Last Updated: October 17, 2026 Policy Version: 2.1
This Privacy Policy explains how personal data is collected, used, stored, and protected for users of the Spotpad application (“App”). By downloading, registering for, or using the App, you represent that you have read, understood, and agreed to all provisions of this policy. If you do not agree, you must not use the App.
When creating an account you must explicitly tick a checkbox confirming that you have read and accept this Privacy Policy and the Terms of Use. An account cannot be created without ticking it.
The date, time and policy version of your acceptance are recorded on your account. This record is kept solely to evidence that consent was given.
If the policy is materially updated you will be informed again inside the App. If you do not accept the changes you may delete your account from within the App.
The following information is collected during registration:
Signing in with Google or Apple: If you create your account with Google or Apple, you do not set a password; the provider verifies your identity. In that case only your email address and, if the provider shares it, your name are received. Your name is used only to suggest a username, which you confirm yourself. If you use Apple’s “Hide My Email”, Apple’s private relay address is received instead of your real address. Your Google or Apple password, contacts or any other account data are not received. When you delete your account, the authorization granted through Sign in with Apple is also revoked.
🔎 Your profile record is visible to other signed-in members. Your username, bio, profile photo, travel score and visited country/city counts can be seen by other users. Your email address, notification token and block list are kept outside this record, in a private area only you can access.
If you grant location permission, your device coordinates are used for two purposes:
TR) is saved to your account and used for the
leaderboard.⚠️ To be explicit: Your precise coordinates are not stored on our servers, but they are sent to the third-party service named above during country detection. The only location data stored on our servers is the two-letter country code. If you deny location permission, your country is estimated from your device’s language/region setting and no coordinates are ever transmitted.
🌍 You choose who sees each post. A post shared with “Everyone” — its caption, photos and your username — is visible to every user of the App, including people who are not your friends. A post shared with “Friends only” is visible only to your accepted friends; when a friendship ends or you block someone, that person can no longer see these posts. Likes and comments are visible to everyone who can see the post. Premium users may forward your public posts to their friends; friends-only posts cannot be forwarded. You may delete your post at any time; deleting it also permanently removes its photos and comments.
⚠️ Important: In-app messages and shared media are not end-to-end (E2E) encrypted. Messages are stored in Google Cloud Firestore and images in Firebase Storage, protected under Google’s own security standards. By using the App, the user acknowledges and accepts this technical limitation.
Types of notification sent:
| Notification | When it is sent |
|---|---|
| Friend request | When you receive a request, or yours is accepted |
| New message | When someone sends you a direct message |
| Friend’s post | When a friend publishes to the home feed |
| Like | When someone likes your post |
| Comment | When someone comments on your post |
| Reminder | Upcoming plans and every-other-day feed reminders (generated on-device) |
Actions by users you have blocked never generate notifications for you.
To protect your account, other users and infrastructure costs, the following technical data is processed. None of it appears on your profile or is shown to any user.
| Data | Purpose | Where |
|---|---|---|
| IP address (hashed) | Enforcing usage limits; stopping floods of automated requests from a single address | The IP address is not stored in clear text. A one-way digest (SHA-256) is taken and only that digest is kept alongside a counter. Records are deleted automatically once they expire. |
| Usage counters | Limiting the frequency of AI requests, sign-in attempts, reports and notification-token registrations | On the server, as short-lived records |
| Device attestation (App Check) | Proving a request genuinely comes from the Spotpad app | Apple’s App Attest is used. An app-specific key is generated on your device and verification happens via Apple and Google (Firebase). Your identity, email or location are not transmitted in this process. |
| Device identifier (hashed) | Preventing someone whose account was closed from repeatedly creating new accounts to harass other users | The identifier obtained from the device operating system is not stored in clear text. A one-way digest (SHA-256) is taken; only that digest is kept on the server and the device cannot be derived from it. It is not linked to any advertising identifier, is not used for advertising or analytics, and is not shared with third parties. |
| Sign-up limit | Preventing bulk creation of fake accounts from the same network; the number of accounts that can be created per day is limited | A digest of the IP address and a counter, as short-lived records |
| Upload inspection | Preventing non-image files being uploaded as “photos” and storage quotas being exceeded | The first bytes of your uploaded file are read on the server to check it really is an image. File content is not examined for any other purpose. |
ℹ️ About IP addresses: As with any internet request, the server side of the App (Google Cloud Functions) technically sees your IP address. That address may be retained in Google’s infrastructure logs for Google’s own retention periods. In our own records the IP address is not stored in clear text.
The following decisions are made automatically, without human review:
None of these decisions results in permanent closure of your account; permanent closure is always a human decision. If you believe an automated decision has affected you unfairly, you may object by writing to egeseymen@icloud.com.
| Data | Purpose |
|---|---|
| Email & Password | Authentication |
| Username | Profile identification and friend search |
| Profile photo | In-app profile display |
| Location | Real-time location display on map |
| Travel data | Personal map and statistics |
| Travel memories & photos | User’s personal archive |
| DM messages | Communication with friends |
| Home feed posts | Sharing trips publicly with the community |
| Likes & comments | Post engagement; notifying the post owner |
| Block list | Hiding content and notifications from unwanted users |
| Reports | Reviewing rule violations |
| Travel score | Leaderboard ranking |
| Country code | Country-level statistics |
| Last seen timestamp | Measuring active users |
| FCM Token | Push notification delivery |
| RevenueCat data | Premium subscription management |
| Hashed IP and usage counters | Preventing abuse and automated attacks |
| Device attestation (App Check) | Verifying a request comes from the genuine app |
| Policy acceptance record | Evidencing when and to which version consent was given |
Under Article 6 of the GDPR and Article 5 of the Turkish Data Protection Law (KVKK No. 6698), each category of data is processed on one of the following legal bases:
| Data | Legal basis (GDPR) | Legal basis (KVKK) |
|---|---|---|
| Email, password, username | Contract – Art. 6(1)(b) | Performance of a contract (Art. 5/2-c) |
| Profile, travel data, posts | Contract – Art. 6(1)(b) | Performance of a contract (Art. 5/2-c) |
| Messages and shared media | Contract – Art. 6(1)(b) | Performance of a contract (Art. 5/2-c) |
| Location (country detection) | Consent – Art. 6(1)(a) | Explicit consent (Art. 5/1) |
| Notification token | Consent – Art. 6(1)(a) | Explicit consent (Art. 5/1) |
| AI requests | Consent – Art. 6(1)(a) | Explicit consent (Art. 5/1) |
| Hashed IP, usage counters, device attestation, hashed device identifier | Legitimate interest – Art. 6(1)(f) | Legitimate interest: security and abuse prevention (Art. 5/2-f) |
| Reports and moderation records | Legitimate interest – Art. 6(1)(f) | Establishment and protection of rights (Art. 5/2-e) |
| Subscription status | Contract – Art. 6(1)(b) | Performance of a contract (Art. 5/2-c) |
| Disclosure to authorities | Legal obligation – Art. 6(1)(c) | Legal obligation (Art. 5/2-ç) |
| Policy acceptance record | Legal obligation – Art. 6(1)(c) | Legal obligation and evidence (Art. 5/2-ç, 5/2-f) |
For processing based on consent (location, notifications, AI) you may withdraw your consent at any time by turning off the relevant permission in your device settings or in the App’s settings. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
| Data | Retention period |
|---|---|
| Account and profile data | While the account exists; deleted immediately when the account is deleted |
| Travel data, memories, plans | While the account exists; deleted with the account |
| Home feed posts, comments, likes | Until you delete them; deleted with the account |
| Direct messages | Until the conversation is deleted. The other party’s copy may remain in their conversation even after you delete your account. |
| Report records | 2 years after the review is closed, to detect repeat violations |
| Moderation action logs | 2 years |
| Hashed IP and usage counters | Deleted automatically within 24 hours of the relevant window closing |
| Hashed device identifier | The device–account link is deleted when the account is deleted. If the device is banned, the ban record is kept until the ban is lifted. |
| Notification token | Until you withdraw permission, sign out, or delete the account |
| Policy acceptance record | 10 years after account deletion, for evidentiary purposes during the statutory limitation period |
| Subscription records | 10 years under tax and commercial law (also retained by RevenueCat and the App Store) |
| Data subject to legal proceedings | Until the proceedings conclude definitively; independent of any deletion request |
Once the period expires, data is deleted, destroyed, or irreversibly anonymised.
The App uses the following third-party services, each governed by their own privacy policies:
| Service | Provider | Purpose | Policy |
|---|---|---|---|
| Firebase Authentication | User sign-in | firebase.google.com/support/privacy | |
| Sign in with Google | Optional sign-in method | policies.google.com/privacy | |
| Sign in with Apple | Apple Inc. | Optional sign-in method | apple.com/legal/privacy |
| Cloud Firestore | User and app data | firebase.google.com/support/privacy | |
| Firebase Storage | Photo and media storage | firebase.google.com/support/privacy | |
| Firebase Cloud Messaging | Push notifications | firebase.google.com/support/privacy | |
| Cloud Functions | Notifications and server-side operations | firebase.google.com/support/privacy | |
| RevenueCat | RevenueCat, Inc. | Subscription and purchase management | revenuecat.com/privacy |
| OpenStreetMap | OpenStreetMap Foundation | Map display | osmfoundation.org/wiki/Privacy_Policy |
| Nominatim | OpenStreetMap Foundation | Country detection from coordinates | osmfoundation.org/wiki/Privacy_Policy |
| Anthropic Claude | Anthropic PBC | AI travel suggestions and plan chat | anthropic.com/legal/privacy |
| Google Maps | Street Roam mode (opens in browser) | policies.google.com/privacy | |
| Firebase App Check | Verifying a request comes from the genuine app | firebase.google.com/support/privacy | |
| App Attest / DeviceCheck | Apple Inc. | Device and app integrity attestation | apple.com/legal/privacy |
| App Store & StoreKit | Apple Inc. | App distribution, purchases and refunds | apple.com/legal/privacy |
🤖 About AI features: When you use AI travel suggestions or plan chat, the plan text and question you write are sent to Anthropic for processing. These requests are relayed through our servers; your email address, username and other account details are not shared with Anthropic. If you do not use the AI features, nothing is sent.
Uploaded profile photos, travel memory images, home feed post photos and images sent in chat are analyzed by an on-device content safety filter (NSFW detector) to detect inappropriate content. This analysis is performed entirely on-device; images are never sent to any server for this purpose.
The App stores some data encrypted on your device:
This data is used solely for app functionality and is not shared with third parties.
⚠️ Security Limitation: No method of data transmission over the internet or electronic storage is 100% secure. While the developer applies industry-standard technical safeguards, absolute security is not guaranteed. By using the App, the user acknowledges and accepts this technical reality.
To review rule violations and operate the App, the developer runs an administration panel. This panel runs locally on the developer’s own computer only, is not exposed to the internet, and is password protected.
Data accessible through this panel:
Administrator capabilities include adjusting subscription status, suspending accounts, and removing content that violates the rules.
⚠️ To be explicit: Because in-app messages are not end-to-end encrypted, they can be read by the developer during a report investigation. This access is used solely for safety, rule-violation review and legal obligations; it is never used for marketing or any other purpose, and is not shared with third parties.
The App uses the following permissions. All permissions are explicitly requested before use:
| Permission | Purpose |
|---|---|
| Location (While Using) | Real-time location display on map |
| Camera | Taking profile photos and travel memory shots |
| Photo Library | Selecting profile and travel images, sharing photos in chat |
| Notifications | Friend request and acceptance notifications |
The App is not intended for children under 13 years of age and we do not knowingly collect personal data from children under 13.
For users in the European Union: under Article 8 of the GDPR, some member states set the minimum age for consent-based processing at 16. If you are below the applicable age in your country, you may use the App only with the consent of your parent or guardian.
If an account belonging to a user under 13 is identified, the account is closed and the related data deleted. If you believe your child has registered without permission, write to egeseymen@icloud.com; upon notice the account is deleted within 30 days at the latest.
Collected data is processed through Google (Firebase) and RevenueCat infrastructure and may be stored on servers in locations including the United States. These transfers are carried out under the relevant service providers’ data processing agreements and GDPR-compliant standard contractual clauses.
You have the following rights regarding your personal data:
To exercise these rights: egeseymen@icloud.com Requests are answered free of charge within 30 days at the latest.
Right to complain: If your request is refused or left unanswered, you may lodge a complaint with the Turkish Personal Data Protection Authority (kvkk.gov.tr) or, if you are in the European Union, with the data protection authority of your country.
This Privacy Policy may be updated from time to time. You will be notified of significant changes via an in-app notification or email. The current policy is always available on this page.
For questions about our privacy policy:
Email: egeseymen@icloud.com
The App may only be used for lawful and ethical purposes. The following activities are strictly prohibited:
Accounts found in violation of these rules may be suspended or permanently terminated immediately and without prior notice. Competent legal authorities may be notified where required, and such notification may occur without prior notice to the user.
The developer may be required to share user data with competent authorities in the following circumstances:
In such cases, prior notice to the user may not be possible. The developer assumes no liability for complying with a valid legal request.
The developer may suspend or permanently terminate a user account without prior notice in the following circumstances:
Subscription fees paid are non-refundable upon account termination due to a policy violation. The developer reserves the right to retain relevant data independently of an account deletion request if required by an active legal proceeding or authority request.
To the maximum extent permitted by applicable law, the developer shall not be liable for:
The developer’s maximum aggregate liability for any claim shall not exceed the total subscription fees paid by the user in the preceding 12 months. For free-tier users, the developer’s maximum liability is zero (USD $0).
The user agrees to indemnify, defend, and hold harmless the developer and its affiliates from and against any claims, damages, penalties, administrative actions, or legal costs (including reasonable attorney’s fees) arising from the user’s violation of this policy, applicable law, or the rights of any third party. This obligation covers both intentional conduct and negligence.
AI-assisted travel plans and suggestions provided within the App are for general informational purposes only and do not constitute professional travel advice, medical guidance, or safety consulting.
In the event of a security breach resulting in unauthorized access to personal data:
To report illegal content, threats, blackmail, harassment, or any policy violation occurring through the App:
Email: egeseymen@icloud.com
Subject line: [REPORT] – User Complaint
Please include: the username/UID of the reported user, date and time of the incident, and any available screenshots. All reports are reviewed within 5 business days. Reports involving imminent threats to life or safety are treated as urgent and, where necessary, escalated to law enforcement.
For users in the European Economic Area or other jurisdictions with applicable data protection laws, you have the following rights regarding your personal data:
To exercise any of these rights: egeseymen@icloud.com
You also have the right to lodge a complaint with your local data protection supervisory authority.
This Privacy Policy and any disputes arising from or in connection with the App shall be governed by and construed in accordance with the laws of the Republic of Turkey. The courts and enforcement offices of Istanbul shall have exclusive jurisdiction to resolve any such disputes.
The user agrees to the following obligations in order to maintain account security:
The developer shall not be liable for account takeover, message leaks, or image exposure resulting from the user’s failure to fulfil these obligations. Any additional harm caused by delayed notification shall also be borne solely by the user.
The App relies on independent third-party service providers including Google LLC (Firebase), RevenueCat Inc., and the OpenStreetMap Foundation. In the event of a data breach, leak, cyberattack, service outage, or unauthorized access within those providers’ infrastructure:
Direct messages (DMs) and shared media files (photos, images) within the App are stored under the following conditions:
The developer shall not be held liable for partial or complete service interruption, data loss, temporary inaccessibility of data, or any direct or indirect damages resulting from events beyond the developer’s reasonable control, including but not limited to: earthquake, flood, fire, pandemic, war, act of terrorism, government intervention, regulatory change, power outage, internet infrastructure failure, large-scale cyberattack (DDoS, ransomware, etc.), or any other comparable force majeure event.
In the event of a force majeure, the developer will make reasonable efforts to restore service but will make no commitment regarding a specific timeline or full data recovery.
The App is provided “as is” and “as available” without any representations or warranties of any kind, express or implied. The developer specifically disclaims all warranties regarding:
By using the App, the user expressly acknowledges and accepts these conditions.
To the maximum extent permitted by applicable law, the developer shall not be liable for any indirect, incidental, special, consequential, or punitive damages — including but not limited to loss of use, loss of data, loss of profits, reputational harm, or emotional distress — even if the developer has been advised of the possibility of such damages. This exclusion covers:
Where mandatory consumer protection law applicable in the user’s jurisdiction provides broader protection, such statutory rights are preserved and not limited by this clause.