Last updated: August 5, 2026
1. Controller and scope
The controller under the EU General Data Protection Regulation (GDPR) is Kaspar Padberg, Möckernstr. 102, 10963 Berlin, Germany. You can contact us at support@heyspotly.com or +49 30 509 306 60.
This Privacy Policy applies to the Spotly mobile app, the public website at https://heyspotly.com, public share previews, and support communications. Privacy enquiries can be sent to the contact details above.
2. Website visits, share pages, and contact
When you visit the website, our hosting provider processes access and connection data, such as your IP address, access time, requested page, browser or device information, and technical response data. We use this information to deliver and protect the website and its share pages.
Public share pages show content that has been shared publicly. Friends-only links do not display the shared content on the website and require authorization in the app. Public lists may appear in search engines, and recipients or preview services may retain a copy of a link preview.
If you email us, we process your contact details, message, attachments, and related communication data to answer and document your request.
Spotly currently does not use advertising or analytics cookies on the public website. Necessary technical access and server logs still occur. We will update this notice and obtain consent where required before adding non-essential tracking.
3. Account, profile, and app data
When you register, we process an account identifier, your email address, sign-in and security information, display name, unique handle, language, and account settings. You can upload a profile photo and optionally add a bio and profile links.
Depending on the features you use, we also process your saved places and lists, notes, tips, tags, photos, visit and reminder information, social interactions, reports and moderation information, points and statistics, notification preferences, and support communications.
Authentication data is required to create and secure an account. Feature data is required only when you choose the corresponding feature. Without required data, we cannot create an account or provide that feature.
4. Visibility, social features, and public content
New accounts start with additional profile details and connection lists hidden. Friend requests remain enabled and following is disabled. You can change these choices in Privacy settings. Content visibility can be private, friends-only, or public where the feature offers that control.
Your display name and handle remain available to signed-in users you have not blocked so that accounts can be found. Private profiles appear in broad search only to existing friends and can otherwise be found through an exact handle. An uploaded profile photo is shown only to signed-in users you have not blocked. Connection counts and lists are shown only when you enable that setting.
A public profile may additionally show your bio, profile links, permitted statistics, and public activity. Public lists, tips, place photos, comments, and other content can be visible to anyone, including website visitors who are not signed in, and may be copied or cached by recipients, search engines, or preview services. Friends-only content requires authorization in the app. Private content is intended for you.
Neutral place records are shared Spotly catalogue data. A place can remain available after you remove your personal saved spot. Publicly licensed or editorial source media includes attribution and licence information where applicable.
5. Location, maps, and place discovery
With location permission while using the app, Spotly processes your current or recent location to centre the map, show distances, search nearby, save a place at your position, and sort relevant results. Search and location information may be sent to our mapping or geocoding providers when needed for the requested result.
If you enable a location reminder, nearby notification, or visit feature and grant background permission, Spotly may process the selected place and radius, entry or exit events, timestamps, visit information, and location data needed for the feature. Spotly does not use location data for advertising.
You can revoke app permissions in iOS or Android settings and disable background location features in Spotly. Background permission is not requested merely by visiting the website. Disabling permission stops future access but does not automatically delete previously stored visit or reminder records; you can remove reminders, disable features, or request deletion.
6. Photos, camera, notifications, and device access
Spotly accesses your photo library or camera only after you choose to select or take a profile or place photo. Place photos follow the selected content visibility. Profile photos are delivered only inside the signed-in app to users you have not blocked.
If you enable notifications, we process a device-specific notification identifier, your preferences, delivery information, and the content needed to send the notification. You can change notification settings in Spotly or on your device.
The app stores the signed-in session, settings, security information, temporary copies, and feature status locally on your device where needed for the requested functions and reliable offline or restart behaviour.
7. Security, diagnostics, and updates
To protect Spotly, prevent misuse, diagnose errors, and deliver app updates, we process technical connection, device, security, and diagnostic data. This may include your IP address, device and operating-system type, app version, a pseudonymous account identifier, and technical error or security events.
For these purposes, we use the security, diagnostics, and update providers listed in Section 8. We limit diagnostic data where possible and filter known sensitive fields before transmission. Technical event data and pseudonymous identifiers may still be included.
8. Service providers and recipients
We use processors and third-party services only as needed to provide Spotly. They receive the data required for their task and may process their own service and security data under their terms.
- Google Cloud and Firebase: account access, cloud data processing and storage, notifications, and app security.
- Google Maps Platform: map and location services.
- Vercel: hosting and delivery of the public website and its access logs.
- Sentry (Functional Software, Inc.): error and crash diagnostics.
- Expo (650 Industries, Inc.): delivery and diagnostics of app updates.
- Apple and Google: sign-in, device security, app distribution, and notification delivery, depending on your device and choices.
- Geoapify: address and timezone information for selected coordinates. Spotly also uses place or media content from Foursquare, OpenStreetMap, and Wikimedia Commons. Loading external media or opening provider links can send connection data to the relevant provider.
9. Purposes and legal bases
We process account and feature data to provide Spotly, respond to support requests, and take steps before entering into a contract (Article 6(1)(b) GDPR). Optional background location, nearby notifications, and other processing presented as consent-based rely on your consent (Article 6(1)(a) GDPR); you can withdraw it at any time for the future.
Security, abuse prevention, diagnostics, service improvement, defence of legal claims, and reliable website delivery rely on our legitimate interests in operating a secure, stable, and useful service (Article 6(1)(f) GDPR). We process data to comply with statutory duties and binding authority requests under Article 6(1)(c) GDPR.
Access to device storage or information is based on your consent where required by Section 25(1) TDDDG. Consent is not required for storage or access that is strictly necessary to transmit a message or provide a digital service you expressly requested under Section 25(2) TDDDG.
10. International transfers
Some providers listed in Section 8 are based in the United States or may process data there or in other countries outside the European Economic Area. The processing location depends on the provider and service used.
Where required, transfers rely on an adequacy decision, including an applicable EU-US Data Privacy Framework certification, or appropriate safeguards such as the European Commission's Standard Contractual Clauses. You can request more information about the relevant safeguards from support@heyspotly.com.
11. Retention and deletion
We keep account and feature data while your account is active and as long as needed for the relevant feature. Visit and related notification records are scheduled for deletion once they are older than seven days; technical delays or backlogs may extend this period. Short-lived records for nearby notifications have an earlier expiry period. Security, diagnostic, moderation, and provider records are retained for the period required for their purpose, under applicable provider settings, or by law, and are then deleted or anonymized where applicable.
You can permanently delete your account in the app under Account settings or request help at support@heyspotly.com. This removes your account and the personal content and settings assigned to it. Shared place information, anonymized aggregates, content that must be retained for another person, legally required records, provider logs, and time-limited backups may remain where applicable.
12. Your rights, complaints, and choices
Subject to the legal requirements, you have rights of access, correction, deletion, restriction, data portability, and objection. You can withdraw consent at any time without affecting processing that was lawful before withdrawal. Where processing relies on legitimate interests, you can object on grounds relating to your particular situation. We do not sell personal data and do not use it for third-party behavioural advertising.
Send requests to support@heyspotly.com. We may need to verify your identity. You may also complain to a supervisory authority, in particular the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59-61, 10555 Berlin, Germany, https://www.datenschutz-berlin.de.
13. Minors, automated decisions, and changes
Spotly is not directed to children under 16, and they must not create an account. If you are under the age of majority, use Spotly only with permission from a parent or legal guardian where required.
Spotly does not make decisions based solely on automated processing that produce legal or similarly significant effects.
We may update this Privacy Policy when the product, providers, or law changes. We will update the date above and provide an additional notice in the app where a change materially affects your rights or choices.