Two things, and what each one knows about you.

The Spotago app

Published on Google Play by Spotago LLC as “Spotago”.

Who is responsible

Spotago LLC is the data controller for everything in this section. Write to hello@spotago.com.

Your account

The first time the app runs it asks our server for an account and gets one: a random account identifier, a creation date, the edition of the terms you accepted and your confirmation that you are 18 or older, and a hashed device identifier. The app sends an identifier of the phone that only this app can see; the server keeps only a scrambled form of it, never the identifier itself, and uses it for two things: to limit how many accounts one phone can start and to stop a phone that has been blocked for abuse from starting another. There is no sign-up form, no name, no handle, no profile photo, and no email address. Posts do not show who made them, but every post belongs to the account that made it.

You can optionally attach an email address and password, or a Google or Apple sign-in, so you could sign in again on another phone. If you attach an email and password we store the address and the password only in a scrambled form that cannot be read back; the password itself is never stored. The only thing ever sent to that address is a password-reset code, and only when you ask for one from the app. If you attach a Google or Apple sign-in we store the identifier they give us for your account; for Apple we also keep what is needed to end that connection when you delete the account.

The app keeps a signed token on your phone that identifies your account to our server. If the account is deleted the token stops working everywhere at once.

Invite codes, when they are in use, record which account an invite came from.

Photographs and what you write

Every photo on Spotago is taken with the app's camera, standing at the place it shows. There is no import from your gallery. For each post we store the photograph, a thumbnail, the title, caption and description you wrote, the moment it was captured, and the derived things described below.

• Metadata is removed before storage. EXIF, XMP and IPTC segments — the camera's own record of position, time and device — are stripped from the file, and the upload fails if any survives. The bytes we store, and therefore the bytes anyone can fetch, carry none of it.
• Posts are public. Every Spotago user can see them. Photographs are served from Cloudflare storage at addresses that are long and unguessable but not secret: anyone who has the address can load the picture.
• Screening. At upload the photograph and your text are sent to OpenAI (vision, text-embedding and moderation models) to describe the scene, work out what kind of place it is, and check it against our rules. The checks are set to refuse a photograph showing a prominent identifiable face — unless it is a verified business posting at its own premises — a readable licence plate, or an identifiable child; to blur to an area one that reads as a private home; and to hold for review one showing a readable house number, whose digits are stripped from the text stored with it. A second automated check runs shortly after the post is published. These are automated checks, not a warranty of the result: report anything that should not be on Spotago, and ask for a second look at a refusal. No person looks at photographs as a matter of routine. OpenAI processes this under its API terms, under which the data is not used to train its models; OpenAI states it may retain API inputs for up to 30 days to monitor abuse.
• Derived data. The description, tags, a place category, numerical “embeddings” of the picture and the text (used for search and ranking), a rarity score, and the screening verdict. The verdict is kept, keyed to the post rather than to you, as evidence of what the system decided and with which models.
• Languages. The app tells us the language your phone is set to (or the one you chose in the app’s Settings), and we keep it with each post you make. Shortly after a post is published, the photograph and its English description are sent to OpenAI once more to write the caption and description in that language, and in the language of the country the photograph was taken in, so that readers there see the post in their own language. A caption you typed is kept exactly as you typed it; a copy in English is made from it for search and screening. These texts are stored with the post, go through the same checks as the English, and are deleted with it. Readers see the language their own phone is set to, and can see the original.

Questions and answers

From a place's page you can ask a short question about it — “Is it windy right now?”, “Is the market on?” — and people who are at that place can answer with a tap, or with a few words. Both sides are anonymous to each other: the person asking is never told who answered and the person answering is never told who asked. A question you type, and an answer somebody types, is checked and rewritten into a short neutral form by our AI provider (OpenAI, as a service provider acting on our behalf) before anyone else sees it; a question or an answer about a person, a vehicle or anything that could identify someone is refused. Nobody ever sees the original words. A question lives for an hour, and whoever asked it can read it and its answers for a day after; its answers are kept with the place for half an hour so the same question need not be asked twice. For abuse handling we keep the text of a question with a scrambled form of the asking account for 30 days, and an answer with a scrambled form of the answering account for 7 days, readable only by us and only with a written reason; nothing else about a question or an answer names an account. The count of times your answers were marked useful is kept with your account and shown only to you.

To be asked, your phone decides on its own, from map data it holds, whether it is inside a public place in our list — a beach, a park, a market, a square, a pool, an attraction, a stadium, a ski area, an airport, a shopping centre — and after three minutes there tells us that place's name and nothing else: never a coordinate, and never where you live or work, which the phone recognises by the hours you spend there and keeps to itself. Bars, cafés, pubs and clubs are different: the app never decides you are inside one. While Ask there is on and you are out, once your phone has stopped somewhere for three minutes it tells us the names of the ones within about 80 metres of it, at most five, so a question about one of them can reach you; walking past sends nothing. That list is kept for 20 minutes, is never a coordinate, and is not sent from the place you started or from a phone that has not moved for three hours. Only if you choose to answer does anyone learn you were there, and then only as an anonymous answer.

Collections

A collection is a list of places to photograph. The app draws some up by itself for the area around you, from OpenStreetMap data, and you can ask for one on a topic of your own — “murals”, “the best viewpoints” — around where you are or around a place you name. The topic and the place name go to our AI provider (OpenAI, as a service provider acting on our behalf) to be read as a kind of place and, for a topic that asks for judgement, for the places it knows; nothing about your account goes with them. The place name you typed goes to OpenStreetMap’s Nominatim geocoder, with a wide region around you so that the nearer of two places by that name wins; the area — a point coarsened to about 100 metres, and a radius — goes with the kind of place to OpenStreetMap’s Overpass servers, which answer with the public map features there; for some lists the public ids of map items go to Wikidata. The list that comes back is kept in a shared cache, keyed by the topic and a 5 km cell, so the next person asking the same gets it at once; nothing in that cache names an account. While a list is being drawn up, the request — the topic, the point, the result — is kept with your account for at most a day. A list you make — its title, intro and places — belongs to your account until you delete it or the account, and is shown only to you. Your progress is not stored: it is read from your published, exactly placed photographs whenever a list is shown. Finishing a list is recorded once, kept with the account, and announced once in the bell. Once you have finished a list you can mint a share link; whoever has it sees the list, which places you collected and your own photographs of them, which are public already, and nothing that names you; you can end the link at any time.

Location

Location is the point of the app, and the one thing about it we handle most carefully. The app asks for location permission and uses it only while the app is open — and, only if you switch on answering questions, while it is minimised, as the last item in this list describes. It never asks for “always” (background) location.

• When you post. The precise GPS position at capture is stored with the post. What is published depends on where you stood. At a public place in our list — a park, a beach, a landmark, a shop — the post is pinned at the spot it was taken, by default. Anywhere else, what is published is a shifted point: the position is snapped to an area about 100 metres across, and every post in that area is shown at the same shifted point, so nobody can narrow it down by comparing posts. Where few other people's photos or public places are nearby the area is wider, up to about 1.6 km. Where the check reads the photograph as a close-up of a private home, the post is blurred to an area whatever it stands near; a private interior is blurred too, unless it stands at a public place such as a hotel. A pin is refused on either. You can also pin a post yourself, for a stated reason — a sale, an event, a hazard, a lost animal — which an automated check compares with the photograph; such pins expire on their own. Exact locations can be switched off for new posts in Settings, and any post of yours can be blurred back to its area at any time.
• How the position is read. The app reads your position while the camera is open. If your phone had no position when you saved a photo, the photo is kept on your phone and the app goes on reading your position — for up to two minutes after the photo was taken, and only while the app is open — so that it can post it. If no position comes in that time, the photo stays on your phone and is not posted; you can delete it from My Posts. With each post the app also sends what your phone said about the reading: how accurate it was, how long before or after the photo it was measured, how fast the phone was moving, and whether the phone marked it as simulated. These are kept with the post, are not shown to anybody, and hold no position. A post whose position cannot be relied on — an old or vague reading, a moving vehicle, a photo that had to wait — is published as an area and never pinned. A position the phone marks as simulated, or one that is impossibly far from your previous photo for the time between them, is refused and the photo is not posted.
• Whether the app is genuine. A position is only worth what the phone reporting it is worth, so when you post, the app may ask the maker of your phone's operating system — Google Play on Android, Apple on iPhone — to vouch that this is the real Spotago app, unmodified, on a phone that has not been tampered with. That request goes to Google or Apple under their terms; what comes back to us is a verdict, a word such as “genuine”, and we keep that word, the platform and the time with your account for 90 days. No identifier of the phone reaches us this way. Since 11 October 2026 the verdict decides: a photo from a phone the platform will not vouch for is not posted, nothing of it is stored, and the app tells you so beside the photo. The same applies to any photo already waiting on that phone, because the position it was taken at can no longer be vouched for. If the platform cannot be reached, the photo waits on your phone and is sent again later.
• The place a post names. A pinned post may say “Taken at” or “Taken near” a public place. The name is chosen by a rule from the public places within about 60 metres of where you stood, and says where the photo was taken from, not what it shows. You can change it to another of those places, or remove it, in My Posts. A business's name is taken off a post while a report about that post is open.
• When you browse. To show what is near you, the app sends the point you are asking about — your position for “near me”, or the middle of the map if you have panned somewhere else — and the server answers. That point is used to answer the request and is not stored: the only trace is the general region it falls in, about 25 km across, in a usage record (below), kept at most 90 days. Nothing finer than that region is kept about where an account has browsed.
• Place names come from your phone's own geocoder, which means Google's on Android and Apple's on iOS; the coordinate being named goes to them under their terms. Map tiles come from MapTiler (MapTiler AG, Switzerland; the map data is OpenStreetMap's), whose servers therefore see which area of the map you are looking at and your IP address, as any map does. The app keeps the tiles it has shown on your phone for two weeks so it need not ask again.
• Answering questions about places. If you switch on Settings → Answering questions (it is off until you do), Spotago reads a coarse position — about a kilometre, from the phone's cell and Wi-Fi signals — while the app is open or minimised, so that your phone can notice it is at a public place such as a beach, a park, a market, a square, a stadium or a viewpoint, and show you questions other people have asked about that place. The matching happens on your phone, against a list of public places it downloads for the 25 km around it about once a day (the position of that one request is used to answer it and not stored). While you are anywhere else — at home, in a shop, on the road — nothing is sent. When you are at a public place, the app sends the name of that place, that you have arrived, and later that you have left; it never sends a coordinate. Your phone shows this state the whole time: on Android a quiet notification that reads “Not answering questions here · nothing is sent” or “Available to answer questions here”, on iPhone the blue location indicator. Closing the app ends it, as do the quiet hours you set, a low battery, and the Pause button. Your phone also keeps for itself a list of places it is at for hours or on most days — home, work — and never reports those; that list, and the places you mute, stay on the phone. What the server holds — which public place an account is at — lives in memory only, under a scrambled form of the account id, for at most four hours, and is never written to a database, a log or a backup.

What you do in the app

We record the ordinary actions the app needs to work and to rank your feed: the posts you like, save and view, how long you looked at a post, which posts were shown to you, the reports you file, the accounts you block, and the feedback you send (which carries the app version and the platform, “android” or “ios”, and nothing else about your phone). From your likes and dwell time the server keeps a taste profile — a numerical summary of what you tend to look at — used to order your feed and, on a walk in the app, to pick out a few of the places and photos along the way for you. You can also tell the app what you like on a walk (coffee, views, history and so on) in Settings; that choice is kept with the profile and used for the same purpose, and nothing else. Nothing about it is shown to anyone, and no place pays to be picked out. All of this is deleted with the account.

Usage records

Two small, closed lists of events, kept to understand whether the app works. The server records feed page, place view, search, place search and upload, each with a few fixed fields such as the feed mode, the number of results, the general region (about 25 km across) and whether a feed was centred on a place you chose rather than where you are. The words of a search are not kept on these records: searches are counted separately, not tied to your account, and a search appears in our totals only when several different people have made it. The app itself reports six things the server cannot see: onboarding completed or skipped, an offline render, a location-permission result, the cold-start time, and a client error — as a code fingerprint, with no message, no stack trace, no screen name and no coordinate. The server refuses any event carrying a position.

Raw events are tied to your account while it exists, detached from it when you delete, and kept for at most 90 days, after which only aggregates remain: daily totals, retention by month, and which areas people travel between. Those aggregates name no one and are only written when several different accounts contribute. No third-party analytics or crash-reporting SDK is in the app or on the server, and nothing leaves our systems.

Server logs

Each request leaves one log line: time, route, status, duration, a coarse platform name and the account id. No query string, no headers, no body, no coordinate, no full user-agent string. Your IP address is not written to that log at the normal setting. One place keeps a shortened form of it: the sign-in record below. Logs are kept by our hosting provider for a short fixed period, no more than 14 days.

If you file a report or a takedown notice, from the app or the form, the account it came from and the IP address it was sent from are kept with it, so it can be acted on and so that abuse can be traced — and are removed 30 days after the notice is decided. A reported photograph is sent to OpenAI again, with the reason it was reported for, for a first decision on the report; a report of nudity or violence that the check cannot decide goes to a person. An address that abuses the form is blocked, and the block record is deleted 30 days after the block ends.

Push notifications

The app can tell you, in its own Activity list, when a place you follow has new photographs, when your weekly summary is ready, when your taste profile has been written, and when you have earned invite codes. That list is always on. A push notification — the same thing arriving on your phone's lock screen — is optional and off until you turn it on, either by ticking “Also send a push notification to my phone” when you follow a place, or under Settings → Notifications, one switch per kind. Your phone's own permission prompt appears the first time you do, and never at launch.

When push is on, the app registers with Firebase Cloud Messaging, a Google service, which assigns your phone an installation identifier and a registration token. That token is the address a notification is sent to and is used for nothing else: it is not an advertising identifier, it is never shown, logged or answered back by our server, and it is not linked to anything but your account and the platform and language your phone reported. A notification carries the same words as the Activity entry it mirrors — the title never names a place, so the lock screen shows nothing about where you follow — and nothing is sent that Activity would not show. The token is deleted from our server when you sign out, when you delete the account, and when Google reports it no longer valid. No Firebase product other than Cloud Messaging is used: no Analytics, no Crashlytics, no Firebase sign-in, and no Firebase database.

Questions and answers use the same registration token and three notifications of their own, which do not go through the switches above because asking is the consent: a question for you to answer (shown by the app itself, from its own check that you are still at the place), “An answer to your question”, and “An answer of yours helped someone”. None of them names a place on the lock screen.

Who else touches it

These providers process data on our behalf. Nobody else does, and nothing is sold, rented, or shared for anyone else's advertising or profiling.

• Render — runs the server and the database.
• Cloudflare — stores and serves the photographs, and hosts this website.
• OpenAI — receives each photograph and its text at upload, for description and screening, and a photograph that has been reported, for a first decision on the report; and the topic you give a collection, with the name of the area, and the questions and answers you type, to be read and rewritten, as described above.
• GitHub — holds our private issue tracker. A problem report you send from the app is filed there: the words you wrote, its category, the app version and the platform. Your account id is not sent.
• Google or Apple, as the maker of your phone's operating system — the geocoder that turns a coordinate into a place name.
• Google (Firebase Cloud Messaging), only when you have turned push notifications on — receives the words of each notification and the registration token of the phone it goes to, as described under Push notifications. On an iPhone the notification is handed on to Apple's push service in the same way.
• MapTiler — the map tiles (OpenStreetMap data).
• OpenStreetMap services (the Nominatim geocoder, and the Overpass servers at overpass-api.de, overpass.kumi.systems, overpass.openstreetmap.fr and overpass.private.coffee), when a collection is drawn up — receive the place name you typed and the area asked about, coarsened to about 100 metres, with the kind of place sought; never your account or your exact position.
• Wikidata, for some collections — receives the public ids of map items, nothing else.
• Google Play (Play Integrity) or Apple (App Attest), when you post — asked whether the app and the phone are genuine, as described under Location. They answer with a verdict; they do not receive the photograph or the position.
• Google Maps, only when you tap a place’s “open in Maps” — the tap hands that place’s coordinate to Google in your browser or Maps app, under Google’s own terms. Nothing is sent unless you tap.

Our servers and storage are located in the United States, so if you use Spotago from Czechia or anywhere else outside the United States, your data is transferred there. For personal data coming from the European Union, these providers process it under the European Commission’s Standard Contractual Clauses or, where the provider is certified, the EU–US Data Privacy Framework; each publishes its terms, and you can ask us for a copy of the ones that apply. There are no advertising networks, no analytics or crash-reporting services, and no social feed of any kind. The one push notification service, Firebase Cloud Messaging, is used only when you have turned push on, and only to deliver the notification. Google sign-in can be attached to an account if you choose; Google then learns that you signed in to Spotago, under its own terms.

Legal process. We disclose data to authorities only when legally required — a valid subpoena, court order or equivalent — disclose no more than the order names, and tell the affected account unless the law forbids it. Child-safety matters are reported to NCMEC as US law requires; see spotago.com/child-safety.

Why, and on what legal basis

To run the service you asked for — storing and showing posts, ranking a feed, keeping people safe (performance of a contract); to keep the app secure and abuse-free, and to understand in aggregate whether it works (legitimate interests); and, for the linked email address and for your precise position at capture, your consent, which you give by linking or by allowing location access and can withdraw by unlinking, revoking the permission, or deleting the account.

How long it is kept

• Your account, posts and everything they own — until you delete them.
• Raw usage events — at most 90 days; aggregates that name no one are kept.
• Which posts were shown to you (impressions) — at most 90 days, so the feed can stop showing you the same things; detached from the account when you delete.
• Screening decisions and review-queue records — kept as an audit record, keyed to the post, not to an account.
• Takedown notices and reports — the address, text and IP on a notice are removed 30 days after it is decided; the decision itself is kept as an audit record.
• Error fingerprints (a code, no message, no personal data) — at most 90 days.
• Device blocks — while the block stands; abuse flags on an account expire after 30 days.
• Genuine-app verdicts (the word, the platform, the time) — at most 90 days, and deleted with the account.
• Sign-ins (the method, the time, the app build and your IP address with its last part dropped) — 30 days, shown to you under Settings as your sign-in activity, and deleted with the account.
• Push registration tokens — until you sign out on that phone, delete the account, or Google reports the token invalid; the record of which notifications were sent is a timestamp on the Activity entry, deleted with the entry after 90 days.
• Which public place you are at (answering questions, when switched on) — in memory only, at most four hours, never in the database or a backup; questions — an hour, their answers half an hour with the place; the text of a question with the asking account 30 days and an answer with the answering account 7 days, scrambled, for abuse handling.
• Collections you make — until you delete the list or the account; the record of a list you finished — with the account; a request for a new list (the topic, the area, the result) — at most a day while it is drawn up; the shared cache of drafts — keyed by topic and a 5 km cell, names nobody, kept while useful.
• Server logs — at most 14 days.
• Backups — age out on their own short cycle and are never restored into the live service.

Deleting

Settings → Account → Delete account removes, immediately and permanently: your posts and the image files behind them, your likes and saves, your taste profile, your reports, blocks and invites, any linked email and password, the push registration of every phone signed in to it, and the account itself. Usage records are detached from the account rather than removed, so that past totals stay true, and nothing in them points back at you. A problem report you sent from Report a problem is handled the same way: its link to your account is removed, and the words of the report are kept on our issue tracker, with no account attached, so that the problem can still be fixed. If you no longer have the app, spotago.com/delete-account does the same thing with your email and password, or takes a request we fulfil by hand within 30 days. Single posts can be deleted from My Posts at any time, and the photograph goes with them.

If a photograph shows you, your home or your car and you did not post it, report it in the app: open the photograph's menu, choose Report, and pick This is my home, This is me or This shows a child. From an account with an email, Google or Apple sign-in attached, such a report takes the photograph down at once and a review confirms or restores it within minutes — by AI, and by a person when needed; from any other account it is reviewed the same way first. Under This is my home you can also ask for the area around your home to be protected, so photographs taken there are held for review before anyone sees them; each account may protect two areas, and asking for a third goes through support@spotago.com. If you do not have the app, the takedown form on the web takes the same notice from an account signed in with its email and password — paste the photograph's share link. Notices are never anonymous, so the channel cannot be used against people. If you have no Spotago account at all, email hello@spotago.com with the link to the post and we will deal with it by hand within 30 days.

If you are not a Spotago user

A photograph taken in a public place can show you, your home or your car even though you never used Spotago. What may then exist about you: the photograph itself, the place it was taken (an area from about 100 metres to about 1.6 km across, unless it is a public place or the person who posted it pinned the spot for a stated reason), an AI description of the scene that names no one, and — if you asked for something — the record of that request, whose contact details are removed 30 days after it is decided.

To have a photograph of yourself, your home or your car removed or blurred, email hello@spotago.com with the link to the post. A claim about a person or a home from someone without an account is acted on with priority — within 72 hours, and usually within minutes, because the same automated check that handles in-app reports handles it. Anything involving a child goes to safety@spotago.com and is handled first, as spotago.com/child-safety describes.

Your rights

The beta is offered in the United States and Czechia. Wherever you are, you can ask for a copy of what is held about you, ask for it to be corrected or deleted, object to or restrict processing, or withdraw consent at any time; where the law where you live grants these as rights — California’s CPRA, the EU/UK GDPR — we honour them as such, and you can also complain to your authority. We do not sell or share personal information as those terms are defined in California law. In practice the fastest route to deletion is the Settings screen, and the fastest route to a copy is Settings → Download my data - it carries your account, posts, likes, saves, reports, invites, blocks and the AI-written taste summary; the last 90 days of raw usage events are available on request. For anything else, email hello@spotago.com and we will deal with it within 30 days. Because most accounts carry no name or email, we may ask you to prove the account is yours, usually by pointing at a post you made.

If you are in Czechia or elsewhere in the European Union

The General Data Protection Regulation (GDPR) applies to how we handle your data, and everything above is written to meet it. The parts that matter most to you:

• Who is responsible. Spotago LLC, a company in Washington, USA, is the controller. Reach us at hello@spotago.com; that address is also our single point of contact for authorities and users under the EU Digital Services Act. Write in English.
• Why we may use your data. The legal bases are the ones named under “Why, and on what legal basis” above: the contract with you, our legitimate interests in a secure and working service, and your consent for a linked email address and for your precise position when you take a photograph.
• Your rights. Access, correction, deletion, restriction, objection, data portability, and withdrawing consent at any time — exercised as “Your rights” above describes, free of charge, answered within one month.
• Automated decisions. Photographs are screened, and reports and takedown notices are first decided, by automated systems; repeated violations can lock an account automatically. You can contest any of these decisions: write to hello@spotago.com and tell us your side. A contested decision is looked at again, by a person when needed.
• Transfers. Your data is stored in the United States under the safeguards described in “Who else touches it”.
• Complaints. You can complain to the data protection authority where you live. In Czechia that is the Úřad pro ochranu osobních údajů (uoou.gov.cz). We would like the chance to put it right first.

Children

Spotago is not for anyone under 18 and we do not knowingly hold data about them. If you believe a child has an account, tell us and it will be removed. A photograph in which the checks identify a child is refused at upload: two separate automatic checks agree before a refusal is final, and when they disagree the photograph is held for human review instead of being published. If you believe a refusal is a mistake, email hello@spotago.com. Our full child-safety standards are at spotago.com/child-safety.

Security

No biometrics. We do not create or store face templates or any biometric identifier. A photograph the check reads as showing a prominent recognisable face is refused, unless it is a verified business posting at its own premises. The embeddings of a refused photograph are deleted when the refusal is made.

Everything travels over HTTPS. Passwords are stored as salted scrypt hashes. The server deletes only the account whose credential makes the request; no request can name another account. The precise capture position of a post that is shown as an area is never served, to anyone, by any route.

Changes

If this policy changes in a way that materially affects data already collected, the app will say so. Smaller corrections are simply dated here.

How this maps to Google Play's Data safety labels

For anyone checking the store listing against this page.

Data is encrypted in transit. Users can request deletion, in the app and at spotago.com/delete-account.

↑ Top of the app policy

The website, spotago.com

One email address, and only if you give it.

This part is about the pre-launch website at spotago.com and its waitlist. It asks for one thing, an email address, and only if you offer it. Everything else below is the short version of how a website works, written out so you can check. The app's data is covered above; nothing here describes it.

What is collected

If you sign up, the waitlist record holds:

• Your email address. The one thing that is actually required.
• A city, if you typed one. Optional, and used to decide which city Spotago opens in first.
• The country your request came from, as a two-letter code that Cloudflare attaches to the request. Same purpose: working out where to launch.
• How you reached the site — the campaign tags on the link you followed, and the site that linked you, kept as a domain and path only. This tells us which advertising is worth continuing and which is wasted. Any query string on the referring link is discarded before the record is written.
• The date and time you signed up.

Whether or not you sign up, the site uses Cloudflare Web Analytics to count visits: pages viewed, country, referring site, and general browser and device type. It sets no cookies, does not follow you to other sites, and is not connected to your signup.

Your IP address is not stored with your signup. Cloudflare, which serves this site, necessarily sees it in order to answer the request at all and keeps it briefly in its own logs, as any web host does. To stop the signup form being used to send mail to people who never asked, we also count recent signups against a salted one-way hash of it — not the address itself, and deleted automatically an hour later. The account-deletion forms are counted the same way.

The only thing stored in your browser is the record of how you arrived, held for the tab you have open so a signup can be credited to the right link. It is not a cookie and it disappears when you close the tab.

If you use the account-deletion page, the email address and password you type are passed once to the app's server to carry out the deletion and are not stored or logged by this site. A deletion request — the contact address and what you wrote — is kept until it is dealt with, and for at most 180 days.

Why, and on what legal basis

To email you once, when Spotago is ready in a city that makes sense for you, and to count votes for which city that should be. The legal basis is your consent, given by submitting the form. Nothing else is done with your address: it is not sold, not rented, not shared for anyone else's marketing, and not used to build a profile of you.

Who else touches it

These service providers process the data on our behalf, and nobody else sees it:

• Cloudflare — hosts the site and stores the waitlist.
• Google Workspace and/or Resend — deliver the confirmation email.

These providers may process data outside your country, including in the United States, under the standard contractual protections they publish.

How long it is kept

Until Spotago launches and you have been told, or until you unsubscribe — whichever comes first. If the project is abandoned, the list is deleted rather than kept or passed on.

Your rights

If you are in the UK, EU, or somewhere with comparable law, you can ask for a copy of what is held about you, ask for it to be corrected or deleted, withdraw consent at any time, or complain to your data protection authority. In practice the fastest route to deletion is the unsubscribe link. For anything else, email hello@spotago.com and we will deal with it within 30 days.

Children

This site is not aimed at children and we do not knowingly collect their data. If a child's address has ended up on the list, tell us and it will be removed.

Changes

If this policy changes in a way that materially affects data already collected, we will say so to the list. Smaller corrections are simply dated here.

Who we are

Spotago is operated by Spotago LLC, which is the data controller for everything described on this page. For anything here, write to hello@spotago.com.

↑ Top of the website policy