Privacy Policy
Effective date: 22 October 2026
Spotted is a mobile app for iOS and Android. You share an Instagram reel, YouTube Short or TikTok to Spotted, and it finds the places in that video and saves them to your own map. This policy explains what data the app uses, why, who helps us process it, how long we keep it, and the choices and rights you have.
The short version: we use your Google or Apple sign-in to give you an account, and we store the links you share and the places we find. After you agree in the app, the public videos you share are sent to AI and mapping services to find those places; the video files are deleted once they’ve been read. Payments for Spotted Pro go through the App Store or Google Play, so we never see your card. Your location stays on your phone. We collect crash reports and basic usage events, tied to a pseudonymous ID, to fix bugs and improve the app. We don’t show ads, we don’t sell your data, and we don’t track you across other apps or websites.
1. Who we are
Spotted is developed and operated by Abbas Anandwala, an independent developer based in India (“Spotted”, “we”, “us”). We decide how and why your personal data is processed, so we are the “controller” under the EU and UK GDPR and the “Data Fiduciary” under India’s Digital Personal Data Protection Act, 2023.
For anything about privacy, including requests and complaints, email hello@adevtutorials.in.
2. What we collect
Account information
When you sign in with Google, we receive your Google account ID, name, email address and a link to your profile photo. When you use Sign in with Apple (on iPhone), we receive a stable Apple account identifier, your email address (or a private relay address if you chose to hide it) and your name if you share it. We use these to create your account, identify you when you sign in, and show who is signed in. For Sign in with Apple we also keep a token from Apple, used only to revoke Spotted’s access when you delete your account. We keep sign-in session records so you stay signed in on your devices.
What you save
We store:
- The links you share to Spotted, and the platform they’re from.
- Public details of each post that we fetch: its title, caption, the creator’s handle and a thumbnail image.
- What we generate from it: a title, a short summary, the city, and the places we find (name, address, area, coordinates, Google rating, references to Google place photos with their authors’ names, and where in the video each place came up).
- The vaults (collections) you create, with their names and emoji.
This is what makes your saves sync across your devices. Your saves and vaults are private to your account; they aren’t shown to other users.
Purchases (Spotted Pro)
If you buy Spotted Pro, the payment is handled entirely by Apple (App Store) or Google (Google Play); we never receive your card or payment details. We use RevenueCat to check purchases with the store: it receives your Spotted account ID and the purchase details the store provides (plan, price and currency, purchase and renewal dates, and store transaction IDs). We store your current plan and when it ends. We also keep a record of when each save was made, which is how the free plan’s weekly limit is counted.
Push notification token
If you allow notifications, we store a push notification token for each device you’re signed in on, so we can tell you when a video’s places have been saved or when a video couldn’t be read.
Crash reports and diagnostics
When the app or our backend runs into an error, a crash report is sent to Sentry. It contains technical details about the error (such as the error message and where in the code it happened), your device model, operating system and app version, and your pseudonymous Spotted account ID, so we can tell whether one person or many are affected. It doesn’t include your name or email address.
Usage analytics
To understand which features people use and where the app gets in their way, the app sends usage events to PostHog: for example, which screens you open, when a save starts, finishes or fails, and when the Spotted Pro screen is shown. Events are tied to your pseudonymous Spotted account ID and include basic device information (device type, operating system, app version). They don’t include your name, email address, the content of your saves or your location. We don’t use the advertising ID, we don’t sell this data, and we don’t use it for advertising or to track you across other companies’ apps or websites.
Location
If you allow location access (“while using the app” only), your location is used only on your device to centre the map around you and show where you are. It is never sent to our servers. The map itself is Apple Maps on iPhone and Google Maps on Android; those map services handle data as described in their own privacy policies. When you search the map for a city, only the text you type is sent to look that place up, and we don’t store it.
Kept only on your device
Your theme and accent colour, whether you’ve agreed to the AI notice, and whether you’ve seen the share-sheet setup are stored on your phone. Your sign-in token is kept in your phone’s secure storage.
What we don’t collect
We don’t access your contacts, photos, files, microphone or camera, and we don’t collect your advertising ID or your browsing history.
3. Why we use your data
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Create your account, sign you in, sync your saves | Account information, what you save | Performing our contract with you |
| Find the places in videos you share | The links you share and the public post content | Performing our contract with you, after you agree to the AI notice in the app |
| Notify you when a save is ready | Push token | Your consent (the notification permission) |
| Sell and verify Spotted Pro, count free saves | Purchase details, plan, save history | Performing our contract with you; keeping records the law requires |
| Fix crashes and bugs, keep the service secure, prevent abuse | Crash reports, rate-limit counters, server logs | Our legitimate interest in a working, secure app |
| Understand how the app is used and improve it | Usage events | Our legitimate interest in improving Spotted |
Under India’s DPDP Act, we process your personal data on the basis of the consent you give when you sign up and use these features, and for the legitimate uses the Act allows.
4. How places are found
Before your first save, the app tells you which AI services will see your videos and asks you to agree. Nothing is sent to them until you tap Agree and continue.
When you share a video, we read its public information to find the places in it: the title, caption, hashtags, location tag, up to 25 top comments, and the video itself (what’s said, text shown on screen, and what’s shown). We ask Instagram, YouTube or TikTok for the post’s public preview (title, creator and thumbnail), and use our own server and the services below, acting on our behalf:
| Service | What it does | What it receives |
|---|---|---|
| Our scraper (self-hosted on our own server) | Fetches the public post details and video for Instagram and TikTok links | The link you shared. It keeps the public video file for up to about 15 minutes while it’s read, then deletes it |
| Residential proxy provider (only if needed) | Relays our scraper’s request when a direct request is blocked | The link you shared (as the address being fetched) |
| Apify | Fallback only: fetches the public post details when our scraper can’t | The link you shared |
| Google YouTube Data API | For YouTube Shorts: gets the video’s length and top comments | The YouTube video ID |
| Google Gemini API | Watches the video: transcribes what’s said, reads on-screen text, notes what’s shown | The public video file (or the YouTube link). Files we upload to Gemini are deleted as soon as the video has been read |
| Anthropic API (Claude) | Picks out the specific places, writes the title and summary | The link, the post’s public title, caption, hashtags, location tag, creator handle and top comments, plus what Gemini found |
| Google Places API | Adds addresses, area, ratings and photos | The names, cities and countries of the places found |
These services receive the shared post’s public content, not your name, email address or location. The transcript, on-screen text and comments are used only to find the places; we don’t store them. We keep the link, the thumbnail, the caption and the places we found, not the video. A video with no places isn’t kept in your account, and one that can’t be read is removed automatically about 30 seconds later unless you tap Try again.
AI results can be wrong. See our Terms of Use.
5. Who we share data with
We don’t sell or rent your personal data, and we don’t share it with advertisers or data brokers. We disclose it only to the service providers that run Spotted for us, under contracts that let them use it only to provide their service to us:
| Provider | Purpose | What it receives |
|---|---|---|
| Convex | Our backend and database (hosted on Amazon Web Services in Sydney, Australia) | Everything in section 2 that we store: account information, saves, vaults, plan, save history, push tokens |
| Google (Sign-In) and Apple (Sign in with Apple) | Signing you in | Your sign-in request; they send us the account details listed in section 2 |
| Our scraper host, proxy provider, Apify, Google (YouTube Data API, Gemini API, Places API) and Anthropic | Finding the places in a video | As listed in section 4 |
| Google (place photos) | Serves the place photos the app shows, each credited to the person who took it | Your phone loads the images directly from Google, so Google receives your device’s IP address, as with any image on the web |
| Google Maps (Android) and Apple Maps (iOS) | Draws the map | The map component collects technical data such as your IP address and device information, as described by Google and Apple. Your location is shown on the map on your device only |
| Expo push service, Firebase Cloud Messaging (Android), Apple Push Notification service (iOS) | Delivering notifications | Your device’s push token and the notification text (for example “📍 3 places saved” and the place names) |
| RevenueCat, Apple (App Store), Google (Google Play) | Selling Spotted Pro and checking purchases | Your Spotted account ID and purchase details (section 2) |
| Sentry | Crash and error reporting for the app and backend | Crash reports with device model, OS, app version and your pseudonymous account ID |
| PostHog | Product analytics | Usage events with your pseudonymous account ID and basic device information |
We may also disclose data if the law requires it (for example, a valid court order), to protect the rights and safety of our users or others, or to a buyer or successor if Spotted is sold or transferred, in which case this policy will continue to apply to your data and we’ll tell you in advance.
6. International transfers
Our providers process data in several countries, including Australia (our database), the United States and the European Union, which may be outside the country you live in. Where the law requires it, we rely on safeguards such as the European Commission’s Standard Contractual Clauses in our providers’ terms. All data is sent over encrypted connections (HTTPS).
7. How long we keep data
- Account, saves, places, vaults, plan and save history: for as long as you have an account. When you delete a reel or a place, it’s removed straight away. Everything is deleted when you delete your account (section 9).
- Video files: never stored with your saves. Our scraper deletes its temporary copy within about 15 minutes, and files uploaded to Gemini are deleted as soon as the video has been read.
- Reels that fail: removed automatically about 30 seconds after they fail, unless you try again. Reels with no places aren’t saved.
- Push tokens: until you sign out on that device, the device stops accepting notifications, or you delete your account.
- Crash reports (Sentry): up to 90 days.
- Usage events (PostHog): up to 12 months.
- Server logs and rate-limit counters: a short time (rate-limit counters within a day, logs within a few weeks), for debugging and preventing abuse.
- Backups: deleted data can remain in our database provider’s backups for up to 30 days before they’re overwritten.
- Purchase records: Apple, Google and RevenueCat keep them as their own policies and tax and accounting laws require.
8. Security
Data is encrypted in transit (HTTPS). Your sign-in token is kept in your phone’s secure storage, and only your own account can read your saves. Access to our systems is limited to what we need to run Spotted. No system is perfectly secure, but if a breach affects your personal data we’ll notify you and the authorities as the law requires.
9. Your choices and rights
- Delete reels and places at any time in the app.
- Turn off notifications or location access in your phone’s settings. The app still works without them.
- Delete your account in the app: Settings → Delete account. This permanently deletes your account, saved reels, places, vaults, thumbnails, push notification tokens, your plan and save history, and revokes Sign in with Apple. If you can’t use the app, follow the steps on our account deletion page. Deleting your account doesn’t cancel a Spotted Pro subscription; cancel it in your App Store or Google Play settings.
- Access, correct, or get a copy of your personal data, object to or restrict how we use it (for example, crash reports or usage analytics), or withdraw your consent at any time. Withdrawing consent doesn’t affect processing that already happened.
- Nominate someone to exercise your rights if you die or become unable to (India’s DPDP Act).
To make any request, email hello@adevtutorials.in from the address you signed in with. We may ask you to confirm it’s your account. We’ll reply within 30 days. These rights apply under the EU and UK GDPR, India’s DPDP Act and similar laws; wherever you live, we’ll handle reasonable requests in the same way.
Grievances and complaints
If you have a concern about how we handle your data, contact our grievance officer, Abbas Anandwala, at hello@adevtutorials.in. We’ll acknowledge it within 7 days and aim to resolve it within 30 days. If you’re not satisfied, you can complain to your data protection authority: in India, the Data Protection Board of India; in the EU or UK, your local supervisory authority.
10. Children
Spotted is intended for people aged 18 and over. It is not directed at children, and we don’t knowingly collect personal data from anyone under 18. One reason is that the AI services we use don’t allow use in services directed at people under 18. If you believe someone under 18 has given us personal data, contact us and we’ll delete it.
11. Changes to this policy
If we change this policy, we’ll update the effective date at the top. For significant changes, we’ll also let you know in the app before they take effect.
12. Contact
Abbas Anandwala, developer of Spotted
Email: hello@adevtutorials.in