Privacy Policy
Last updated: October 12, 2026
This Privacy Policy explains how Spotary ("we", "us") collects, uses, and protects your personal data when you use the Spotary mobile application ("App"). We comply with the General Data Protection Regulation (GDPR) for users in the EU/EEA.
Data Controller
SIA Horizon C
Registration number: 40203709918
Registered address: Matīsa iela 61A-18, Riga, LV-1009, Latvia
Contact: [email protected]
1. Data We Collect
Account data
- Email address
- Username
- Full name
- Date of birth (used to verify age eligibility)
- Sign-in method: your email address with a one-time code, or Google / Apple sign-in. We do not store passwords.
- Optional residence (chosen from suggested places in the format "Country, City", for example "Latvia, Riga"; free text is not accepted)
- Bio (up to 150 characters)
- Profile photo (if uploaded)
Content & usage data
- Posts, captions, and media files you upload (photos and videos)
- Optional location coordinates you manually attach to posts
- Routes you create (see section 3): route name, ordered points, favourites, and the users you choose to share a route with
- Comments, likes, saves, and other interactions you perform
- Follow relationships and block lists
- Messaging content between you and other users (visible only to conversation participants)
- Support requests and feedback you submit
Technical data
- Device type, operating system, and app version
- IP address and timestamps (for security and abuse prevention)
- Device token (for push notifications)
- Crash reports and error logs (anonymised where possible)
- Anonymous usage analytics (feature interaction frequency; no personally identifiable data)
We do not collect
- Background or continuous real-time location
- Your phone contacts or address book
- Payment data (no payments are currently processed)
2. Location Data
- The App may read your current location to suggest a starting point for the map marker when creating a post, and in Quick Post it pre-fills your current device location (or the location stored in your photo). You can move the marker, switch the location off, or change its source before saving or publishing.
- Adding a location to a post is always optional.
- Followers may see your post location only if you explicitly enable it for that specific post.
- The Community map in "Nearby" mode sends your approximate current location to our server solely to filter nearby content for display. This data is used only to process that individual request and is not stored, logged, or shared with other users.
- Location drafts created while offline are stored only on your device and are never transmitted to our servers. Quick Post drafts (including their location, if included) are stored on your device and uploaded only when you press "Publish" while online.
- We do not store historical movement patterns or background location data.
3. Routes
The App lets you plan routes made of several points on the map.
- What we store: the route name, the order of its points, and for each point either a link to an existing post or a custom point you add (coordinates, title and optional description). Routes you mark as favourite are stored as well.
- Directions are not stored: the path, distance and duration are calculated on the fly by the Mapbox Directions API (see section 6) and shown on your device. We store only the points and their order, not the calculated path.
- Sharing: a route is visible only to you. You can choose to share it with your followers, who can then see the route and its points. If a point is linked to one of your posts, followers see that post's details only if they are otherwise allowed to view that post. You can stop sharing at any time.
- On your device: which points are switched on or off in the route view is stored only on your device (by point ID) and is not sent to our servers.
- Deletion: you can delete a route at any time. Your routes are also deleted when your account is permanently deleted.
4. How We Use Your Data
We use your data to:
- Create and manage your account;
- Display your posts, comments, and profile to users according to your privacy settings;
- Enable social features such as messaging, following, and notifications;
- Send push notifications about activity on your account;
- Detect and prevent abuse, spam, and security threats;
- Diagnose and fix technical issues;
- Measure aggregate app performance and feature usage;
- Comply with legal obligations.
We do not sell your personal data, share it with advertisers, or use it for automated decision-making that produces legal or similarly significant effects.
5. Legal Bases (GDPR)
- Performance of a contract (e.g., providing the App, managing your account, messaging)
- Your consent — for optional features such as location sharing, and for the use of non-essential tracking technologies like app usage analytics.
- Legitimate interests (e.g., maintaining App security, preventing abuse, diagnosing technical errors).
- Legal obligation — where required by applicable law.
You may withdraw consent for optional features at any time in your profile settings.
6. Third-Party Services
We use the following third-party providers to operate the App. Each processes limited data as necessary to deliver their service.
Infrastructure & hosting
- Microsoft Azure (Frankfurt, Germany) — hosts our backend API servers.
- Neon Postgres (AWS eu-central-1, Frankfurt, Germany) — primary database.
Media storage & processing
- AWS S3 — stores user-uploaded images and videos.
- AWS CloudFront (CDN) — delivers media to end users.
- AWS MediaConvert — transcodes and processes uploaded videos.
- AWS Lambda & EventBridge — handle video processing callbacks and status updates between AWS services and our API.
Maps
- Mapbox SDK — renders interactive maps within the App. Mapbox may receive limited technical data such as map tile requests.
- Mapbox Directions API — when you plan a route, the App sends the coordinates of the route's points (and the selected travel mode) directly from your device to Mapbox to calculate the path, distance and duration. This request does not include your name, email, or account identifier.
Sign-in
- Resend — delivers the one-time sign-in code to your email address. Resend processes your email address and the message content (the code, valid for 10 minutes) solely to deliver the email.
- Google Sign-In and Sign in with Apple — optional ways to sign in. If you use them, we receive a verified identity token containing your email address, your name (as provided by Google or Apple) and a unique identifier from that provider. Apple may provide a private relay email address instead of your real one. We never receive your Google or Apple password.
Security & bot protection
- Cloudflare Turnstile — a privacy-friendly challenge shown in some cases during sign-in to tell humans from automated bots. Cloudflare may process your IP address and limited browser/device signals for this purpose.
Push notifications
- Firebase Cloud Messaging (FCM) — delivers push notifications to your device. Only your device token is shared; no message content is stored by FCM.
Analytics & error tracking
- Firebase Analytics — collects anonymous, aggregated usage statistics (e.g. feature interaction frequency). No personally identifiable information is included.
- Firebase Crashlytics — collects frontend crash reports to help us fix bugs. Reports include device type, OS version, and a stack trace; they do not include the content of your posts or messages.
- Sentry.io (EU servers) — collects backend error reports. Reports include your user ID, basic device information, and a stack trace. Sentry is configured to minimise personal data collection.
All AWS and Firebase services used by us are operated within or routed through EU data centres where applicable. We take reasonable contractual and technical measures to protect your data when using these providers.
Where our third-party service providers (such as AWS, Google, or Microsoft) process personal data, this may involve data transfers outside the European Economic Area (EEA), particularly to the United States. We ensure that appropriate safeguards are in place, relying on approved transfer mechanisms such as the EU-US Data Privacy Framework (DPF) or the European Commission’s Standard Contractual Clauses (SCCs).
7. Data Retention
- Technical logs and IP addresses: automatically deleted or anonymised after 30 days.
- Account data: retained while your account is active.
- Routes: retained until you delete them or your account is permanently deleted.
- Messages: automatically deleted after 60 days from the date sent.
- Notifications: automatically deleted after 30 days.
- Account deletion: when you request deletion, your account is immediately deactivated and hidden. You may cancel the deletion by logging back in within 14 days. After 14 days, your account and all associated data are permanently deleted or irreversibly anonymised.
We may retain limited data beyond these periods where required for legal obligations, dispute resolution, or fraud prevention.
8. Your Rights (GDPR)
You have the right to:
- Access the personal data we hold about you;
- Request correction of inaccurate or incomplete data;
- Request deletion ("right to be forgotten");
- Request restriction of processing;
- Data portability;
- Object to processing based on legitimate interests;
- Withdraw consent at any time;
- Lodge a complaint with your local data protection authority, or our lead supervisory authority: the Data State Inspectorate of Latvia (Datu valsts inspekcija, www.dvi.gov.lv).
To exercise any of these rights: [email protected]
9. Children
Spotary is not intended for users under 16 years old. We do not knowingly collect data from children under this age. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
10. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you within the App or via email before the changes take effect. Where required by applicable law, we will obtain your explicit consent.