can disable notifications in your device settings.
- To detect and prevent abuse, fraud, and security incidents.
- To comply with legal obligations.
We do not sell your data. We do not share your data with advertisers.
3. Third parties we use
- Supabase Inc. — database, authentication, and file storage. Hosted in the US. Data Processing Agreement in place.
- Apple Inc. — Apple Sign-In authentication.
- Google LLC — Google Sign-In authentication (Android only).
- Cloudflare Inc. — website hosting and content delivery. Privacy policy at cloudflare.com.
- Plausible Insights OÜ — privacy-respecting website analytics. Does not use cookies or collect personal data.
4. International data transfers
Our backend is hosted in the United States. If you are in the UK, EU, or EEA, your data will be transferred to and processed in the US. We rely on Standard Contractual Clauses (SCCs) approved by the European Commission for these transfers. Our processors (Supabase, Cloudflare, Plausible) are all SCC-compliant.
5. Your rights
If you are in the UK, EU, or EEA, you have the following rights under GDPR:
- Access — request a copy of your data.
- Rectification — correct inaccurate data.
- Erasure — delete your account and all associated data.
- Restriction — pause processing of your data.
- Portability — receive your data in a machine-readable format.
- Objection — object to certain types of processing.
To exercise any of these rights, email privacy@spotapps.net. We respond within 30 days.
6. Account deletion
You can delete your account at any time from Settings → Account → Delete Account. When you delete your account:
- All your spots, photos, and profile data are permanently deleted within 30 days.
- Your follower/following connections are removed.
- Aggregated, non-identifying statistics (e.g. "100 spots deleted") may be retained.
7. Data retention
- Active account: data is retained as long as your account is active.
- Inactive account (no sign-in for 24 months): we will email you before deletion. If you do not sign in within 60 days of the notice, your account is deleted.
- Deleted account: data is permanently deleted within 30 days. Backup copies are rotated out within 90 days.
8. Children's privacy
The Apps and Service are not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has created an account, contact privacy@spotapps.net and we will delete it.
9. Security
We use industry-standard security measures including encrypted data in transit (TLS 1.2+), encrypted data at rest, and row-level security in our database. No system is perfectly secure; if you discover a vulnerability, please report it to security@spotapps.net.
10. Changes to this policy
We may update this policy from time to time. We will notify you via the apps and the website of any material changes. The "Last updated" date at the top of this page reflects when the most recent change was made.
11. Contact
For privacy questions, contact privacy@spotapps.net or our postal address (registered office):
[Registered office address — to be added before App Store submission]
12. UK GDPR representative
If you are in the UK and would like to contact our UK GDPR representative, please email uk-rep@spotapps.net.