Privacy Policy

Spontly (“we”, “the Service”) — the iOS app and the website at spontly.eu — is operated by:

Sergej Děďuchin
IČO: 09827064
Kurzova 2222/16, Praha – Stodůlky, 155 00, Czech Republic
Email: info@spontly.eu

Spontly is an app for spontaneous meetups: it shows meetups near you, lets you join them and chat with the people going.

Account

• Email address, and a password stored only as a cryptographic hash — we never see it.
• If you sign in with Apple or Google: your identifier at that provider, plus the name and email they pass on. If you use Apple's “Hide My Email”, we only ever see the relay address.

Profile

• Name, profile photo, date of birth (used to show your age and to enforce the 17+ limit), languages you speak, your city.
• Your rating and counters of meetups organised and cancelled — these make the community accountable and are visible to other users.
• Bank details (IBAN and recipient name) only if you choose to organise a meetup where participants share the cost. They are shown to the participants of that meetup so they can transfer their share.

Location

• The position of your device, if you allow it, to show meetups around you and to place them on the map.
• The location of a meetup you create — this is public to everyone who can see the meetup.

What you create

• Meetups (title, description, time, place, photos), 24-hour stories, chat messages, ratings, who you follow, meetups you saved or skipped, reports you send and users you block.

Technical

• A push notification token for your device, so we can deliver notifications.
• Error logs from the app when something fails, so we can fix it.

We do not use analytics, advertising or tracking SDKs. Spontly contains no advertising network, no Facebook SDK and no third-party tracker, and we never sell your data.

• To perform our contract with you (Art. 6(1)(b) GDPR): running your account, showing meetups near you, delivering messages and notifications you asked for.
• Your consent (Art. 6(1)(a)): access to your precise location and to push notifications. You give it in the system dialogue and can withdraw it at any time in iOS Settings.
• Our legitimate interest (Art. 6(1)(f)): keeping the service safe — handling reports and blocks, preventing abuse and fraud, fixing errors.
• Legal obligation (Art. 6(1)(c)): where the law requires us to keep or disclose something.

Your device position is used at the moment you open the map or search, to find meetups around you. We do not track you in the background and the app does not collect a history of your movements.

You may refuse the permission: the app keeps working and shows meetups in your city instead. Other users never see your position — they see only the place of a meetup you created or joined.

Your name, photo, age, languages and rating are visible to other users of the app, as are the meetups you create and the stories you post. Messages are visible to the participants of that meetup. Your email address, your date of birth as such, and your bank details are never shown publicly — bank details are shown only to participants of your paid meetup.

We use a small number of providers, each bound by a data-processing agreement:

• Supabase — database, authentication, photo storage and server functions. Your data is stored in the EU (AWS, Ireland).
• Apple — Sign in with Apple, and the Apple Push Notification service that delivers notifications to your device.
• Google — Google Sign-In, and Google Maps, which renders the map and therefore receives the map requests from your device.
• GitHub — hosting of app update bundles, which means it receives your IP address when the app checks for an update.

We may also disclose data if the law obliges us to. We do not sell data and do not share it for advertising.

Data is stored on servers in the European Union (Ireland). Apple and Google may process some data outside the EU under the European Commission's standard contractual clauses.

• Account and profile — while your account exists.
• Stories — 24 hours, then deleted automatically.
• Meetups, messages and ratings — while your account exists, so that the history of a meetup stays readable for its participants.
• Reports and blocks — kept while needed to keep the service safe, so that a removed user cannot simply return.
• Error logs — a short period, then deleted.

You can delete your account yourself: Profile → Account → Delete account. This removes your profile, your meetups, your messages, your stories and your photos immediately and irreversibly.

You may also write to info@spontly.eu and we will delete everything within 30 days. Some records may remain briefly in encrypted backups before they expire.

Under the GDPR you have the right to access your data, to correct it, to have it deleted, to restrict or object to processing, and to receive it in a portable format. Where processing is based on consent, you can withdraw it at any time.

Write to info@spontly.eu and we will answer within one month. If you believe we handle your data incorrectly, you may complain to the Czech Data Protection Authority (Úřad pro ochranu osobních údajů, uoou.gov.cz) or the authority in your country of residence.

Spontly is not intended for people under 17 and we do not knowingly collect their data. If you believe a minor has created an account, tell us at info@spontly.eu and we will delete it.

Traffic is encrypted with HTTPS. Access to the database is restricted by row-level security rules, so one user cannot read another user's private data. No system is perfectly secure, but we will inform you and the supervisory authority of a breach affecting you as the law requires.

We may update this policy. We will announce significant changes in the app or by email. Questions about this policy or about your data:
Email: info@spontly.eu