Privacy Policy
Last updated: July 9, 2026
This Privacy Policy explains how Spotto ("we", "us", "our") collects, uses, and shares information when you use the Spotto mobile application, the Spotto website at spotto.gg, or the web game at spotto.gg/play (together, the "Service").
1. Information we collect
Account and profile
- A unique user identifier assigned when you first use the Service (including anonymous guest accounts)
- Username and optional profile avatar
- Whether you are signed in as a guest or with a linked account
- Authentication tokens stored on your device so you can stay signed in
Gameplay data
- Daily run times, board splits, and completion dates
- Difficulty level, streaks, and leaderboard placement
- In-progress game state stored locally on your device so you can resume a run
Device and usage data
- App or web version and platform (e.g. iOS, Android, web browser)
- Product analytics events (such as screens viewed, features used, and errors) via PostHog
- Technical logs needed to operate and secure the Service
- On the web, session data may be stored in browser local storage and cookies to keep you signed in
We do not intentionally collect precise location, contacts, or payment information through the Service.
2. How we use information
We use information to:
- Provide daily puzzles, save your progress, and display leaderboards
- Maintain streaks, personal bests, and run history
- Authenticate you and store your profile and avatar
- Improve the Service, fix bugs, and understand how features are used
- Enforce our Terms and Conditions and prevent abuse
3. Legal bases (EEA/UK)
Where applicable, we process data based on:
- Contract — to provide the Service and its core features
- Legitimate interests — analytics, security, and product improvement
- Consent — where required for optional processing
4. Sharing and processors
We use service providers to host, authenticate, store, and analyze usage of the Service. These providers process data on our instructions and under appropriate agreements. We do not sell your personal information.
| Provider | Role | Data involved | Privacy policy |
|---|---|---|---|
| Supabase | Backend hosting, authentication, database, avatar storage, and serverless functions | Account IDs, profile data, gameplay records, uploaded avatars, server logs | Supabase Privacy |
| PostHog | Product analytics | Usage events, device/browser metadata, pseudonymous user IDs | PostHog Privacy |
| Vercel | Website and web app hosting | IP address, request logs, cookies served by our site | Vercel Privacy |
| Free Dictionary API | Word definitions | Words looked up during play (no account data) | Dictionary API |
| Google Fonts | Typography on some platforms | IP address and font request metadata when fonts are loaded from Google | Google Privacy |
When you link an account with a third-party sign-in provider (such as Google or Apple, when available), that provider processes information according to its own privacy policy. We receive only the profile details needed to create or link your Spotto account.
Data may be stored and processed in countries other than your own, including the United States. We take steps to ensure appropriate safeguards where required.
5. Cookies and local storage
On the web, we use browser local storage and cookies to:
- Keep you signed in across visits
- Remember your theme and accessibility preferences
- Support core game functionality
PostHog may set its own cookies or use similar technologies for analytics. You can limit analytics collection through your browser settings or by contacting us.
6. Retention
We retain account and gameplay data while your account is active and as needed for leaderboards, streaks, and legal obligations. Local in-progress saves on your device are cleared when you complete a run or when they become stale. Analytics data is retained according to our analytics provider's settings and our internal retention policies.
7. Your choices and rights
Depending on your location, you may have rights to access, correct, delete, or export your data, or to object to certain processing. You can:
- Update your username and avatar in Settings
- Sign out of a linked account (when available)
- Uninstall the app or clear site data in your browser to remove local storage
To exercise privacy rights, contact us at ari@byaryeh.xyz.
8. Children
The Service is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us data, contact us so we can delete it.
9. Security
We use industry-standard measures to protect data in transit and at rest, including encryption and access controls through our hosting providers. No method of transmission or storage is completely secure.
10. Changes
We may update this Privacy Policy from time to time. We will update the "Last updated" date when we do. Continued use of the Service after changes means you accept the updated policy.
11. Contact
For privacy questions or requests, contact us at ari@byaryeh.xyz or through the support options listed on spotto.gg.