Privacy Policy

Spontly (“we”, “the Service”) — the iOS and Android app and the website at spontly.eu — is operated by:

Sergej Děďuchin
IČO: 09827064
Kurzova 2222/16, Praha – Stodůlky, 155 00, Czech Republic
Email: [email protected]

Spontly is an app for spontaneous meetups: it shows meetups near you, lets you join them and chat with the people going.

Account

• Email address, and a password stored only as a cryptographic hash — we never see it.
• If you sign in with Apple or Google: your identifier at that provider, plus the name and email they pass on. If you use Apple's “Hide My Email”, we only ever see the relay address.

Profile

• Name, profile photo, date of birth (used to show your age and to enforce the 17+ limit), languages you speak, your city.
• Your rating and counters of meetups organised and cancelled — these make the community accountable and are visible to other users.
• Bank details (IBAN and recipient name) only if you choose to organise a meetup where participants share the cost. They are shown to the participants of that meetup so they can transfer their share.

Location

• The position of your device, if you allow it, to show meetups around you and to place them on the map.
• The location of a meetup you create — this is public to everyone who can see the meetup.

What you create

• Meetups (title, description, time, place, photos), 24-hour stories, chat messages, ratings, who you follow, meetups you saved or skipped, reports you send and users you block.
• Your answers to the “Pick a company for me” questionnaire. Only if you allow AI: a free-text description of yourself and a short line that people at your table see.

Technical

• A push notification token for your device, so we can deliver notifications.
• Error logs from the app when something fails, so we can fix it.
• Anonymous usage statistics (PostHog): which screens are opened and which steps are taken, such as “a meetup was created”, with the app version and device type. Nothing is stored on your device and no account ID, name or text is sent; PostHog counts people with a hash that changes every day, so nobody can be recognised from one day to the next.

Ad measurement — only if you agree

We advertise Spontly on Google, on Facebook and Instagram (Meta) and on TikTok. After you sign in, the app asks once whether it may measure which ad brought you. Only if you agree (on iPhone also “Allow” in Apple's tracking dialogue) does the app tell Google (Firebase / Google Analytics), Meta and TikTok that you installed and opened the app, signed up, asked to join a meetup or created one — together with the app version and your device's advertising identifier. Your name, email, photos, meetups, messages and location are never sent, and personalised ads stay off. You can change your choice at any time in Settings → Ad measurement (on iPhone also in iOS Settings → Spontly → Allow Tracking).

Without asking we keep only the install source the store hands to the app: on Android the Google Play install referrer (which campaign, if any, led to the install); on iPhone — only after you agree — whether the install came from an Apple Search Ads campaign. It stays in our database with your account.

We never sell your data. There is no advertising network inside Spontly and the app shows no ads.

• To perform our contract with you (Art. 6(1)(b) GDPR): running your account, showing meetups near you, delivering messages and notifications you asked for.
• Your consent (Art. 6(1)(a)): access to your precise location and to push notifications. You give it in the system dialogue and can withdraw it at any time in iOS Settings.
• Your consent (Art. 6(1)(a)) to ad measurement: given on the “Ad measurement” screen, withdrawn in Settings → Ad measurement. We keep a record of your choice (date, text version, language, app version) as proof.
• Our legitimate interest (Art. 6(1)(f)) in knowing which of our campaigns bring people: the Google Play install referrer.
• Our legitimate interest (Art. 6(1)(f)) in seeing how the app is used so we can improve it: anonymous usage statistics (PostHog).
• Our legitimate interest (Art. 6(1)(f)): keeping the service safe — handling reports and blocks, preventing abuse and fraud, fixing errors.
• Legal obligation (Art. 6(1)(c)): where the law requires us to keep or disclose something.

Your device position is used at the moment you open the map or search, to find meetups around you. We do not track you in the background and the app does not collect a history of your movements.

You may refuse the permission: the app keeps working and shows meetups in your city instead. Other users never see your position — they see only the place of a meetup you created or joined.

Your name, photo, age, languages and rating are visible to other users of the app, as are the meetups you create and the stories you post. Messages are visible to the participants of that meetup. Your email address, your date of birth as such, and your bank details are never shown publicly — bank details are shown only to participants of your paid meetup.

We use a small number of providers, each bound by a data-processing agreement:

• Supabase — database, authentication, photo storage and server functions. Your data is stored in the EU (AWS, Ireland).
• Apple — Sign in with Apple, and the Apple Push Notification service that delivers notifications to your device.
• Google — Google Sign-In, and Google Maps, which renders the map and therefore receives the map requests from your device. Firebase Cloud Messaging delivers notifications on Android.
• GitHub — hosting of app update bundles, which means it receives your IP address when the app checks for an update.
• OpenRouter (USA) and the AI model provider it forwards the request to (Anthropic, USA) — only if you allow it: your free-text description and line from the questionnaire, to match you with people and check the line; for an on-site introduction you agreed to, the first names, lines and interests of the people being introduced. Venue accounts: photos and text of the event posters they upload. Never used for advertising.
• Google (Firebase / Google Analytics, Google Ads) and Meta Platforms Ireland (Meta App Events, for Facebook and Instagram ads) — only if you agreed to ad measurement: the steps listed in section 2 with the app version and advertising identifier, so that we can see which ads bring people. Meta may transfer data to Meta Platforms, Inc. in the USA.
• TikTok Technology Limited (Ireland; TikTok App Events, for TikTok ads) — on the same terms and with the same data. TikTok may transfer data to its group companies outside the EU.
• PostHog (EU Cloud, Frankfurt) — anonymous usage statistics without identifiers or storage on your device (section 2).

We may also disclose data if the law obliges us to. We do not sell data. For advertising we share data only for ad measurement and only with your consent (section 2).

Data is stored on servers in the European Union (Ireland). Apple, Google, Meta, TikTok, PostHog, OpenRouter and Anthropic may process some data outside the EU under the European Commission's standard contractual clauses.

• Account and profile — while your account exists.
• Stories — 24 hours, then deleted automatically.
• Meetups, messages and ratings — while your account exists, so that the history of a meetup stays readable for its participants.
• Reports and blocks — kept while needed to keep the service safe, so that a removed user cannot simply return.
• Error logs — a short period, then deleted.
• Anonymous usage statistics (PostHog) — at most 1 year.
• Your ad measurement choices and the install source — while your account exists (proof of consent). Google, Meta and TikTok keep measurement events under their own retention rules; Google Analytics for at most 14 months.

You can delete your account yourself: Profile → Account → Delete account. This removes your profile, your meetups, your messages, your stories and your photos immediately and irreversibly.

You may also write to [email protected] and we will delete everything within 30 days. Some records may remain briefly in encrypted backups before they expire.

Under the GDPR you have the right to access your data, to correct it, to have it deleted, to restrict or object to processing, and to receive it in a portable format. Where processing is based on consent, you can withdraw it at any time.

Write to [email protected] and we will answer within one month. If you believe we handle your data incorrectly, you may complain to the Czech Data Protection Authority (Úřad pro ochranu osobních údajů, uoou.gov.cz) or the authority in your country of residence.

Spontly is not intended for people under 17 and we do not knowingly collect their data. If you believe a minor has created an account, tell us at [email protected] and we will delete it.

Traffic is encrypted with HTTPS. Access to the database is restricted by row-level security rules, so one user cannot read another user's private data. No system is perfectly secure, but we will inform you and the supervisory authority of a breach affecting you as the law requires.

We may update this policy. We will announce significant changes in the app or by email. Questions about this policy or about your data:
Email: [email protected]