Spottly legal

Privacy Policy

Effective and last updated: July 12, 2026

How Spottly handles information, permissions, choices, and account controls.

Scope

This Privacy Policy describes how Spottly handles information in the Spottly iPhone application, related services, and this website. It does not govern third-party services under their own policies.

[LEGAL REVIEW REQUIRED: Insert the operator’s registered legal name.]

[LEGAL REVIEW REQUIRED: Insert the operator’s mailing address.]

Depending on the features you use, you may provide profile details, goals, food logs, custom foods, recipes, workout records, exercise preferences, friend connections, privacy choices, and support correspondence. You choose whether to add optional profile and activity information.

Account and authentication information

Spottly uses Sign in with Apple. The service receives the account identifier and any information Apple makes available with your authorization. Session credentials are stored in the iPhone Keychain; email is treated as account metadata rather than the primary identity key.

Food and nutrition information

Food searches, favorites, recent items, meal entries, serving adjustments, goals, custom foods, recipes, and saved meals may be stored so Spottly can provide logging, history, and synchronization. Provider-backed records retain their source and attribution details.

Workout and fitness information

Exercise favorites, templates, active workouts, sets, repetitions, weight, RPE or RIR, rest timing, and completed workout history may be stored to provide training and progress features. This information is not used to diagnose or treat a health condition.

Camera and barcode scanning

Spottly requests camera permission only when you choose barcode scanning. Camera access is used to read the barcode in that workflow. You can deny camera permission and continue using food search and manual entry.

Photos and uploaded media

If you add a custom-food or recipe image, Spottly processes it for private storage. Uploaded images are verified for supported type and size, re-encoded to remove embedded metadata, and retrieved through ownership-checked access. They are not placed in a public storage bucket.

Device and technical information

The service necessarily processes limited request and device information to authenticate requests, synchronize records, operate the service, and investigate reliability or security problems.

[LEGAL REVIEW REQUIRED: Confirm the production logging, monitoring, analytics, crash-reporting, and cookie practices before describing specific technical fields.]

Optional website analytics

On this website, Spottly uses Google Analytics 4 only after you select Accept analytics. Analytics is off by default. Before you accept, Spottly does not load Google Analytics, set Google Analytics cookies, or send analytics requests.

After you accept, Google may process browser and device information, pages and features you use, referral and campaign information, approximate location, and engagement information. Spottly uses this information to understand how the website is used and improve its pages and features.

Spottly does not intentionally send names, email addresses, health or fitness information, form contents, precise location, or other information intended to identify you to Google Analytics.

Google LLC provides Google Analytics 4. Learn how Google uses information from sites and apps that use its services. You can decline analytics or change your choice at any time using Analytics preferences in the site footer. If you later decline, Spottly stops future analytics and removes known Google Analytics cookies for this site where technically possible.

[LEGAL REVIEW REQUIRED: Confirm the jurisdiction-specific consent language and Google Analytics provider disclosure before publication.]

How information is used

Provide food, workout, progress, profile, friend, and account features.
Authenticate users and maintain sessions.
Synchronize local changes and resolve record conflicts.
Respond to support, privacy, and account-deletion requests.
Protect the service and diagnose reliability or security issues.

Service providers and external data sources

Food records may originate from Open Food Facts or USDA FoodData Central. Sign in with Apple supports authentication. Hosting, database, caching, and private object-storage infrastructure supports the service.

[LEGAL REVIEW REQUIRED: Identify the actual production infrastructure vendors, subprocessors, and their roles after deployment choices are final.]

Data retention

Spottly retains information only as needed for the purposes described here and as law may require.

[LEGAL REVIEW REQUIRED: Confirm retention periods and lawful retention exceptions.]

Security practices

Spottly data is end-to-end encrypted and remains encrypted in transit, at rest, and in backups. Sharing controls determine which people can see the activity you choose to share. Other measures include Keychain storage for iPhone session credentials, scoped access to user-owned records, rotating session tokens, verified private-media uploads, and ownership checks. No system can promise absolute security, and this policy does not claim a certification or guarantee.

Your choices and controls

Decline or revoke camera permission in iPhone Settings.
Choose visibility for supported friend and profile information.
Update account, profile, and goal information in the app.
Choose whether this website uses optional analytics. Use Analytics preferences in the footer to review or change your choice at any time.
Request help or exercise applicable privacy rights through support.

Account deletion

A signed-in user can start deletion from Settings → Account & Security → Delete Account. The service may require recent authentication, revokes active sessions, and begins deletion. See the dedicated Account Deletion page for instructions and support alternatives. Any delay or lawful retention exception must be confirmed before publication.