Privacy Policy

• We collect what the app needs to work: your account, what you share with your groups, and a few technical details.
• We don't sell your data, and there are no ads in the app.
• Sharing your rough location with your groups is off unless you turn it on.
• AI features only use your messages and details if you allow it, and you can change your mind in Settings.
• You can delete your account, and everything in it, from Settings at any time.

Spontaza is run by Panagiotis Nikolaou, an individual based in the United Kingdom("we", "us"). We are the data controller for the personal data described here. You can reach us at [email protected].

Your account

• Your name, email address, username, and optionally a profile photo and bio.
• Your password is handled by our sign-in provider and stored only in hashed form. If you sign in with Apple or Google, they share your name and email with us.

Things you tell us

• Your home area (a postcode or neighbourhood). You can type it, or it's filled in once from your location the first time you allow location access. You can change it in Settings.
• Your hangout preferences, when you're usually free, and your notification settings.

What you share in the app

• Messages, photos, videos, voice notes, files and GIFs you send, and your reactions.
• Plans, polls and votes, memories and trip diaries, and places you save, with any notes.
• Friend requests, people you block, and reports you make (or that others make about you).

Location

• Nearby places: while you use the app, your phone's location is used to show the map and places near you. When you search for places, the search area is sent to Google to get results.
• Sharing with your groups (off unless you turn it on): your position is rounded to about 500m and saved at most once an hour, only while the app is open. We keep only your latest point, with no history. It's ignored after 4 hours, and deleted as soon as you turn sharing off. It's only used to show your groups roughly how far a place is for everyone, and it's never shown to anyone as a point on a map.
• We never collect your location in the background.

Calls

• We connect voice and video calls between group members. We do not record or store call audio or video.
• We keep a record of each call: who took part, and when it started and ended.

Device and diagnostics

• Push notification tokens, so we can send you notifications.
• Your device type, operating system and app version, how long the app takes to start, and logs that help us fix problems with notifications and with sharing into the app.
• The app has no third-party analytics or advertising trackers.

Our website and waitlist

• If you join the waitlist, we collect your email address through Google Forms and use it only to send you updates about Spontaza.
• Our website uses Vercel Analytics to count visits. It doesn't use cookies or identify you.
• With your permission only, the website also loads the Meta Pixel and TikTok Pixel, which set cookies to measure how our adverts perform. They stay off unless you choose Accept in the cookie banner. You can change your choice any time with Cookie settings at the bottom of every page.

Some features use Claude, an AI model made by Anthropic, to help your group plan. The app asks you once whether to allow this, and you can change your answer any time in Settings → Plan with AI.

If you allow it, the following can be sent to Anthropic:

• Keeping plans up to date: recent messages you send in a plan's chat, with your name, so the plan's date, time and place can be filled in automatically.
• Meetup suggestions: your name, home area, your rough shared location (combined with other members' into one central point), and your hangout preferences. It also uses group details: the group name, saved places, upcoming plans, past votes, and how many people are free when.
• Starting a plan from a note: the note you type when creating a plan, to pull out a date, time and place.

If you don't allow it, your messages and details are left out, and you can still plan everything yourself. Anthropic processes this data on our behalf and, under its commercial terms, doesn't use it to train its models. Separately, place recommendations in Discover use only your group's name and saved places, never anyone's messages or personal details.

• To provide Spontaza to you: your account, chats, calls, plans, places, memories and notifications. Legal basis: performing our contract with you.
• Location sharing, AI features, and the website's advertising pixels. Legal basis: your consent, which you can withdraw at any time.
• Keeping Spontaza safe and working: reviewing reports, preventing abuse, securing accounts, fixing bugs and improving the app. Legal basis: our legitimate interests in running a safe, reliable service.
• Legal requirements: where the law requires us to keep or disclose information. Legal basis: legal obligation.

Your groups.People in your groups see what you share there: your name, photo, messages, media, plans and votes. Your reactions, and whether you're in a call, are visible to them too.

Service providers who run parts of Spontaza for us. They may only use the data to provide their service to us:

• Supabase (EU, Ireland): database, sign-in, file storage and server functions.
• Anthropic (US): the AI features above, only if you allow them.
• Google (US): place search, details and photos (Google Places); Android notifications (Firebase Cloud Messaging); Google Sign-In; and the waitlist form (Google Forms).
• Apple (US): iPhone notifications and Sign in with Apple.
• Cloudflare (global): relays calls when two phones can't connect directly. Call audio stays encrypted and Cloudflare can't access it.
• Mapbox (US): map images, and turning a point you pin on the map into an address. We've switched off Mapbox's own usage tracking.
• Giphy (US): the GIF search terms you type. These go through our servers, without your name or account.
• Vercel, Meta and TikTok (US): website hosting and analytics, and measuring our adverts (website only, not the app).

Notification previews (for example the first line of a message) pass through Apple or Google to reach your phone. You can turn notifications off in your phone's settings.

Other cases.We may disclose information if the law requires it, to protect someone's safety, or as part of a business transfer (for example, if Spontaza becomes a company). We never sell your data.

Some of the providers above are based outside the UK, mainly in the United States. Where data leaves the UK, we rely on UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework) or the UK's approved contract clauses.

• Your account and content are kept for as long as your account exists.
• Deleted messages are cleared for everyone in the chat, not just hidden for you.
• Your shared location holds only your latest point, is ignored after 4 hours, and is deleted when you turn sharing off.
• Diagnostic logs are kept only as long as they're useful for fixing problems, and are deleted with your account.
• When you delete your account, your profile, messages, photos, videos, voice notes, files, saved places, location, plans you created and groups you own are deleted straight away. Copies in our database backups are removed as those backups expire, within 7 days.
• Waitlist emails are kept until you ask us to remove them or we stop sending updates.

Under UK data protection law you can:

• ask for a copy of your data
• ask us to correct it
• ask us to delete it
• ask us to restrict or stop using it
• ask for it in a portable format
• withdraw consent at any time

Many of these are built in. You can edit your profile, turn location sharing and AI off in Settings, and delete your account in Settings → Delete account. For anything else, email [email protected]. We'll reply within one month.

If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk. We'd appreciate the chance to put it right first.

Your data is encrypted in transit and stored on secured servers, and access controls mean members can only see groups they belong to. Messages are not end-to-end encrypted, so our systems can technically access them. We only look at content when we need to: to run the service, to review something that has been reported to us, or when the law requires it.

Spontaza is for people aged 16 and over. We don't knowingly collect data from anyone younger. If you think a child under 16 is using Spontaza, tell us and we'll delete the account.

If we change this policy, we'll update the date at the top. If the change is significant, we'll tell you in the app before it takes effect.

Questions or requests: [email protected]. See also our Terms of Service and Support page.