SpotoSpot: Live Your Day, Spot by Spot

1. Who We Are

SpotoSpot ("we") operates the SpotoSpot website and mobile app from California, United States, and is the controller of the personal data described in this policy. For anything privacy-related, contact privacy@spotospot.com.

2. Information We Collect

Account information: email address, display name, avatar configuration, and a record of the Terms version and minimum-age confirmation you accepted at sign-up.
Trip content: itineraries, notes, saved places, and images you create or upload. This includes a photo you attach to a stop, a photo you upload as the cover of a trip or a day, and a photo you upload as your profile picture. Before the app uploads any of them it re-encodes the image, which removes the metadata a camera writes into it: the GPS coordinates it was taken at, the device, and the timestamp. That matters most for a profile picture, which is usually taken at home. The file we store carries none of those tags.
Where and when a photo was taken: one exception to the line above, in the mobile app, when you add a photo to a stop. Before re-encoding the picture the app reads two things out of it: the time it was taken, and the coordinate it was taken at. The time is used to date your arrival at that stop, so a photo from an hour ago puts the stop an hour ago rather than at the moment you pressed save, and that arrival time is saved with the stop. The coordinate is sent to us in one case only: the camera shortcut that creates a stop straight from a photo you have just taken, where it is what lets us match the place in the picture against our own place data. Add a photo to a stop you are already describing and the coordinate never leaves your phone. The file we store is stripped either way.
Travel documents: files you upload to a trip (boarding passes, hotel and booking confirmations) and the booking details extracted from them: traveler names as printed on the document, confirmation codes, flight numbers, seats, addresses, and dates.
Location data: described in full in section 5.
Health and fitness data: described in full in section 6. Only the mobile app collects it, only during a live day, and only if you allow it.
Messages: what you write in a trip's chat in the mobile app, and the photos you send there.
Searches: the places and destinations you search for, kept so the app can offer them back as recent and saved searches. You can clear the whole history from Settings.
Reports and support messages: what you send us when you report content or contact us.
Android launch notice: if you ask to be told when the Android app ships, the email address you give us. You do not need an account to ask, and we do not create one. It is used for that single email and nothing else and is never added to a mailing list. Once the notice has gone out we keep the address only so that a later send cannot email you twice. If the address belongs to a SpotoSpot account, deleting that account deletes it as well, whether or not you were signed in when you asked.
Crash and diagnostic data: in the mobile app only. If it crashes or hits an error, a report goes to our error-reporting provider so we can fix it. The report carries the fault, your device model and OS version, and your account's internal id. Before it leaves your phone it is stripped of everything else that could identify you or say what you were doing: your email address, your name, your position, and the contents of anything you have written or searched for. See section 7.

We do not run analytics or advertising trackers. Nothing on the Service measures what you look at, how long you stay, or what you tap, and there is no advertising or cross-app identifier anywhere in it. The crash reporting above is the one thing the app sends without being asked, and it reports faults rather than use. If either of those ever changes, we will ask for your consent first and update this policy.

3. How We Use Your Information

To provide and improve the Service.
To personalise your experience (e.g. suggested destinations and plans near you).
To send transactional emails (trip invites, notifications you opted into).
To monitor and prevent abuse of the platform.
To send the push notifications you turned on, to the device you turned them on from.
To record what a live day was like for you, including the figures in section 6.
To find and fix crashes and errors in the app.
To power the AI features described in the next section.

4. AI Features

These features send your content to AI companies that process it on our behalf. There are two of them, and these are the models each one runs your content through:

OpenAI: GPT-4.1.
Anthropic: Claude Haiku 5.5, Claude Sonnet 5.5.

Under our agreements with both, content sent to their APIs is not used to train their models. A single request may go to either company: one is the primary and the other is the automatic fallback when the first is unavailable, so we name both rather than imply your content only ever reaches one of them. Photo safety screening, the last item in the list below, is the exception: it runs on the moderation model at OpenAI and nowhere else.

The first four are optional and you control them. We ask before any of them runs, and nothing is sent until you say yes. You can turn them off again at any time in Settings → Permissions, under Smart suggestions, and when they are off nothing is sent to either company. Everything you can do with them, you can do by hand: type a booking in, write your own titles and descriptions. The last one, photo safety screening, is different, and the paragraph after the list explains why.

If you turned smart suggestions on before we added the second company, your content goes to OpenAI and nowhere else until you answer the notice asking again, because that is what you agreed to. Everything keeps working in the meantime, and declining to widen it takes nothing away.

Document scanning: when you upload a travel document, we send the whole file to one of the companies above to extract the booking details listed in section 2. On the website this runs automatically once you have turned smart suggestions on, and you can also run it later from the Scan button on a file you already uploaded. The Documents panel says so, and names the companies, before you pick a file and before the Scan button does anything. Turn smart suggestions off and nothing is sent; the Add flight and Add stay buttons beside the uploader do the same job by hand.
Activity details: when you add a place to a plan (including by checking in during a live day), we send the place's name, address, and coordinates, plus any short note you typed, to suggest a title, description, duration, and cost. On the website, if you ask for a description of a stop that has a photo staged, that photo is sent with it.
Day descriptions: when you save a day, we send its list of stops, which is their titles, times, and kinds of place, to write a short title and summary.
Reading a photo of a place: in the mobile app, when you use the camera shortcut that adds a stop from a photo you have just taken, we send that photo to one of the companies above to work out what it shows, including any name or wording visible on a sign in it. What comes back is a suggested title, description, and kind of place, which you review and correct before anything is saved. This runs only on that shortcut, where reading the photo is the point of it. A photo you attach to a stop you have already named is screened (next bullet) and not described.
Photo safety screening: when you attach a photo to a stop, or upload one as a cover or as your profile picture, we send the image to OpenAI's moderation model, and only there, to check it before it is stored. A photo that does not pass is refused and never saved. We also screen a cover photo that reaches a public page without having been checked at upload, such as a picture shared in a plan's chat and then chosen as its cover. If that screening does not pass, the photo is removed from the public copy of the plan, you are told, and the plan is referred to a human reviewer.

Photo safety screening is not one of the optional features and has no switch. Every photo that reaches us is checked before it is stored, whatever your smart-suggestions setting says. It is there to keep illegal and harmful images off the Service, including off the trips other people can see, and a check you could decline would not be a check: refusing it would mean storing the photo unscreened. It reads the image to classify it and nothing else, no title and no description comes back from it, and it is the one thing in this section that runs whether or not you have turned the rest on.

Uploaded documents are visible to everyone on the trip by default. The upload panel lets you mark an upload as visible only to you.

5. Location

Location powers maps, nearby plans, local weather, and live days. Here is exactly what we read, what we store, and who can see it:

Reading your position. If you have granted location permission, the app reads your approximate position when you open it, to center maps and show plans and weather near you. It never triggers a permission prompt on its own, and the website does not track your location in the background. You can stop all location use with the toggle in Settings → Permissions.
Live days on the mobile app.If you start a live day in the mobile app and turn on route tracing, your position is tracked for that day, including while the app is in the background, to draw your route and check you in as you arrive at stops. The day's route is saved to its recap; deleting the recap deletes the route. This is the one place SpotoSpot tracks location in the background: it runs only during a live day you started, and it stops when the day ends or you stop it.
Check-ins. Checking in at a stop stores the place and time, visible to the people on that trip or plan.
Sharing your live location. If you share your position with trip mates, it is visible to them for the window you choose and is deleted automatically after that window ends.
Publishing. A published plan shows its stops, their times, and its destination area, not your GPS position.

6. Health & Fitness

Only the mobile app measures these. A browser cannot count steps and the website never asks to. Once a figure is saved with a day, you can see it on either, because it is your own record of your own day.

During a live day, and only if you grant Motion & Fitness when the app asks, the app reads three figures your iPhone has already measured for itself: the steps you took, the flights of stairs you climbed, and the distance you covered on foot. They are read from Apple's motion sensor, which counts them on the device whether or not any app is listening. SpotoSpot does not use Apple Health, has no access to your Health app, and reads nothing else from it.

When it reads them. Only for the stretches of a live day you were recording, so that it can put them on your lock-screen card while the day runs and on the summary of the day once it ends. Nothing is read outside a live day you started.
What is kept.One final figure for each, saved with that day's summary in your account. We do not keep a minute-by-minute record, a history across days, or anything your phone measured while no live day was running.
Who can see them.You, and no one else. These three figures are the one kind of content on SpotoSpot that your trip companions cannot read even on a trip you share with them: they are held apart from the rest of the day's summary precisely so that sharing a trip never shares them. They are never on a published plan, never on your profile, and never visible to anyone you have invited.
When they do leave. If you choose to put them on a share card. The card is drawn on the device you are using, in the app or in your browser, and you pick which figures appear on it. Nothing goes anywhere until you save or send the finished image yourself. Leave them off and they stay off.
How you turn it off.Settings › Permissions has a Step count switch, and iOS Settings has the Motion & Fitness grant behind it. Either one stops the reading. The figures already saved with a past day are deleted when you delete that day's summary, from your past days, or when you delete your account. Worth knowing: deleting the plan or the trip does not remove the summary, because a recorded day is a record of what happened rather than a part of the plan it followed. The summary is its own thing, and deleting it is its own action.
What it is not. These are estimates from a consumer sensor, offered as a record of a trip. They are not a medical or fitness measurement, we do not use them to infer anything about your health, and they are never used for advertising, data mining, or any purpose beyond showing them back to you.

Separately, while a live day is recording, the app compares how fast you are moving to guess whether you are walking, running, cycling, or riding in something, so it can ask whether to mark the change on your route. That guess is a property of the plan rather than of you: if you confirm it, it is saved on the day as the way you travelled that leg, and like the rest of the day's route it is visible to the people that plan is shared with. It is worked out from position alone, not from the motion sensor above.

7. Data Sharing

We do not sell your personal data, and there are no ad networks or data brokers anywhere on the Service. Data is shared only with:

Other users: only content you explicitly make public or share via collaboration invites. Photos you attach to a stop, and photos you upload as a cover, are served from a private store through a long-lived link, so they are visible to everyone the plan is: your collaborators while it is private, and anyone at all once you publish it. That link is not revoked when a plan goes back to private. Removing the photo is what deletes the file and breaks the link. A profile picture works the same way, and is public by nature: it appears next to your name wherever you appear, including on pages anyone can open. If you would rather not be photographed anywhere, the generated avatar is the default and stays available. Removing your photo puts it back.
Platform providers: Supabase (accounts, database, file storage) and Vercel (hosting).
Resend: delivery of the emails we send.
OpenAI: the AI features in section 4, and the photo safety screening described there, which runs on OpenAI alone.
Anthropic: the four optional AI features in section 4. Not photo safety screening, and nothing at all if your answer to the smart-suggestions notice predates it being added.
Expo, Apple, and Google: delivery of push notifications to the mobile app. Turning notifications on registers a token that identifies your device to Apple's or Google's push service, which is how a notice reaches that phone and not someone else's. The token is stored against your account and deleted when you sign out on that device. If you turn notifications off in your phone's settings instead, or uninstall the app, the token stops working immediately and is dropped the next time we try to send to it.
Sentry: the crash and error reports described in section 2. Reporting is off in development builds, and a report carries no email address, name, position, or message content.
Apple: the mobile app asks iOS to name the neighbourhoods a recorded day passed through, which sends those coordinates to Apple's geocoding service under Apple's own privacy policy. Apple is also your sign-in provider if you chose Sign in with Apple, as Google is if you chose Google.
Place-data providers: our servers query Google and Foursquare for place details and openrouteservice for the routes drawn between stops. When a route starts from "where you are", your position is sent as the route's start point. Choosing a cover photo notifies Unsplash of the download, as its license requires.
Legal obligations: if required by law or to protect the rights and safety of SpotoSpot and its users.

Requests your browser makes directly

Some content loads straight from its source, which means that source sees your IP address and the request itself. That is standard for any website, but worth naming:

Map tiles: the basemap (TerraSketch, served via Cloudflare) and, when you turn them on, satellite imagery (Esri) and terrain data (AWS). The request reveals which area of the map you are viewing.
Place photos: venue photos load from Foursquare's and Google's image servers, which see that your browser fetched photos of that venue.
Open-Meteo (open-meteo.com): used for two things, neither of which sends anything that identifies you or your account. For current conditions where you are on the Today page, if you have granted location permission, we send a coordinate rounded to two decimal places (roughly one kilometre), never your precise position. For the ground a recorded day crossed in the mobile app, which is what draws the elevation line on a finished day, we send up to a hundred points sampled along the route you traced, at full precision, and receive the height of the land at each. That is the one request on the Service that sends a precise position to a third party. It happens only for a live day you recorded, and it asks about the terrain rather than about you.

Every data source we render, and the licence it is credited under, is listed on our data sources page.

8. Cookies & Device Storage

SpotoSpot uses only essential first-party cookies, for authentication and session management. These are required for the Service to work and are not used for advertising or cross-site tracking. We also use your browser's local storage for preferences (like theme and map settings) and short-lived working data. None of it is used to track you. We do not use analytics or advertising cookies; if that ever changes, we will ask for your consent first and update this policy.

The mobile app has no cookies. It keeps your sign-in token in the device's own secure keychain, your preferences and a cache of what you were last looking at in its private storage, and, while a live day is running, the few facts its lock-screen card draws in a container shared with that card. All of it stays on your phone, none of it is used to track you, and uninstalling the app removes it.

9. Data Retention

We retain your data for as long as your account is active. If you delete your account, we will remove your personal data within 30 days, except where retention is required by law. Two things worth knowing sooner:

Expired live-location shares are deleted automatically after their sharing window ends.
A photo you remove from a stop, or whose stop or plan you delete, is queued for deletion from our file storage, and its link stops working once that runs. A cover photo or profile picture you uploaded is deleted once nothing points at it any more, which covers one you replaced, one you removed, and one you chose and then abandoned.
Live-day routes, check-in history, and the step, stairs, and on-foot figures from section 6 stay in a day's recap until you delete that recap or your account. They outlive the plan they were recorded against: deleting the trip or the day leaves the recap in place, holding what happened, with no link back to the plan. Deleting the recap is a separate action in your past days, and it takes the route and the figures with it.
Searches can be cleared at any time from Settings, which deletes the history rather than hiding it.

10. Your Rights

Depending on your jurisdiction, you may have the right to:

Access the personal data we hold about you.
Request correction or deletion of your data.
Object to or restrict certain processing.
Export your data in a portable format, available anytime in Settings → Account & security. The download covers your profile and preferences, your trips with every day and item in them, days you built on someone else's trip, your saved places, your notes, your search history, every day you recorded with its route and the figures in section 6, every stop you checked in at, the chat messages you wrote, the travel documents you uploaded along with the booking details read out of them, any live location share still running, which trips you are on, and the todos and meeting points you added. Coordinates come out as readable text rather than as a blob. Three things are not in it and are yours on request at the address below: your friends and friend requests, the accounts you have blocked, and reports you have filed. Each of those says something about another named person, so we would rather hand it over deliberately than put it in an automated file.

To exercise any of these rights, email privacy@spotospot.com. You can delete your account yourself at any time from Settings.

For users in the EEA, UK, and Switzerland:we process your data to provide the Service you signed up for (contract), to keep the platform safe and prevent abuse (legitimate interests), and, for location, for the optional AI features in section 4, and for the step, stairs, and on-foot figures in section 6, only with your permission (consent), which you can withdraw at any time in Settings. Where those figures count as data concerning health under the GDPR, the explicit consent you give at the Motion & Fitness prompt is the only basis we process them on, and withdrawing it stops the processing. Our providers process data in the United States; where required, those transfers rely on safeguards such as the EU–U.S. Data Privacy Framework or standard contractual clauses in our providers' data-processing agreements. You also have the right to lodge a complaint with your local supervisory authority.

11. Security

We implement industry-standard security measures including encryption in transit (TLS) and at rest. However, no method of transmission over the internet is 100% secure.

12. Children's Privacy

SpotoSpot is not directed at children, and you must be at least 18 to create an account (see our Terms of Use). We ask every new account to confirm this at sign-up, and we do not knowingly collect personal information from anyone under 18. If you believe a child holds an account, contact us and we will remove it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice on the Service.