Privacy.

What Spot stores

To work at all, Spot keeps the following on its server:

• How you sign in. An email address, or an identifier from Apple or Google if you used one of those buttons. If you used Sign in with Apple and chose to hide your address, we only ever see Apple's private relay address and cannot resolve it to your real one.
• Your profile. The name you choose, an optional username, and your invite code.
• Your profile photo, if you set one. This is the one thing in Spot that is not end-to-end encrypted, and it cannot be: everyone you are connected to has to be able to see the same picture. It is stored under a random name that changes every time you change the photo, and that address only ever appears on your profile — which is readable by you and by people you are connected to. The photos you send are never handled this way.
• Your public key. The half of your encryption key that other people use to seal photos to you. It is public by design.
• Who you are connected to, and who has asked to connect.
• Encrypted content. Photos, captions and request notes, stored as ciphertext together with a key that has itself been encrypted to the recipient.
• Timestamps — when a request was made, answered or opened.
• A notification token, and only if you turn notifications on. It is the address Apple uses to reach this app on this phone. It is tied to nothing else, joined to nothing else, and deleted when you sign out or delete your account.

What Spot cannot see

• Your photos, captions and notes. Each one is encrypted on your device with a fresh key, and that key is then sealed to the recipient's public key. The server stores both halves and can open neither.
• Your private key. It is generated on your device and kept in the iOS Keychain. It is never transmitted, and it is excluded from iCloud backups.

This has a consequence worth being plain about: if you lose your device, the photos you were sent cannot be recovered — not by you, and not by us. There is no copy of the key anywhere else. That is the cost of the guarantee above, and we think it is the right trade.

How long it is kept

• A photo is deleted from the server the moment you close it. That is the promise the app makes, and it is the ordinary path. Closing is what spends a photo — so one you opened and were interrupted in the middle of is still there, still yours to look at, and still on the row where it arrived.
• A photo that is never opened stays encrypted on the server until it is deleted or until the account it belongs to is deleted.
• Your profile, connections and requests stay until you delete them or delete your account.

Who else is involved

Spot is small, and the list is short:

• Supabase hosts the database, authentication and file storage, on servers in the European Union. They hold the same encrypted bytes we do, and likewise cannot read them.
• Apple and Google are involved only if you choose their sign-in button, and only to confirm it is you.
• Firebase Hosting serves this page and the invite links.
• Apple's push notification service, if you turn notifications on. A notification carries a name and what happened — "asked you for a photo" — and nothing else. It can never carry the photo, the caption or the note, because the server holds those as ciphertext it cannot open.

There is no analytics package, no advertising network, no crash reporter and no third-party SDK that profiles anyone. Your data is never sold, rented or shared for anybody's marketing.

What you can do

• Delete your account, from Account → Delete account. It removes your profile, your connections and every photo you have sent or received, and destroys the key on your device. It is immediate and cannot be undone.
• Block someone, by tapping their row in People. They are removed from your circle, what passed between you is deleted, and they cannot reach you again — including by re-using your invite link.
• Stay unfindable. Spot has no search and no directory. Nobody can find you without a link you chose to send them.
• Turn notifications off, from You → Notifications or in iOS Settings. Nothing else changes — Spot works exactly as before, it simply stops telling you.

If you are in the UK or EU, you also have the right to ask what is held about you, to have it corrected, and to have it erased. The delete button does the last of those in full; for anything else, write to us.

Children

Spot is not directed at children under 13, and we do not knowingly create accounts for them.

Changes

If this policy changes in a way that matters, the date at the top changes with it and the new version appears on this page.

Contact

Spot is made and run by one person. Questions about privacy, requests about your data, or anything else: dritero.avd@gmail.com.