Privacy policy

What we collect

Your account. The email address you sign in with and, if you give one, a display name. The website and the apps sign you in with a one-time link sent to your inbox rather than a password.

What you add. Springs you submit (name, description, directions, coordinates, temperature and a photo), discussion posts and replies, and ratings and reviews. Approved springs, posts and reviews are visible to other people using Hot Spots.

Photos. A photo you upload is stored so it can appear with the spring once approved. Photos can carry hidden metadata such as where and when they were taken. The iPhone app removes it before uploading; on the web and on Android, remove location data from a photo before you upload it if you do not want it published.

Profile photo. The photo you choose appears beside your discussion posts and ratings to other signed-in members who can see them, with your display name. If you have not chosen one, we look up whether your email address has a Gravatar and, if it does, use a copy of that photo until you upload your own or remove it. We store our own resized copy and remove its metadata, and we delete it with your account.

Home base and saved searches. If you set a home base, we store the place you chose so searches and route previews can start there, and we store the searches you save. Only you can see either, and both are deleted with your account.

Invitations. You have an invite code, and we record which accounts joined through it, so we can credit you; you see how many joined, never who. If you invite someone by email, we send them one message that names you, and keep only a one-way fingerprint of their address, never the address itself, so that nobody can invite them again too soon and nobody can email them at all once they ask us to stop.

Location. Only when you allow it: to show springs near you and to record a spring's position when you submit one. Your position is sent with that search or submission and is not stored against your account.

Address search. When you look up an address while adding a spring, the text you type goes to a map provider. On the website it goes through our server to Mapbox, so Mapbox receives the address but not who asked. The iPhone app asks Apple's map search directly, along with the rough area around you if you have shared your location. The Android app asks your phone's built-in address lookup, which on most phones is run by Google.

Membership. If you buy a membership we record which plan, which store it came through, its status and when it renews or ends. Card details go to Stripe, Apple or Google, never to us.

Notifications. If you turn notifications on in an app, we store your device's push token so we can send them. Turning them off or signing out removes it.

Messages to us. What you send through the contact form (your name, email address and message) and any email you send us. Email to our support address is forwarded to our support inbox, and we keep a record of which messages belong to which conversation so replies reach you.

Technical data. Our hosting provider keeps request logs, which include IP addresses, to run and secure the service. Web analytics are cookie-free and aggregated: they count page views and do not identify you.

Cookies and storage on your device

The website sets only the cookies it needs to keep you signed in. There are no advertising or tracking cookies.

The website and the apps keep some data on your device so they work offline: springs you have viewed, offline maps you have saved, submissions waiting for signal, and your map settings. Signing out clears the springs you have viewed; your offline maps, unsent submissions and settings stay on the device for when you sign back in. Deleting your account clears all of them from the device you delete it on. Offline maps are kept per device rather than per account, so that includes every offline map saved there, whichever account saved it.

A member's invite link you follow is remembered in your browser for up to 30 days, until you sign in, so that member can be credited if you join.

Why we use it

To provide the service you asked for: your account, your submissions and posts, your membership and offline use. This is the contract between us.

To keep the service safe and working: reviewing submissions, stopping abuse, fixing faults and keeping records we are required to keep for payments. These are our legitimate interests or legal obligations.

To send you notifications, only if you turn them on. That is your consent, and you can withdraw it at any time in the app or in your device settings.

Who processes it for us

Supabase stores the database, the sign-in system and uploaded photos, in its US West region (Northern California). Vercel hosts the website and the server the apps talk to, in the United States. Uploaded photos are served through a content delivery network, which may keep a copy of a deleted photo for a short time after we delete it.

Stripe processes payments on the website. Apple and Google process purchases made in their app stores and deliver push notifications. They also answer address searches in the apps: Apple for the iPhone app, and Google, on most Android phones, through the phone's built-in address lookup.

Mapbox provides the maps, address search on the website, and route previews. For a route preview our server sends Mapbox your starting point (your home base or your current location) and the spring, but not who asked.

Mapbox provides the maps and address search on the website. Map requests go from your device to Mapbox, and the mapping libraries in the apps may send Mapbox anonymised usage data under Mapbox's own privacy policy.

Gravatar (run by Automattic) is asked whether your email address has a profile photo. Our server sends it a one-way hash of your address, not the address itself, and other people's browsers never contact Gravatar about you, because we serve our own copy of the photo.

Resend delivers our email, including sign-in links. Zoho hosts the inbox that receives email sent to us.

Each of them processes data only to provide their part of the service, under their own terms and data protection commitments. Where data leaves the UK or the European Economic Area, it is covered by the safeguards those providers offer, such as the European Commission's standard contractual clauses.

How long we keep it

Your account and everything attached to it, until you delete your account.

Payment records, for as long as tax and accounting law requires, the payment providers keep their own records for the same reason.

Contact messages, and the email you send our support address (which our email providers keep and our support inbox receives) for up to two years after the conversation ends, unless you ask us to delete them sooner. Deleting your account does not delete these, because they are tied to an email address rather than to the account; ask us and we will.

Request logs, for as long as our hosting provider retains them, which is a matter of days to weeks.

Invitation fingerprints, with the account of the member who sent them, and deleted with it. The fingerprint of an address that asked not to be emailed is kept, so that we never email it again.

Deleting your account

You can delete your account at any time: on the website under Your account, or in either app on the Account screen. If you can no longer sign in, write to us from the address on the account and we will delete it for you.

Deleting your account removes your sign-in, your profile, your ratings, any submissions still waiting for review, your photos, your membership records and your device's notification registration. If you confirmed your email address, our record of which support emails belong to which conversation is removed too; the emails themselves are kept as described above. It ends a web membership straight away (cancelling any renewal with our payment provider and removing your customer record there) and clears what the device you delete from keeps: viewed springs, unsent submissions, settings and every offline map saved on it.

Some things stay. Springs you added that are already listed stay listed without your name, with their photo moved out of your account. Your discussion posts stay too, shown as written by a deleted member, so other people's replies still make sense; delete any you want gone before you delete your account. Contact messages and support email are kept as described above. Stripe keeps its own records of payments and invoices, as financial law requires.

An App Store or Google Play subscription is billed by Apple or Google, not by us, and deleting your account does not cancel it. Cancel it in your store's subscription settings. Any membership bought through a store, including lifetime access, belongs to the deleted account and cannot be moved to a new one.

Your rights

You can ask to see, correct, export or delete your personal information, and object to or restrict how we use it. On the website, under Your account, you can download your data: your profile, submissions, discussion posts, ratings, membership records, the devices registered for notifications, a list of the photo files stored for your account (where each is kept, not the images themselves) and, if you confirmed your email address, your contact messages and a record of your support conversations (subjects and dates, not the emails). It leaves out what we never hold, such as card details, and the codes that would let someone act on a store purchase or send to your device. You can delete your account there or in the apps.

For anything else, contact us using the details below. We will answer within one month. If you are in the UK or the European Economic Area you can also complain to your data protection authority, and if you are in California you have the rights the CCPA gives you; we do not sell or share personal information as that law defines it.

Children

Hot Spots is not intended for children under 16, and we do not knowingly collect information from them. If you believe a child has given us information, contact us and we will delete it.

Changes and contact

If we change this policy in a way that matters, we will update the date at the top and tell you in the app or by email before the change takes effect.

Questions or requests: use the contact page, or email admin@hotspots-usa.com.