Privacy Policy

Last updated: July 28, 2026

SPTTD (“we”, “us”) is a car-spotting app operated by Elias Bishop. This policy explains what we collect, why, and who we share it with. Questions: support@spttd.app.

1. Information we collect

You provide

• Account: your email address and a username (and an optional display name).
• Profile: an optional photo, bio, website, and social-media links.
• Spots: photos of cars you take, and the identified vehicle details.

Collected as you use the app

• Location: the precise GPS location of each spot, and — during a drive you record — your precise location continuously, including in the background, to trace the route.
• Drives: route, speed, elevation, time, and motion/accelerometer readings.
• Social & activity: friends, votes, swipes, achievements, notifications, and reports you file.
• Device & technical: push token, device model and platform, IP address, and crash/diagnostic data.
• Purchases: if you buy a pass or subscription, your purchase and entitlement history (we never see your payment details — Apple handles payment).

2. How we use it

• To identify cars, build your collection, and run the map, leaderboards, and social features.
• To record and back up your drives.
• To send notifications you’ve enabled.
• To keep the service safe (rate limiting, moderation, abuse prevention) and to fix crashes.

3. Who we share it with

We use the following service providers (processors) to run the app:

• Our AI identification provider (United States) — receives the car photo you take to identify the vehicle. Your location is not sent with the photo.
• Supabase — our database, accounts, and file storage.
• Expo (United States) — delivers push notifications and app updates.
• Apple — push delivery, App Store distribution, and in-app purchase payment processing.
• RevenueCat (United States) — manages in-app purchases and subscription entitlements.
• Vercel (United States) — hosts this website, including public spot-verification pages.
• Sentry (United States) — crash and error reporting.
• Instagram — only if you choose to share a spot to Instagram Stories.

4. What’s public

Some content is visible to other users and, in places, to anyone on the web: your rare spots on the map and in Gas-or-Pass (photo, an approximate offset location, the car, your username and avatar), leaderboard rankings, and your public profile. Each spot also has a public verification page at spttd.app/c/<serial> showing the photo, the car, the place name/country, and your username. Your exact coordinates are never shown publicly — only an offset location.

5. Permissions

We ask for camera (to photograph cars), location (to tag spots and record drives, including in the background during a drive), photo library (to set an avatar and save spots), notifications, and motion (for drive g-force). You can change these anytime in your device settings; the app still works with them declined, with reduced functionality.

6. Retention & deletion

You can delete your account in the app (Settings → Account → Delete account) or request help at spttd.app/delete-account. How long we keep data:

• Active accounts: we keep your data while your account is active.
• Inactive accounts: we may delete accounts that have been inactive for more than 12 months, after notice to the account’s email address.
• Deleted accounts: deletion removes your spots, collection, drives, profile, and stored photos after a 30-day grace period (during which you can restore the account by signing back in). Residual copies in encrypted backups are purged within 30 days after that.
• Legal & safety: we may keep limited records longer where needed to enforce moderation decisions (such as reports and blocks), prevent abuse, or comply with law.

7. Your rights

Depending on where you live (including under Canada’s PIPEDA, the EU/UK GDPR, and California’s CCPA), you may have the right to access, correct, delete, or export your data, and to withdraw consent. To exercise these rights, contact support@spttd.app. We’ll respond to verified requests within the timelines the law requires, and we’ll never treat you worse for exercising your rights.

8. Legal bases (EU/UK users)

Where the GDPR applies, we process your data on these legal bases:

• Contract: to provide SPTTD itself — your account, spots, collection, and drives.
• Consent: for optional features you turn on, such as location, push notifications, and background tracking during a drive. You can withdraw consent anytime in your device or app settings.
• Legitimate interests: keeping the service safe (moderation, rate limiting, abuse and fraud prevention) and fixing crashes and improving the app.
• Legal obligation: where the law requires us to keep or disclose information.

9. California privacy rights

If you’re a California resident, the CCPA gives you the right to know what personal information we collect (this policy is that disclosure), to delete it, to opt out of its sale or sharing, and to not be discriminated against for exercising those rights. We do not sell your personal information and we do not share it for cross-context behavioral advertising. To exercise these rights, email support@spttd.app.

10. International data transfers

SPTTD is operated from Canada, and most of the providers listed above process data in the United States — so your data may be handled in countries other than your own. Where required, we use appropriate safeguards for these transfers, such as Standard Contractual Clauses.

11. Children

SPTTD is not directed to children and is intended for users aged 13 and over (or the higher minimum age required where you live). We do not knowingly collect data from children under that age; if you believe we have, contact us and we will delete it promptly.

12. Changes

We may update this policy as the app changes; the date above always reflects the current version. For material changes, we’ll notify you in the app — and by email for significant ones — before they take effect.

Contact: support@spttd.app