Privacy Policy

Effective date: October 25, 2026

Data controller: Süleyman Doran, individual developer, Ankara, Türkiye

1. Introduction

Spot is a shared event-photo app. This Privacy Policy explains what information we collect, why we collect it, and how we protect it when you use the Spot app, App Clip, website, waitlist, invitation pages, or partner features (together, the “Service”). Spot is operated by Süleyman Doran, an individual developer based in Ankara, Türkiye, who is the data controller for the personal data described in this policy.

2. Information We Collect

We collect only the information needed to operate the Service.

Account and profile information. We create an anonymous account identifier for your device. If you choose to sign in, we may collect the information provided through email, Sign in with Apple, or Google Sign-In. We also collect the display name you choose.
Photos and event data. We store photos you take in the app, their styled copies, capture time, uploader identifier, and the Film to which they belong. We also store Film names, dates, cover images, invite codes, QR codes, participant and capture limits, reveal settings, camera styles, and organiser/co-organiser settings.
Notification data. If you allow notifications, we store a push token (an Apple Push Notification service token on iOS, or a Firebase Cloud Messaging token on Android) to deliver event notifications and Live Activity updates.
Purchase and referral data. We process one-time purchase entitlements, referral-code use, and related account identifiers. Apple handles payment-card information. Where RevenueCat is used to manage purchases, it receives only the identifiers needed to provide purchase entitlements.
Partner data. If you join our partner (referral) programme, we process your name, partner code, contact email, IBAN, partner type, and the usage and commission records linked to your code, so that we can calculate and pay commissions.
Security and support data. We collect limited technical information such as IP address, request time, rate-limit records, browser/device information, and the messages you send to support. We use this information to prevent abuse, keep the Service secure, and answer support requests.
Usage and diagnostics information. To understand how the app is used and to fix problems, we collect product usage events (for example, that a Film was created or joined, a photo was captured, or photos were saved or shared, together with settings such as the camera style or the number of photos), the screens you view, and technical details such as a randomly generated app-instance identifier, device model, operating-system and app version, language, and approximate country or region derived from your IP address. If the app crashes or an error occurs, we collect a crash report with the error details and the same kind of technical information. These events do not include your name, email address, photos, Film names, or invite codes.
Website information. If you join the waitlist, we collect your email address. Our website uses local storage for language preferences and Google Fonts, which may receive your IP address when fonts are loaded.

We do not collect device location, contacts, microphone data, health data, advertising identifiers (such as IDFA or the Android Advertising ID), or cross-app tracking data. We do not sell, rent, or trade personal data, and we do not use advertising networks or behavioural advertising. Photo EXIF/GPS location metadata is removed before storage.

3. How We Use Information

We use information to:

create and maintain anonymous, guest, and signed-in accounts;
create Films and let invited guests join, capture, upload, view, save, and share photos;
apply selected camera styles and reveal photos at the chosen time;
manage invitations, QR codes, co-organisers, limits, access, one-time purchases, and referral features;
send notifications or Live Activity updates when permission is granted;
understand which features are used, measure how the Service performs, and find and fix crashes and errors;
respond to support requests, moderate reported content, and prevent fraud, spam, and other misuse; and
meet legal obligations and protect the rights, safety, and security of Spot and its users.

4. Photo Privacy and Album Access

Photos, display names, and event information are visible only to people who have access to the relevant Film, including its organiser and co-organisers. A Film can be configured to keep photos hidden until its reveal time.

Guests and organisers can save photos to their devices or use the iOS sharing tools. Once content is shared outside Spot, the recipient’s handling of it is outside our control.

Before uploading a photo, make sure you have the necessary permission to photograph and share every person shown, especially children and people in private settings.

People who appear in photos. Photos may show people who do not use Spot. We process these images only to provide the shared album to the Film’s members. Anyone who appears in a photo can ask us to remove it by using the in-app Report feature or by emailing [email protected]; we will review the request and remove the photo where appropriate.

Automatic hiding. A photo that receives reports from three different members is hidden automatically until we review it. This is a temporary safety measure; the final decision is made by a person.

5. Service Providers and Data Sharing

We use carefully selected providers to run the Service:

Supabase for authentication, database, storage, and backend functions. Our primary data region is AWS eu-central-1 in Frankfurt, Germany.
Apple for App Store distribution, in-app purchases, Sign in with Apple, APNs, and Live Activities.
RevenueCat for one-time purchase entitlement management.
Cloudflare for the website, invitation pages, partner pages, and DNS.
Google for Google Sign-In, Google Fonts, Firebase Analytics (product usage statistics), and Firebase Cloud Messaging (Android notifications). Firebase data may be processed in the United States.
Sentry for crash and error reporting. Crash reports are stored in the European Union (Germany).

These providers process information only as needed to deliver their services to us. Supabase, Google/Firebase, Sentry, RevenueCat, and Cloudflare process personal data on our behalf under data processing agreements. Apple (for the App Store and payments) and Google (for Google Fonts) act under their own terms and privacy policies. We may also disclose information where required by law, to protect rights or safety, or as part of a merger, investment, or business transfer.

Our primary data is stored in the European Union (Frankfurt, Germany). Some providers may also process data in other countries, including the United States. These transfers are covered by the providers’ data processing terms, including the EU Standard Contractual Clauses where applicable.

6. Data Retention and Deletion

We keep account, Film, and photo data until it is deleted by the relevant user or organiser, or until an account is deleted. When a Film, a participant, or a photo is deleted, the related photo files are removed from storage within a day.

Photos. All photos of a Film (originals, styled copies, previews, and full-resolution copies) are automatically deleted 90 days after the Film’s end time. We send the Film owner push notifications 30, 7, and 1 day before deletion, and a final notification once deletion has happened, so they have a chance to save their photos first. The Film itself (its name, dates, settings, and participants’ display names) remains until the organiser deletes it or deletes their account.

Account deletion. Deleting an account deletes your account data, the Films you created together with all of their photos, and your photos and display name in other people’s Films, except where retention is required by law.

Guest accounts. An anonymous guest account that is not converted to a signed-in account is deleted 60 days after it was created. Photos and the display name a guest added to a Film remain part of that Film and follow the photo rules above, including the 90-day deletion.

Other records. Security and rate-limit records are kept for up to 90 days. Product usage statistics are kept for no longer than 14 months, and crash and error reports for up to 90 days. Database backups are deleted within 30 days. Waitlist emails are kept until you unsubscribe or withdraw consent. Support emails are kept for up to 2 years after your request is closed. Partner commission and payment records are kept for the period required by tax law (at least 5 years); other partner data is deleted when the partnership ends.

You can delete your account in the app through Settings > Account > Delete Account. You can also contact us at [email protected] with privacy questions or deletion requests.

7. Legal Bases and Your Rights

We process information to provide the Service you request (performance of a contract); for our legitimate interests in keeping the Service secure, understanding how it is used, and fixing errors; with your consent where we ask for it, such as notifications and the waitlist; and to comply with legal obligations.

Depending on where you live, including under the Turkish Personal Data Protection Law No. 6698 (KVKK) and the EU General Data Protection Regulation (GDPR), you may have the right to: learn whether we process your personal data and request information about it; access, correct, or delete it; restrict or object to its processing, including processing based on our legitimate interests such as usage statistics; receive a copy in a portable format; learn the third parties to which it is transferred; withdraw consent at any time; and lodge a complaint with a data protection authority, such as the Turkish Personal Data Protection Authority (KVKK) or your local EU supervisory authority.

To exercise these rights, contact us at [email protected]. We will respond within 30 days. Users in Türkiye can read our Turkish-language information notice under KVKK at spontanea.app/kvkk.

8. Security

We use reasonable technical and organisational safeguards, including HTTPS/TLS in transit, encryption at rest, private storage, temporary signed links, row-level access controls, upload limits, rate limits, multi-factor authentication on administrative accounts, automatic deletion schedules, and restricted backend access. No method of transmission or storage is completely secure, but we work to protect your information from unauthorised access, alteration, loss, or disclosure.

If a personal data breach occurs, we will notify the competent authority (for example, the Turkish Personal Data Protection Authority within 72 hours) and affected users without undue delay where required by law.

9. Children’s Privacy

Spot is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe that a child has provided personal information to us, contact us and we will take appropriate steps to delete it.

10. Changes to This Policy

We may update this Privacy Policy when the Service or applicable law changes. For significant changes, we will provide notice in the app, by email, or on spontanea.app/privacy. The effective date above shows when this version took effect.

11. Contact Us

For questions about this Privacy Policy, your personal information, a content report, or account deletion, contact us at [email protected].

This English version controls in the event of a conflict with a translation, subject to any mandatory local law.