Get the app
Back to SpotCars

SpotCars Privacy Policy

Last updated: October 28, 2026

SpotCars is a car-spotting card game. You photograph cars, our service names the car, and you collect it as a card. This policy explains what we collect, why, who helps us run the service, and the choices you have. It applies to the SpotCars iOS app and to spotcars.app.

1. Who we are

SpotCars.app is the controller of your personal data. Contact: contact@spotcars.app.

2. What we collect

  • Account: when you sign in with Apple or Google we receive an account ID and, if you share them, your name and email address (Apple may give us a private relay email). You can also play as a guest: we then create an anonymous account ID with no name or email.
  • Profile: your username, display name, profile picture if you add one, the country shown on your profile, and the cards you choose to showcase.
  • Photos you scan: when you scan a car, the app sends a reduced copy of the photo (about 768 px) to our servers to identify the car. When the card is added to your Garage we store a card image, a thumbnail, a cut-out mask and a private copy of your full photo (only you can see it, so you can re-crop your card on any device).
  • Spot location: if you allow location access, the app records the precise location and time of each shot. We use it to verify the spot, to place it on your own map and to show the country on your card. Your exact location is private: other players only ever see the country, never the city or a pin. You can turn location off at any time in iOS Settings; your shots then count as unverified.
  • Game activity: cards, XP, ranks, missions, streaks, sets, favourites, Dream Garage, likes, friends and friend requests, posts on Discover, reports and blocks you make, and messages we send you in the app.
  • Purchases: if you subscribe to Premium, Apple handles the payment. We and RevenueCat receive the subscription status and transaction details (product, dates, renewal state), never your card or bank details.
  • Notifications: if you allow notifications, we store a push token to send them.
  • Device and security data: device model, iOS and app version, an app instance ID, Apple App Attest / DeviceCheck results and scan rate data, used to stop cheating, bots and abuse.
  • Crash and error reports: when the app crashes we receive the error message, app version and device model to fix the problem.

We do not collect your contacts, your photo library (only the photos you pick or take), health data or the content of other apps.

3. Why we use it (and our legal bases)

  • To run the game and your account: sign-in, saving your Garage on our servers, identifying cars, cards, XP, leaderboards, friends and Discover (performance of our contract with you).
  • To keep SpotCars fair and safe: verifying spots, detecting cheating (for example photos of screens), preventing bots and fraud, handling reports, moderating content and enforcing our Terms (our legitimate interests, and our legal obligations).
  • To sell and manage Premium (contract).
  • To send notifications you allowed and in-app messages about your account (consent for push notifications, contract or legitimate interests for service messages).
  • To fix bugs and improve the app, using crash reports and aggregate usage (legitimate interests).
  • Location and push notifications are used only with your permission, which you can withdraw at any time in iOS Settings (consent).

4. What other players see

Other players can see your username, display name, profile picture, country, rank, XP, Garage value and the cards and photos you post to Discover or show on your profile, and your likes on public content. Public card images have their photo metadata (EXIF, including GPS) removed. Your exact spot locations, email address and purchase details are never shown to other players. When you share a card outside the app, you decide where it goes.

5. Who helps us (service providers)

We share data only with providers that process it for us under contract:

  • Supabase (database, sign-in and file storage; servers in the EU, Ireland).
  • AI service providers (they run our AI system, which reads the scan photo to identify the car).
  • Google (Google Sign-In, if you use it).
  • Apple (Sign in with Apple, App Store payments, push notifications, App Attest / DeviceCheck, and Apple Maps for the map).
  • RevenueCat (subscription management).
  • Expo (delivery of push notifications).
  • Google AdMob (ads for free players).

We may also share data if the law requires it, to protect the safety of players or the public, or as part of a merger or sale of the business (you will be told first).

Ads: free players see ads from Google AdMob (Premium players see none). If you allow tracking in the iOS prompt, Google may use your device's advertising identifier to show ads that match your interests; if you do not, you only see non-personalised ads. In the EEA, UK and Switzerland, Google asks for your consent first. You can change this at any time in iOS Settings > Privacy & Security > Tracking. We do not sell your personal data, and apart from these ads we do not track you across other companies' apps and websites.

6. International transfers

Our main servers are in the EU. Some providers (for example Google, Apple, RevenueCat and Expo) may process data in the United States or other countries. Where data leaves the EEA, UK or Switzerland, we rely on adequacy decisions (including the EU-US Data Privacy Framework where the provider is certified) or the European Commission's Standard Contractual Clauses.

7. How long we keep it

  • Your account, cards and photos: as long as your account exists. When you delete a card, the card and all its photos are permanently deleted from SpotCars.
  • Scan photos sent for identification: kept with the scan record to review wrong identifications and reports, and deleted with your account.
  • Spot locations: kept with the card; deleted with the card or your account.
  • When you delete your account (Settings > Delete account), your account and everything in it, including all your cards, photos, posts and game progress, are permanently deleted from SpotCars.
  • Reports and moderation decisions: as long as needed to protect players and to defend legal claims.
  • Purchase records: as long as required by tax and accounting law.
  • Crash reports: as long as needed to fix the problem, at most 12 months.

8. Your rights and choices

  • Delete your account and data at any time in the app: Settings > Delete account. Signing in with Apple, we also revoke the app's access to your Apple ID.
  • Access, correct, export or delete your data, or object to or restrict some uses, by writing to contact@spotcars.app. We answer within 30 days (45 days where US state law allows).
  • Withdraw consent for location or notifications in iOS Settings at any time.
  • In the EEA and UK you can complain to your local data protection authority.
  • In the USA (including California, Colorado, Connecticut, Virginia and other states with privacy laws) you have the right to know, access, correct and delete your personal information and to opt out of sale, sharing and targeted advertising. We do not sell or share personal information or use it for targeted advertising. We will not treat you differently for using your rights. You can use an authorised agent; we may need to verify your identity.

9. Children

SpotCars is not for children under 13, and we do not knowingly collect data from them. In the EEA and UK you must be at least 16, or have permission from a parent or guardian. If you believe a child has given us data, contact contact@spotcars.app and we will delete it.

10. Security

Data is encrypted in transit, access to it is limited to people who need it, and our admin tools require two-factor sign-in. No service can be completely secure, so please keep your Apple or Google account safe.

11. Changes

We may update this policy. If the changes are important we will tell you in the app before they take effect. The date at the top shows the latest version. For example, before any future community map shows spots from other players, we will update this policy; it would only ever show blurred, delayed areas, never your exact location.

12. Contact

Email: contact@spotcars.app.