Privacy Policy

Effective date: September 7, 2026

1. Introduction

Spot is a shared event-photo app. This Privacy Policy explains what information we collect, why we collect it, and how we protect it when you use the Spot app, App Clip, website, waitlist, invitation pages, or partner features (together, the “Service”).

2. Information We Collect

We collect only the information needed to operate the Service.

Account and profile information. We create an anonymous account identifier for your device. If you choose to sign in, we may collect the information provided through email, Sign in with Apple, or Google Sign-In. We also collect the display name you choose.
Photos and event data. We store photos you take in the app, their styled copies, capture time, uploader identifier, and the Film to which they belong. We also store Film names, dates, cover images, invite codes, QR codes, participant and capture limits, reveal settings, camera styles, and organiser/co-organiser settings.
Notification data. If you allow notifications, we store an Apple Push Notification service (APNs) token to deliver event notifications and Live Activity updates.
Purchase and referral data. We process one-time purchase entitlements, referral-code use, and related account identifiers. Apple handles payment-card information. Where RevenueCat is used to manage purchases, it receives only the identifiers needed to provide purchase entitlements.
Security and support data. We collect limited technical information such as IP address, request time, rate-limit records, browser/device information, and the messages you send to support. We use this information to prevent abuse, keep the Service secure, and answer support requests.
Website information. If you join the waitlist, we collect your email address. Our website uses local storage for language preferences and Google Fonts, which may receive your IP address when fonts are loaded.

We do not collect device location, contacts, microphone data, health data, advertising identifiers (IDFA), or cross-app tracking data. We do not sell, rent, or trade personal data, and we do not use advertising networks or behavioural advertising. Photo EXIF/GPS location metadata is removed before storage.

3. How We Use Information

We use information to:

create and maintain anonymous, guest, and signed-in accounts;
create Films and let invited guests join, capture, upload, view, save, and share photos;
apply selected camera styles and reveal photos at the chosen time;
manage invitations, QR codes, co-organisers, limits, access, one-time purchases, and referral features;
send notifications or Live Activity updates when permission is granted;
respond to support requests, moderate reported content, and prevent fraud, spam, and other misuse; and
meet legal obligations and protect the rights, safety, and security of Spot and its users.

4. Photo Privacy and Album Access

Photos, display names, and event information are visible only to people who have access to the relevant Film, including its organiser and co-organisers. A Film can be configured to keep photos hidden until its reveal time.

Guests and organisers can save photos to their devices or use the iOS sharing tools. Once content is shared outside Spot, the recipient’s handling of it is outside our control.

Before uploading a photo, make sure you have the necessary permission to photograph and share every person shown, especially children and people in private settings.

5. Service Providers and Data Sharing

We use carefully selected providers to run the Service:

Supabase for authentication, database, storage, and backend functions. Our primary data region is AWS eu-central-1 in Frankfurt, Germany.
Apple for App Store distribution, in-app purchases, Sign in with Apple, APNs, and Live Activities.
RevenueCat for one-time purchase entitlement management.
Vercel for the website, invitation fallback pages, and partner pages.
Google for Google Sign-In and Google Fonts.

These providers process information only as needed to deliver their services to us. We may also disclose information where required by law, to protect rights or safety, or as part of a merger, investment, or business transfer. We use appropriate safeguards for international transfers where required by applicable law.

6. Data Retention and Deletion

We keep account, Film, and photo data until it is deleted by the relevant user or organiser, or until an account is deleted. Deleting an account deletes associated account data and the content uploaded by that account, except where retention is required by law.

Original photos from a Film are automatically deleted 90 days after the Film ends. We send the Film owner push notifications 30, 7, and 1 day before deletion, and a final notification once deletion has happened, so they have a chance to save their photos first.

Anonymous accounts and associated data are deleted after 60 days if they are not converted to a signed-in account. Security and rate-limit records are kept for up to 90 days. Backup copies are deleted within one year. Waitlist emails are kept until you unsubscribe or withdraw consent.

You can delete your account in the app through Settings > Account > Delete Account. You can also contact us at support@spontanea.app with privacy questions or deletion requests.

7. Security

We use reasonable technical and organisational safeguards, including HTTPS/TLS in transit, encryption at rest, private storage, temporary signed links, access controls, rate limits, and restricted backend access. No method of transmission or storage is completely secure, but we work to protect your information from unauthorised access, alteration, loss, or disclosure.

8. Children’s Privacy

Spot is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe that a child has provided personal information to us, contact us and we will take appropriate steps to delete it.

9. Changes to This Policy

We may update this Privacy Policy when the Service or applicable law changes. For significant changes, we will provide notice in the app, by email, or on spontanea.app/privacy. The effective date above shows when this version took effect.

10. Contact Us

For questions about this Privacy Policy, your personal information, a content report, or account deletion, contact us at support@spontanea.app.

This English version controls in the event of a conflict with a translation, subject to any mandatory local law.