Privacy Policy

1. Data controller

The data controller for Spotted.gi is the operators of Spotted.gi. For privacy requests, contact us at support@spotted.gi.

2. Data we collect

• Google account data: when you sign in with Google we receive identifiers such as your Google user ID, email address, display name, and profile photo (as provided by Google).
• Username: the public username you choose for the leaderboard and profile.
• Location (GPS): when you use Ping or claim a location-based collectible, we process approximate or precise coordinates you allow the browser to share, with your consent via the device/browser location prompt.
• Ping history: records of ping requests (time, location used for the request, and nearby results) so you can review activity and we can operate cooldowns and anti-abuse controls.
• Collection activity: which collectibles you have claimed and when.
• Technical data: standard server and security logs (e.g. IP address, user agent) processed by our hosting and authentication providers.

3. How we use data (purposes & bases)

• Provide authentication, accounts, and the collectible experience (contract / legitimate interests).
• Process location for Ping and proximity claims only when you grant permission (consent).
• Operate leaderboards, collections, and support (legitimate interests / contract).
• Security, abuse prevention, and service reliability (legitimate interests).
• Comply with legal obligations where applicable.

4. Processors and infrastructure

We use trusted processors to run Spotted.gi, including:

• Firebase / Google — authentication, Firestore database, and storage.
• Vercel — application hosting and edge delivery.
• Google AI — optional admin tooling for generating descriptions, coordinates, or images (not used to train on your personal content for public features).

These providers process data on our instructions under their respective terms and data processing terms. Data may be processed in the EU/UK or other regions depending on provider configuration; we take reasonable steps to ensure appropriate safeguards.

5. Location and consent

Location access is optional for browsing, but required for Ping and for claiming items that require proximity. Your device or browser will ask for permission. You can revoke location permission at any time in your browser or device settings. We do not continuously track you in the background when you are not using Ping or a location-gated claim.

6. Retention

We retain account, username, collection, and ping history data for as long as your account remains active and as needed to operate the service. We may retain limited logs for security and troubleshooting for a shorter period. Soft-deleted collectible content may remain in backups or admin records for a limited time. Contact us if you want your account data erased where applicable.

7. Your rights

Under UK GDPR / GDPR (as applicable), you may have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase data ("right to be forgotten") in certain circumstances
• Restrict or object to certain processing
• Data portability where applicable
• Withdraw consent (e.g. location) without affecting prior lawful processing
• Lodge a complaint with a supervisory authority (e.g. the Gibraltar Regulatory Authority or the UK ICO)

To exercise these rights, email support@spotted.gi.

8. Children

Spotted.gi is intended for users aged 13 and over. If you are under 13, do not create an account. If you believe a child under 13 has provided us personal data, contact support@spotted.gi and we will take appropriate steps.

9. Sharing

We do not sell your personal data. Public-facing information may include your username, profile photo (if shown), and leaderboard stats. We share data with processors listed above and where required by law.

10. Changes

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date on this page.

11. Contact

Questions about privacy: support@spotted.gi. See also our Support page.