Privacy Policy

1. Controller

The controller is Davide Quercia, email team@spodded.com, website spodded.com. You can write to this address about any privacy matter.

2. Data we process

Account and sign-in

• Account identifier, creation date and sign-in method (email and password, Apple, Google or anonymous guest).
• Email address (with Apple it may be a relay address provided by Apple). Your password is managed by Firebase Authentication and is never visible to us.
• Phone number, only if you provide it.
• A guest account contains no email: it is associated only with a technical identifier.
• Acceptance of the Terms (version accepted and date) and your choice on usage statistics (yes or no, and date).

Profile

• Display name and profile photo.
• Optional: a description of your appearance for the "Looks Like Me" feature (sex, age range, eye and hair colour, glasses, piercings, tattoos) and your Instagram username.
• Saved Spods, blocked users and invited users (referrals): see section 4 on who can access them.

Content and activity

• Spods you create: type, name, description, photos, location, time window, any physical description, creation date and author.
• "Likes" and saved Spods.
• Chats: text messages and photos, date and read status.
• Reports: reason, description, reported content or user, author of the report, date, status and handling notes.

Location

• Your device's precise location, only while you use the app and only if you have given permission ("while using the app"; never in the background).
• Your last known location (coordinates, a geographic code for the area and the date), stored among your private data and overwritten at each update: we do not keep a history of your movements.

Notifications

• Your device's notification token, with platform, language, app version and registration and update dates.
• Your notification preferences (main switch, notification types, radius for nearby Spods) and the dates of the latest notifications sent, used to avoid sending notifications too often.

Technical and usage data

• Only if you have consented to usage statistics: app usage events (for example screens opened and actions taken) associated with your identifier, device model and operating system, app version, language and approximate geographic area derived from your IP address (Firebase Analytics).
• With the same consent: performance data, such as start-up times and duration of network requests (Firebase Performance Monitoring).
• App and device integrity checks to block unauthorised access (Firebase App Check with Apple App Attest/DeviceCheck and Google Play Integrity).
• IP address and technical request data, processed by the providers listed in section 6 to deliver their services, and technical server logs.

3. Why we process it and on what legal basis

• Providing the Service (account, profile, Spods, map, chats, "likes", saved items, address search): performance of the contract, i.e. the Terms of Use (Art. 6(1)(b) GDPR).
• Recording your acceptance of the Terms and your declaration that you are at least 16: performance of the contract (Art. 6(1)(b)) and our legitimate interest in being able to prove them (Art. 6(1)(f)).
• Using your device's location for the map and for creating Spods: your consent, given through the system permission and revocable at any time (Art. 6(1)(a)).
• Storing your last known location and using it for "near you" and "looks like you" notifications and for administrators' communications addressed to an area: your consent (location permission and enabling notifications, Art. 6(1)(a)).
• Sending push notifications: your consent, given through the system permission and the switches in the app (Art. 6(1)(a)).
• Security, prevention of abuse and fraud, handling of reports (including notifying administrators), moderation, suspensions and the log of administrators' actions: our legitimate interest and that of users in a safe service (Art. 6(1)(f)) and, where applicable, legal obligations, including those under Regulation (EU) 2022/2065 on digital services (Art. 6(1)(c)).
• Usage statistics and performance analysis to improve the app (Firebase Analytics and Performance Monitoring): your consent (Art. 6(1)(a)), which is optional. Collection is off until you consent: on your first access you choose with an unticked box, and you can change your mind at any time from your profile (Terms of Use or Privacy Policy → "Your choices"). If you had accepted a previous version of the Terms, which provided for this collection, it stays on until you turn it off. Refusing or withdrawing consent does not limit your use of the app in any way.
• Service communications: performance of the contract; news about the Service can be turned off in the notification settings.
• Automatically deleting data when the periods in section 8 expire, including inactive guest accounts: the storage limitation principle (Art. 5(1)(e)) and our legitimate interest (Art. 6(1)(f)).
• Complying with legal obligations and orders from authorities, and defending our rights: legal obligation (Art. 6(1)(c)) and legitimate interest (Art. 6(1)(f)).

Account data is necessary to use the Service. Optional profile data, location, notifications and usage statistics are optional: without the first three some features are not available; usage statistics make no difference to you.

4. Who can see your data

• Other signed-in users, guests included, can see your public profile (name, photo, Instagram and "Looks Like Me" description if provided) and the Spods you publish, with their location, content and author.
• The author of a Spod can see who liked it, with name and photo. The list is not confidential: other signed-in users can also see it.
• The Spods you have saved, the users you have blocked and those you have invited are not shown to others in the app, but they are part of your profile and should not be treated as confidential information.
• Chat messages are visible only to the two participants. Chats addressed to an area go to its manager.
• The manager of an area can remove the Spods located within it.
• Your email, phone number, last location, notification preferences and usage statistics choice are never visible to other users.
• The Service's administrators, who are persons authorised by the controller and bound by confidentiality, access the data needed for moderation, support and security, including email, last access and reports. They do not look at chats, except where necessary to establish a reported breach or to comply with a legal obligation.

5. If you are described in a Spod

A Spod may describe a person who is not registered on Spodded, with a generic indication of appearance, place and time of the encounter. The Terms prohibit stating names, contacts, addresses, sensitive data or elements that allow the person to be directly identified, and describing minors. This data comes from the user who created the Spod; we process it on the basis of our legitimate interest in providing the Service, balanced by these rules and by the removal tools.

If you believe a Spod concerns you, you can ask for its removal, object to the processing (Art. 21) or exercise the other rights in section 9 by writing to team@spodded.com, even without an account, identifying the Spod (for example place, date or a screenshot). If you have an account you can also report it from the app. We handle these requests as a priority and normally remove the Spod.

6. Providers and recipients

To deliver the Service we use providers that process data on our behalf as processors or, for the services indicated, as independent controllers under their own privacy policies:

• Google (Google Ireland Ltd and Google LLC), Firebase platform: Authentication, Cloud Firestore (European multi-region), Cloud Storage, Cloud Functions (Europe region, Belgium), Cloud Messaging, App Check and Hosting; Analytics and Performance Monitoring only with your consent.
• Google Maps Platform (Places and Geocoding): receives the text you search for or the coordinates to be converted into an address, as well as your IP address.
• Google Play Integrity and Sign in with Google, on Android devices and for those who use them.
• Apple (Apple Inc. and Apple Distribution International): Sign in with Apple, Apple Push Notification service (APNs), App Attest and DeviceCheck.
• Mapbox Inc.: provides the maps and receives your IP address, technical device data and the map area being viewed.
• Public authorities, where required by law.

We do not sell your data, we do not share it with third parties for marketing purposes and we do not show advertising.

7. Transfers outside the European Union

Some providers (Google, Apple, Mapbox) may process data in the United States or in other countries outside the European Economic Area. Transfers take place on the basis of the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework, for certified providers, or of the standard contractual clauses approved by the Commission, with the additional safeguards provided by the providers. You can request a copy at team@spodded.com.

8. How long we keep data

• Account, profile, private data and preferences: until you delete your account.
• Last known location: a single value, overwritten at each update and deleted with the account.
• Spods: until you delete them, they are removed through moderation or you delete your account. After 90 days a Spod becomes "expired": it remains stored and may still appear on the map in areas without recent Spods.
• Chats and messages: until one of the two participants deletes the chat or their account.
• Notification tokens: until you sign out, the token becomes invalid or you delete your account.
• Closed reports (resolved or dismissed) and the log of administrators' actions: 24 months from the closure of the report or from the action, after which they are deleted automatically by a monthly procedure, unless they are needed longer to defend a right or to comply with legal obligations. Open reports are kept until they are handled.
• Analytics data, only if you have consented: 14 months, according to Google Analytics retention settings.
• Technical markers used to calculate internal statistics, containing no user content: 7 days.
• Technical server logs: about 30 days.
• Guest account: until you delete it from your profile. If it has not created any Spods, at most up to 180 days after it was last used: it is then deleted automatically with all its data, as if deleted from the profile. If you sign out without having linked it to an email address you will no longer be able to access it: write to us if you want it deleted sooner.

9. Your rights

You have the right to:

• access your data and receive a copy of it (Art. 15 GDPR);
• rectify it (Art. 16): you can edit much of it directly in your profile;
• erase it (Art. 17): you can delete your account from the app;
• restrict its processing (Art. 18);
• receive the data you have provided to us in a structured, machine-readable format and transmit it to another controller (portability, Art. 20);
• object to processing based on legitimate interest (Art. 21);
• withdraw your consent at any time, without affecting prior processing: for location and notifications, just change your device or app settings; for usage statistics, use the switch in "Your choices" (profile → Terms of Use or Privacy Policy);
• lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of the country where you live or work.

To exercise your rights, write to team@spodded.com from the address associated with your account (or, for guest accounts, explaining how to identify it). We reply within one month, extendable by two months in complex cases; we may ask you for information to verify your identity.

10. Deleting your account

When you delete your account from your profile we automatically delete: your profile, private data (email, phone number, last location, preferences), devices registered for notifications, the Spods you created, chats and their messages (for the other participant as well), your "likes", references to you in other users' saved items and block lists, and the files you uploaded. The same happens automatically for guest accounts that have not created any Spods and have not been used for more than 180 days.

The reports concerning you are kept for the period stated in section 8, because they are needed for moderation and to protect other users, together with the entries in the log of administrators' actions. The reports you sent are kept without any reference to you. Aggregated statistics that do not identify you and, if you had consented, Analytics data until it expires are also kept.

11. Automated decision-making

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. Some features are automatic but do not have such effects: selecting the Spods shown on the map based on the area being viewed, comparing your "Looks Like Me" description with that of Spods for "looks like you" notifications, and sending notifications based on your last known location.

12. Minors

Spodded is only for people aged 16 or over. Users declare their age on their first access, by ticking the box accepting the Terms; we do not ask for documents. We do not knowingly collect data from younger people, and creating Spods that describe or depict minors is prohibited. If we learn that an account belongs to a person under 16, we close it and delete its data; to report this, write to team@spodded.com.

13. Security

We adopt appropriate technical and organisational measures (Art. 32 GDPR): encrypted communications, access rules for the database and file storage that restrict each item of data to authorised parties only, separation of private data from public profile data, app integrity checks (App Check), and restricted, logged administrator access. However, no system is completely secure: in the event of a personal data breach that poses risks to you, we will act as required by Articles 33 and 34 GDPR.

14. Cookies and tracking tools

The iOS and Android app does not use cookies. Firebase analytics and performance tools use an app installation identifier and are active only if you have consented to usage statistics (section 3); we do not use advertising profiling tools. The information pages of the spodded.com website do not use cookies. The web version of the app stores in your browser the technical identifiers needed for sign-in; analytics tools start switched off and do not store cookies without your consent.

15. Changes to this policy

We may update this policy. The date and version are shown at the top; we will inform you in the app of material changes before they take effect. If a change concerns processing based on consent, we will ask for your consent again.

16. Contact

Davide Quercia, email team@spodded.com, website spodded.com.

© 2026 Spodded · Terms of Use · Privacy Policy