Privacy Policy

Who we are

SpotUs (“we”, “us”) operates the SpotUs mobile app and related services, including https://joinspotus.com. Questions about this policy: support@joinspotus.com. Safety reports can also go to reports@joinspotus.com or through in-app Report.

Information we collect

Account: email address, username, password (stored by our auth provider, not in readable form), date of birth (to enforce our age minimum), and optional profile name and profile photo. You may also save a workout split and a My Spot gym. Sign-up is email and password. If we offer Sign in with Apple or Google, we receive the identifiers those services share with us (such as a token and, when you allow it, name or email).

Social content you create: friend connections, friend requests, Close Friends, and blocks; callouts, comments, reactions, stories, food drops, and comments on gym posts; and photos or videos you save in Saved Media. Direct messages and chat photos are processed by our chat provider so you can message friends.

Location: with your permission, when Share My Location is on and you have Nearby open, we store your current coordinates so mutual friends can see you on the map and so the map can show who is at a gym. We do not keep a history of past locations — only the latest position, which is overwritten the next time we update it. Nearby gym search sends your approximate position to Google so we can list gyms around you. Map tiles are loaded from Mapbox.

Diet (optional): foods you log (name, grams, macros, source), and meal photos you scan. Scan photos are sent to our servers and to a third-party AI provider (Google) to estimate foods and macros. We may keep a short-lived scan cache (about 24 hours) so the same photo is not re-analyzed immediately. Manual search queries go to the USDA food database. Barcode lookups go to Open Food Facts. Estimates are not medical or nutritional advice.

Device and app: a push notification token; camera, microphone, and photo-library access when you use those features (profile photo, stories, food scans, chat photos, saving a stamped meal photo); and some preferences on your device (for example notification settings cache and which stories you have already seen). We may keep technical logs on our servers when something fails so we can fix bugs. We do not currently use a third-party crash-reporting or advertising-analytics SDK.

Invites: if you share a profile QR code, we send your invite link (which includes your username) to a third-party QR image service so the code can be displayed.

Reports: if you report a person or content, or someone reports you, we store the reason, optional details, and a snapshot of the reported content so we can review it.

Website and gym partners: if you claim a Spot or use the gym admin dashboard on our website, we collect the business and contact details you submit, dashboard login, and payment information processed by Stripe (we do not store full card numbers). Posts and events a gym publishes can appear in the app.

How we use information

To create and run your account, show profiles and usernames to other users, and let you use friends, Nearby, Pulse, messages, Diet, Saved Media, workout split, and My Spot.

To honor your location-sharing and notification choices. We store a push token so we can send notifications you have enabled. Lock-screen notifications include friend requests (when Messages notifications are on) and Pulse callouts: when a friend or your My Spot gym posts a callout, and when someone comments on your callout or replies to your comment. Stories, reactions, and direct messages are not sent to the lock screen yet. Pulse activity also appears in the app. A weekly streak reminder can be scheduled on your device.

To moderate the community (report, block, remove content or accounts that break our terms).

To improve the product — for example adding scanned foods to a shared food catalog without attaching them to your name, and using technical logs to fix bugs.

We do not sell your personal information. We do not use your private messages or precise location to advertise to you.

Who can see what

Your username and profile (name, photo if you add one) can be seen by other SpotUs users as needed to use the app (for example friend search and friend profiles). Streak badges on profiles are visible to other users. Your workout split is private unless you choose to show it to friends.

Location is visible only to mutual friends, and only if you enable Share My Location. Close Friends and Other Friends have separate settings: Always On (latest position while Nearby is open), At Spots Only (meant to share only when you are at a gym or Spot), and, for Other Friends, Don’t Share. Turning sharing off hides you from friends on the map. Friends who can see your location may also see that you are inside a gym on the map.

Pulse callouts and stories are shown to the audience you choose (friends or Close Friends), subject to friendship and block rules. Food drops you share to Pulse are shown to mutual friends. Partner gyms may publish gym posts; comments you leave there are visible to people who can see that post.

Direct messages are visible to people in that chat. We use a third-party chat service (Stream); they host message text and chat images to deliver the feature.

Your food log and Saved Media are private to you. Shared food photos (Food Drops or DMs) are visible to the people you share them with. My Stats (counts of posts and scans) is private to you.

Service providers

We use companies that process data on our behalf to run SpotUs, including: hosting, database, and storage (Supabase); chat (Stream); maps (Mapbox); place search (Google); food-scan AI (Google); food search (USDA); barcode lookup (Open Food Facts); push delivery (Apple, Google, Expo); email for report notifications (Resend); QR image generation when you share a profile code (QRServer); and payments for gym partners (Stripe).

Those providers see only what they need to provide their service, under their own terms and our instructions. Our website is also used for account emails (password reset and email confirmation) — not to store your map, Pulse, or diet content.

How long we keep data

We keep account and content data while your account is open. Stories and food drops typically expire after 24 hours. Callouts expire on the schedule you pick in the app (6, 12, or 24 hours). After a Pulse post expires, we may keep a private count of activity for My Stats.

Your food log is kept until you delete your account. Scan cache entries drop off after about 24 hours. Location is only the latest position and is removed when you turn sharing off or delete your account.

If you delete your account, we remove your profile, friends graph, posts, chat access and messages on our chat provider, diet log, location, scan cache, and media we store for you (avatars, stories, food drops, saved media). We keep reports other people filed about you (with a username snapshot, not a live account) so we can handle safety issues. Shared food-catalog entries that are not tied to your account may remain.

Backups and logs may persist for a short period after deletion, then drop off on our normal rotation.

Your choices

You can edit profile name and photo, location sharing, Close Friends, blocks, notification settings, workout-split visibility, and My Spot in the app.

You can delete your account from Account & Support. That is permanent.

You can turn off location, camera, microphone, or photos in your device settings. Features that need those permissions will not work.

You can disable notifications in the app and at the system level.

Children

SpotUs is for people 16 or older. We do not knowingly collect personal information from children under 16. If we learn that an underage account was created, we will delete it.

Security

We use industry-standard measures (encryption in transit, access controls, and database rules so users cannot read data they are not allowed to see). No method of transmission or storage is 100% secure.

Changes

We may update this policy. We will change the effective date above and, if changes are material, provide a notice in the app or by email. Continued use after the update means you accept the revised policy.

Contact

Privacy questions: support@joinspotus.com. Public copy: https://www.joinspotus.com/privacy.