Privacy policy

Last updated 9 November 2026

Spotco is an app and website for finding and hosting group activities: football, padel, hikes, runs, board game nights, club nights. This policy explains what we collect, why, who else sees it, and how to get it back or removed. It is written to be read, not to be survived.

Who we are

Keshi Henkeshi Ile (Aleje Jerozolimskie 190C, 02-486 Warsaw, Poland, NIP 5214029015) is the data controller for the personal data described here. For anything about your data, write to privacy@spotco.app.

What we collect

What you give us

• Your email address. Required: it is how you sign in and how we send you sign-in links.
• Your first and last name (or, for a group or organization, its name) and, if you add one, a profile photo. Other people using Spotco see the name in full, and the photo.
• If you sign in with Google or Apple, we receive your name, email address and, from Google, your profile photo. We do not receive your password or access to anything else in that account.
• A phone number, if you choose to verify one. We send a one-time code by SMS to confirm it is yours. It is never shown on your public profile. Venue owners confirm their number this way when claiming a venue.
• Your city and your language. The city decides which activities you see; the language decides what language notifications reach you in.
• Content you create: events you host, their names, descriptions, rules and line-ups; photos you add to an event (up to eight); chat messages, and private messages with an activity’s organizers; reviews of hosts and venues; reports you make.
• Drafts of activities you organize: what you have filled in so far, saved as you go and when you choose Save for later, so you can finish it in the app or on the website. Nobody else using Spotco sees a draft; Spotco’s team can, to help organizers who get stuck.

Your date of birth

You must be 18 or over to use Spotco. You give us your date of birth once, during sign-up, and we keep it on your account. We check it against 18 straight away, and we check it again whenever you join an event whose host has set an age limit. A yes/no flag cannot do that second job: it says you were 18 when you signed up and nothing more, so an age limit would be a sentence on a page rather than a rule.

It is private. Nobody else using Spotco can see it, it is never shown on your profile, and the database enforces that rather than the screen. Nothing else is derived from it: we do not use it for advertising, and we do not send birthday messages. It is deleted when you delete your account.

If you tell us you are under 18, nothing is saved at all, neither the date nor the flag, and the account cannot be used.

This changed in September 2026. Until then we calculated your age and discarded the date, and this policy said so. We now keep it, for the reason above.

Location

• Your city: you pick it, or you let the app suggest one from your approximate location.
• Your phone’s location: only if you grant the permission. The app uses it on your phone to suggest your city and show how far away activities are, and keeps only your last position, on your phone. To turn a position into a country or an address, your phone asks its own map service (Apple on iPhone, Google on Android). We do not receive your position and keep no location history, with the one exception below.
• Your position on the website: only if you allow it, when you sort a list of venues by Nearest to me, or filter a list of activities by distance from where you are. Your browser uses it to put the nearest first. It is not sent to us or kept.
• Meeting points you set as an organizer: the address and pin of an activity you create are saved with it and shown to everyone who can see it, and on the website if it is public. That is the point of them. If you tap Use my current location while creating or editing an activity, your position at that moment becomes the pin and is saved and shown the same way, so move the pin if you are not at the meeting point.

You can refuse or withdraw the location permission at any time in your phone’s settings. The app works without it; you pick a city by hand instead.

What we record as you use it

• Sessions you join, host or leave, and whether you turned up. Hosts mark attendance after an event.
• Your reliability score, and the entries behind it: a no-show, a late cancellation, a completed session. Kept as a list rather than a bare number so it can be explained and corrected.
• Payments: for each payment through Spotco, the amount, the service fee, what went to the host or venue, any refund, and Stripe’s reference for it; never your card. Entries from the old in-app wallet stay listed with their reason and date.
• Pro Organizer, if you subscribe: your plan, its status and renewal date, and Stripe’s references for you and the subscription. The newsletters you send to your followers, with their subject, text and how many people they reached.
• Venue plans, if you buy Starter or Pro for a venue: the plan, its status and renewal date, and Stripe’s references for the venue and its subscription; never the card.
• Payouts, if you are paid as a host or run a venue that is: the Stripe account the money goes to and whether Stripe has verified it. Your identity documents and bank details go to Stripe, not to us.
• Safety records: reports you make or that are made about you, including a copy of a reported message or review, and accounts you block.
• Your acceptance of the terms of use: when you accepted them, and which version.
• A notification token for your phone, if you allow notifications, so we can send reminders and updates. It identifies the app on your device, not you, and is removed when you sign out or delete your account.

Technical data

Our hosting providers process your IP address and standard request information to serve the app and website and to protect them from abuse. The website’s cookies, and the analytics you can choose to allow, are described under Cookies on the website below.

Product analytics and crash reporting are disabled unless we have configured a key for them. Where enabled, analytics records a small set of actions (viewing a session, joining, starting and publishing an event, starting a venue claim) associated with your account ID. Crash reports include the error and device model. Neither reads your messages.

The waitlist

Before Spotco was in the App Store and Google Play, the website offered to tell you when it was. If you signed up, we collected your email address, a city if you chose to say which, the language of the page you were reading, and which page you signed up on. Nothing else, and no account was needed. The list closed on 16 October 2026, when the iPhone app was released: nobody can join it any more.

We use it for exactly one thing: to send you one email on the day the app is released. It is not attached to a Spotco account, it is not used to build a profile of you, and it is never sold, shared or passed to an advertiser. We hold it on the basis of your consent, which you can withdraw at any time.

Write to privacy@spotco.app and we will remove your address. You do not have to give a reason. If you later create an account and then delete it, the waitlist entry for that address goes with it.

Venue enquiries

If you run a venue and write to us through the form on the For venues page, we collect your name, your email address and your role at the venue, the venue’s name and city, and, if you give them, a phone number and a message. You do not need an account.

We use them only to answer you and, if you ask, to set your venue up on Spotco. Nobody else using Spotco sees them, we do not use them for marketing, and we never sell them. We delete an enquiry twelve months after you sent it. To have it deleted sooner, write to privacy@spotco.app.

Venue pages

Spotco lists sports venues so that people can find somewhere to play. For a venue that has not joined Spotco, we write its page from its own website, one venue at a time, and the page says so, with the date we last checked it: its name, address and district, what can be played there and how many courts or pitches it has, its opening hours and prices, and the links, phone number and email address it publishes for its customers. We do not copy other directories, maps or reviews, and we do not use its photos.

These are business details, published by the venue for exactly this purpose. Where a venue is run by a sole trader they can also be personal data, which we hold on the basis of our legitimate interest in people being able to find places to play. We do not use them for marketing. Anyone at a venue can ask us to correct its page or remove it, through the links at the foot of the page or by writing to privacy@spotco.app.

When somebody opens a venue’s page, or follows its website, booking link, phone, email or social links, we count it for that venue, with nothing about who it was: no account, no address and no cookie. The venue sees the counts on a paid plan.

The same for activities: when an activity appears in a list on screen, its page or screen is opened, or its join page is opened, we count it for that activity with a category of where the visit came from (a search engine, a social network, a Spotco page, a campaign link or none), and nothing about who it was: no account, no address, no cookie and no device identifier. Its organizer will see the counts.

Claiming a venue

If you run a venue, you can claim its page. We record your role at the venue, a note if you add one, and the evidence you choose to give: a document that names the venue (a registry extract, an invoice, a lease) and an email address at the venue’s own domain. We write to that address once, with a link, and record whether and when it was confirmed. Only Spotco’s admins see a claim and its evidence, and only to decide it.

If somebody gives your address at a venue in a claim, you will receive that one email. If you ignore it, nothing changes, and we do not write again.

Activities listed from elsewhere

Spotco also lists some public activities that are advertised somewhere else, for example on an organizer’s own website or on another platform, so that people can find them. Spotco is not their organizer. For each one we record the facts needed to find it: its name, the activity, the date, time and place, whether it is free and what it costs, the organizer’s name as the original listing gives it, and the address of the original listing, where it came from and when we checked it. The activity’s page says it is an external activity and links to the original.

We prefer the name of a club or organization to the name of a person, and we do not copy descriptions, photos, logos, attendee lists or comments. Where the organizer is a person, their name is personal data, which we hold on the basis of our legitimate interest in people being able to find activities near them. The organizer, or anybody else, can ask us to correct a listing, take it down or hand it over to its organizer, through the links on its page or by writing to privacy@spotco.app.

Asking us to correct, remove or hand over a listing

If you ask for a correction or a removal, we collect your email address, your connection to the activity (for example that you organize it) and the reason you choose, and, if you give them, your name and a message. You do not need an account. We use them only to deal with your request and to reply, and only Spotco’s admins see them. We delete a request twelve months after you sent it.

To claim an activity, you sign in, because it moves to your account. With your request we keep which account sent it, its name and email address, where you told us we can see that you organize it, and that you confirmed you may manage the activity and have the rights to what you add. We check that you organize it before we hand it over, for example from your social media profile or an address at the organization’s domain. We record how we checked it and what we decided. If we approve it, the activity moves to your account and we email you; if not, we email you our reason. We delete a claim request twelve months after you sent it, or at once if you delete your account. A claim sent before claims needed an account is answered with a link that makes the activity yours, and when you use it we record the same confirmation.

Answers to an organizer’s questions

An organizer can ask questions when you join their activity, for example your Instagram or where you are from. We record your answers, once for an activity that repeats. Answering is up to you: an optional question can be skipped, and if a required one asks something you would rather not say, you can choose not to join.

Your answers are seen only by you, the organizer of that activity and its co-organizers, never by other attendees, and a Pro Organizer can include them in the list of attendees they download. We hold them to pass them to the organizer of the activity you join, as part of the service you asked for. Organizers may not ask about health, beliefs, sex life or orientation, or racial or ethnic origin, or for documents, passwords or payment details (terms, section 4). How an organizer uses the answers they receive is the organizer’s responsibility.

We delete your answers twelve months after the activity’s last date, and at once if you delete your account. To have them deleted sooner, write to privacy@spotco.app.

Private messages with an organizer

If you have a place on an activity, a place in its queue or a request to join it, you can write privately to its organizer, and its organizer can write privately to you. We record the messages, who wrote each one and when, and when each of you last read the conversation.

A private conversation is seen only by the attendee, the organizer of that activity and its co-organizers, never by other attendees. Nobody at Spotco reads it unless one of you reports a message: our team then sees that message and the three before and after it, only to decide the report.

If no phone of yours receives Spotco’s notifications, we email you when you have a new private message, at most once an hour for each conversation. The email names the activity and links to the conversation; the message itself is not in it.

We hold the messages to deliver the conversation you started or answered, as part of the service you asked for. We delete a conversation twelve months after the activity’s last date. If the attendee deletes their account, their conversations are deleted with it. If an organizer deletes theirs, what they wrote in attendees’ conversations stays, shown as “Deleted user”, so the attendees can still read the answers.

Reminders to organize again

If your last activity is over and you have nothing coming up, we may email you a reminder to organize the next one, at most a few times until you do. We record which email we sent you and when, whether its button was pressed, and whether you published an activity in the two weeks after it, to see which wording helps organizers. We do not track whether you opened it.

Every reminder has a link to stop them, and you can turn them off or back on in the app, in Settings, Notifications. We delete the record of each email twelve months after we sent it, and at once if you delete your account.

Asking a venue to book

When you organize at a venue that is not on Spotco yet, you can ask it to book through Ask to book. We then email the venue, at the address it publishes, your name, what you want to organize, the date, time and length, how many attendees and your message. The reply address is your email address, so the venue sees it and answers you directly; the replies do not reach us.

We keep a record of each request (the venue, what you asked and when it was sent) for twelve months, to keep requests to a few a day and to answer questions about them, then delete it; it goes at once if you delete your account. A venue can stop every request through Spotco with the link in each one; we then keep its email address on a list so that nothing more is sent to it.

Tax details for payouts

Before we pay an organizer or a venue for anything, EU tax rules (DAC7, in Polish law since 2023) require us to know who we are paying. If you set up payouts, we ask for how you are paid (as a private person, a sole trader, or a company, association or foundation), your name and date of birth and, if you have no tax number, your place of birth, or for a business its legal name and registration number, your address, your tax identification number and VAT number, the account we pay into, and for a venue its land registry number if you know it.

We use them to report, once a year, each person or business we paid and what they received to the Polish tax office (Krajowa Administracja Skarbowa), as the law requires, which is also the legal basis. Only you, Spotco’s admins and the tax office see them. We keep them for as long as tax law requires, which can be up to ten years, including after you delete your account.

Whether you sell as a private person or as a business is also shown to buyers next to a price paid through Spotco, because consumer law requires marketplaces to say so.

Cookies on the website

The website uses two kinds of cookie.

Cookies it needs

• Sign-in cookies, only when you sign in on the website (to join or book an activity, to claim one, or to use the venue dashboard). They keep you signed in and go when you sign out. While you sign in with a code, one more (spotco_signin) holds the address the code went to, for an hour at most, so the page can check the code against it.
• Your cookie choice (spotco_consent), so we do not ask on every page. Kept for twelve months.
• Your city. The website suggests one from the town your IP address points to, and keeps nothing of it. If you choose a city with the pencil beside its name, your choice (spotco_city) is kept in your browser’s storage rather than a cookie, so the buttons lead to that city, until you choose another or use your location again.

These are set without asking, because the website cannot do what you asked without them. They are not used to track you.

When you pay on the website, Stripe’s payment form is loaded for that step only. Stripe sets two cookies of its own, __stripe_mid (for a year) and __stripe_sid (for thirty minutes), and looks at how the form is used, to tell genuine payments from fraud. They are needed for the payment you asked for, and Stripe uses them only for fraud prevention and security, never for advertising.

Analytics, only if you accept

The first time you open the website we ask whether you accept analytics cookies. Nothing is measured unless you choose Accept, and choosing Reject changes nothing else about the site.

If you accept, Google Analytics measures how the website is used: the pages you open, how you arrived (for example from a search), your approximate location (country and city, worked out from your IP address), and your device, browser and language. It sets two cookies, _ga and _ga_ followed by an identifier, kept for up to thirteen months. We do not link it to your Spotco account, and its advertising features are switched off: nothing is used to show you ads.

Google Ireland Limited processes this data for us. Google may process it in the United States, which relies on the EU-US Data Privacy Framework.

You can change your mind at any time with Cookie settings at the bottom of every page. Withdrawing deletes the analytics cookies from your browser.

Why we are allowed to use it

Who else sees it

Other people using Spotco

Your name, photo, reliability score, host rating and the activities you have taken part in are visible on your profile in the app. Your email address, phone number and wallet are not. The database enforces this, not just the screen.

When you join an event, the host and the other participants can see that you have joined. On public lists, profile photos of people going can appear beside the number going, without their names, and an activity’s public page shows their first names and profile photos. Messages in an event chat are visible to everyone in that chat; a private message, only to the attendee and the activity’s organizers (see Private messages with an organizer). A review you write of a host is shown with your name and photo on that host’s events.

A Pro Organizer you follow can send you newsletters by email. They never see your email address, and every newsletter has a link to stop them. A Pro Organizer can also download a list of who joined their events and what was paid, by name and with any answers to the host’s questions, never with an email address or phone number.

If you are a Pro Organizer, that is shown beside your name on your activities.

The public website

When a host makes an event public, it gets its own page on spotco.app that anyone can open without an account, and that search engines may list. That page shows the event, its place and photos, the host’s name, photo and rating, and reviews of the host, and how many places are taken. It does not list who has joined. An event shared by link only gets a page too, but it is marked so search engines do not list it. Pages stop being listed once the event is over or cancelled.

An organizer also has a page of their own on spotco.app, linked from their activities: their name, photo and description, their public activities coming up and held, their rating and reviews, and how many follow them, never an email address, a phone number or who joined. An organization’s page may be listed by search engines; a person’s is marked so they do not list it.

Venues

If you book an event at a venue, the people who manage that venue are told the booking exists and can see it in their dashboard. If the venue takes payment online, they also see that it was paid, and whether it was refunded or paid to them, never your card details.

Service providers

• Supabase: database, sign-in, file storage and server functions.
• Vercel: hosts the website.
• Google and Apple: sign-in, if you choose them; maps (Apple Maps on iPhone, Google Maps on Android), which receive what is needed to draw the map.
• Expo, Apple and Google: deliver notifications to your phone. They receive the notification text and your device token.
• Stripe: processes payments by card and BLIK, the Pro Organizer subscription and its billing, venue plans, and payouts to hosts and venues. Stripe receives your card details directly, and the identity and bank details of anyone who sets up payouts. We never see your card details, and of the rest we keep only the tax details you give us for payouts (see Tax details for payouts).
• Resend: sends our emails (sign-in links, confirmations and reminders, the email about a new private message, the weekly city email, reminders to organize again and hosts’ newsletters), and receives your email address and the message to do so.
• Cloudflare (Turnstile): checks that a sign-in on the website is made by a person and not a bot, before a sign-in code is sent. It runs in your browser and receives technical information about the visit to do so, such as your IP address and your browser; we receive only whether the check passed.
• An SMS provider (Twilio): sends phone verification codes, and receives your phone number to do so.
• OpenStreetMap, or Google Places where enabled: address search while creating an event, or when filtering activities by distance from an address. Your search text is sent, without your identity, and Spotco does not keep it. On the website, the map for placing the meeting point loads its tiles from OpenStreetMap’s servers, which receive your IP address, as any site whose images you load does.
• Sentry (crash reporting) and PostHog (analytics): only where we have enabled them.
• Google Analytics: measures visits to the website, only if you accept analytics cookies.

We do not sell your personal data, and we do not share it with advertisers. There are no advertising SDKs in the app.

Where it is held, and for how long

Data is held on our provider’s infrastructure in the European Union. Where a provider processes data outside the EEA, that transfer relies on the European Commission’s standard contractual clauses or an adequacy decision.

• Your account: until you delete it.
• Activity chats: become read-only 48 hours after the activity ends, and are kept so everyone in them can read them back, including after one of them deletes their account.
• Private messages with an organizer: read-only 48 hours after the activity ends, and deleted twelve months after its last date, or with the attendee’s account.
• Payments, payouts, billing for Pro Organizer and venue plans, and old wallet entries: as long as tax and accounting law requires us to keep financial records.
• Safety reports: kept after the reported account is deleted, in anonymised form, because a pattern of reports is exactly the thing that stops being visible if it is erased with the account.
• Waitlist addresses: until the app is released and that one email has been sent, or until you ask us to remove yours, whichever comes first.
• Venue enquiries: twelve months from when you sent them, then deleted automatically.
• Venue pages: for as long as the venue is open, and corrected or removed when the venue asks.
• Activities listed from elsewhere: like any other activity, kept after it has happened; corrected or removed when its organizer asks.
• Requests about a listing: twelve months from when you sent them, then deleted automatically.
• Answers to an organizer’s questions: twelve months after the activity’s last date, then deleted automatically.
• Drafts of activities: until you publish or delete one, or twelve months after you last changed it, then deleted automatically.
• Reminders to organize again: the record of each one twelve months after it was sent, then deleted automatically, or with your account.
• Requests to a venue to book: twelve months from when you sent them, then deleted automatically, or with your account. A venue’s request to receive nothing more is kept for as long as we send requests.
• Tax details for payouts: as long as tax law requires (up to ten years), including after an account is deleted.
• Counts of a venue page’s views and clicks: 400 days, then deleted automatically.
• Counts of how an activity is seen: 400 days, then deleted automatically.
• Venue claims: for as long as the account that made them. The document, the phone number and the address at the venue’s domain are removed when that account is deleted.
• Website analytics: fourteen months in Google Analytics, then deleted automatically.

Deleting your account, and what survives it

You can delete your account in the app: tap your photo at the top left to open Settings, then Privacy and safety → Delete my account. It takes effect immediately and you are signed out. While you organize an activity that has not started yet or own a claimed venue, the app first asks you to cancel the activity, or to write to us so we can take the venue off your account, because others depend on them. Without the app, see how to delete your account.

Please read this part. We do not erase everything outright, because your account is attached to things that belong to others too: the history of everyone who attended an activity with you, reviews you wrote, messages in activity chats, and safety reports.

Deleting your account removes:

• Your name (replaced with “Deleted user”, including in notifications about you in other users’ Spotco inboxes; push notifications and emails already delivered cannot be recalled), email address, phone number, date of birth, bio and profile photo, including the photo file itself
• Your notifications and your phones’ notification tokens, follows, saved activities, city alerts, blocked list, unfinished bookings started on the website, drafts of activities and waitlist entry
• Your places in upcoming activities (including “Join every week”), and requests to join that were still waiting for an answer
• Your private conversations with organizers as an attendee, with every message in them
• Your access to any venue you help manage
• Documents you uploaded to claim a venue, and the phone number recorded with the claim. Whether the claim was approved or refused, and the note you wrote with it, stay on the venue’s record
• Photos you uploaded that no activity shows
• Your ability to sign in: every phone and browser still signed in is signed out, and our log of your sign-ins is deleted. The account cannot be recovered

These stay, shown as “Deleted user”:

• Your past attendance, so headcounts and other attendees’ history stay correct
• Reviews you wrote, so organizers and venues keep their ratings
• Messages you sent in activity chats, and chat notices that named you at the time (such as “Ola joined”), so the conversations still make sense to everyone in them
• What you wrote as an organizer in an attendee’s private conversation, so they can still read your answers
• Activities you organized, with their names, descriptions, places and photos, because they are part of their attendees’ history
• Reports you made and reports about you, because a pattern of reports has to outlive the account
• Your reliability score and the entries behind it, and any results an organizer recorded for you
• Venues you added to Spotco, as part of the venue’s record
• Payments, payouts, billing for Pro Organizer and venue plans, the tax details given for payouts, and old wallet entries, for as long as financial and tax records must be kept

If you want something erased that this leaves behind, such as a message or a photo, write to privacy@spotco.app and we will look at it individually.

Your rights

You can ask us for a copy of your data, to correct it, delete it, restrict what we do with it, move it elsewhere, or object to us using it. You can withdraw consent (for location, notifications or analytics) at any time without affecting what came before.

Write to privacy@spotco.app. We will answer within one month.

If you are not satisfied, you can complain to your data protection authority. In Poland that is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

Children

Spotco is for adults. You must be 18 or over. If we learn that an account belongs to someone under 18 we will close it.

Changes

If we change this policy in a way that affects you, we will tell you in the app before the change takes effect. The date at the top always reflects the current version.