Privacy
Privacy Policy
Last updated 6 November 2026. Applies to Spotto for Android
(nz.co.spottoapp) and to Spotto in a web browser
(app.spotto.kiwi).
The short version. On Android, Spotto works entirely on your phone unless you choose to make an account. In a web browser it needs a free account (section 2). There is no analytics SDK, no advertising SDK and no third-party tracker in the Android app. In a web browser, Spotto counts visits and how many times its main features were used each day, as totals that are not tied to you (section 2). Nothing about you is sold, rented or shared for advertising, ever.
Where you spotted a car never leaves your phone. When you share a spot, the exact location, the place name and the time of day are not sent — only the calendar date and, if you have set one, your region. You choose who sees each spot: your friends, or everyone on Spotto. Your region is shown to your friends only; someone who is not your friend sees the car and the date, never the region. The only way anyone else learns it is if you switch on Show my name on my region’s board, which is off unless you turn it on. The one exception is a cloud backup, which is off unless you turn it on, and is described in full below.
Number plates are in the photographs, and that is fine. You do not have to blur anything. Coarse location is what protects people here, not editing your pictures — section 3 explains the reasoning.
1. Who is responsible for your information
Spotto is operated by the developer of the app, in New Zealand. For any privacy question, request or complaint, contact:
- privacy@spotto.kiwi
We are an agency under the Privacy Act 2020 and this policy is written against the Information Privacy Principles in that Act.
2. Using Spotto without an account
You can install Spotto and use most of it without giving us anything at all. The vehicle catalogue, your sightings, your photos, your collection progress, the Assembly Line and every rarity figure are held in a database on your own device. In that mode we hold no personal information about you whatsoever, because none of it is ever sent anywhere.
Without an account, the registration counts behind every rarity figure change only when the app is updated. With one, see section 3.
The daily quiz
The day's cars come from our servers, and each guess you make is added to an anonymous tally so the app can tell you how close you came compared with everyone else. A tally records the day, the car, the range your guess falls in and how many guesses landed there, and nothing else: no account, no device, no time of day. It is the same with or without an account.
Invite links
If you install Spotto from somebody’s invite link, Google Play hands their spotter name to the app the first time it opens. The app keeps it on your phone, and uses it only if you make an account: then it opens that spotter’s profile, so you can add them as a friend. Without an account it is never sent anywhere, and it is forgotten after 14 days.
Spotto in a web browser
Spotto also runs in a web browser at app.spotto.kiwi, and there
it needs a free account: the vehicle catalogue is only sent to signed-in
accounts. Signing in works as in section 3 — a six-digit code sent to your
email address, and a password afterwards if you choose to set one.
Everything else is as on a phone. Your sightings, photos and collection are kept in your browser's own storage, on your computer or phone, and are not sent to us unless you share a spot. Clearing your browser's data for the site deletes them, and Safari on an iPhone or iPad deletes a site's data if it is not opened for seven days, unless Spotto is on your Home Screen. Use Settings › Export to keep a copy.
In a web browser, Spotto counts how it is used, as daily totals. Each total is a day, an action and a number: how many browsers opened Spotto, joined, logged a spot, shared a count card, played the quiz, opened each tab or used search, and how many opened each car's page. No account, no device and no time of day is attached, so a total cannot be traced to you. Logging a spot adds one to that day's total and sends nothing about the car, the place or the time. A car looked up fewer than five times is never reported. The Android app counts none of this.
3. What we collect if you make an account
An account exists to let you share spots — with your friends, or with everyone on Spotto — like and comment on spots, send messages and appear on the leaderboard. This is the complete list of what is held on our servers.
| Information | Why we hold it |
|---|---|
| Your email address | Signing in, and keeping one account to one person |
| Your spotter name (it does not have to be your real name). It is unique, and anyone signed in to Spotto can search for it: typing part of it brings up your name, your profile picture and your badges, and lets them send you a friend request. It does not show them your region or your spots. You can switch on Hide me from search in your account; then only your friends find you that way, and anyone else has to type your whole name | Shown to friends and on the leaderboard, and how people find and add you |
| Your profile picture, if you add one. It is cut to a square and resized on your phone, and its location and camera details are removed before it is sent | Shown to everyone signed in to Spotto, next to your name |
| Your region, if you set one — one of sixteen New Zealand regions | Shown to your friends, and used for regional rarity and your region’s monthly board. On that board, people who are not your friends see you as “A spotter”, with no name or picture, unless you switch on Show my name on my region’s board |
| Your spotter badges | Shown on your profile |
| Your friends, friend requests and blocks | Deciding who can see what |
Your invite link, spotto.kiwi/ followed by your spotter
name. Anyone who opens it sees that name and a way to get Spotto, and
nothing else about you. The page does not check whether the name
belongs to anyone |
Giving your mates a way to find and add you |
| Whose invite link you joined through, if you opened one while your account was new (its first 14 days). It is recorded once and does not change. The spotter who invited you sees your spotter name in their list of mates who joined through their link; nobody else sees it | Showing people who joined through their link, and checking entries if we run a competition that counts invites |
| Spots you choose to publish: the vehicle, its rarity grade, your region, the calendar date, your note, and whether you shared it with friends or with everyone | The feed. A spot shared with friends is shown to your friends; a spot shared with everyone is shown to every Spotto account. The region is shown to your friends only, whichever you chose |
| Likes you give, and comments you write on a spot | Shown to everyone who can see that spot. A like count is a number on the spot and nothing else — it feeds no score, badge or board |
| Direct messages you send | Delivering them |
| Photos and GIFs you send in a direct message | Delivering them to the person you are writing to. Only the two of you can see them. Before one is sent the app strips its location data and other hidden details, and offers to black out a plate; your own copy is not changed |
| Photos you choose to attach to a shared spot | Shown to everyone who can see that spot. Before a photo is shared the app strips its location data and lets you black out anything you want hidden; your own copy is not changed |
| Whether your account is suspended, and the reason | Enforcing the Terms of Service. Shown only to you |
| Your leaderboard figures: totals worked out on your phone, such as points and how many cars, including each month’s totals for the friends and regional boards. Never which cars, where or when | The leaderboards: the all-time board, and the monthly boards for your friends and your region |
| Whether you have switched on Show my name on my region’s board | Deciding whether people in your region who are not your friends see your name on its monthly board |
| Whether you have switched on Hide me from search | Deciding whether people who are not your friends can find you by typing part of your spotter name. Off unless you turn it on. On, they have to type the whole name, and people you have blocked cannot find you either way |
| Reports you make, and reports made about you | Moderation and safety. See section 8 |
| A notification token for your device, if you allow notifications | Telling your phone a message has arrived, that someone liked a spot you shared, or that a friend shared a rare spot |
| Which of those notifications you have switched off, and a note of when a like or rare-spot notification was sent to you and whose it was about | Sending only the notifications you want, and no more than a few a day. Only you can see your switches. Notes older than two days are deleted as new notifications are sent |
| Feedback you send from the app: what you wrote, the car it is about if you sent it from a car's page, the app version, and your account if you are signed in | Reading it and fixing what you tell us about. You can send it without an account, and then nothing says who sent it |
| A cloud backup, only if you turn one on | Restoring your collection on a new phone. See section 5 |
Updated registration counts. Once a day, a signed-in Spotto downloads the latest registration counts from our servers, using the session it already has, so rarity figures stay current between app updates. The request carries nothing your other signed-in requests do not, and the counts are never published at a public address.
What we never collect
These are not omissions of good manners. There are no database columns for them, and the code that prepares a spot for publishing lists every field it is allowed to send:
- Coordinates and place names. Where you saw a vehicle is recorded on your phone and stays there.
- Times of day. A published spot carries a date, never a timestamp — so it cannot be used to work out your movements.
- Number plates as data. There is no plate field anywhere in Spotto. A plate is never typed in, never stored, never searchable, never part of an export and never sent to us. See the next section for what this does and does not mean about photographs.
- Your contacts, your calendar, your other apps, your advertising ID. Spotto does not ask for any of these.
Photographs and number plates
Spotto is an app for photographing cars, and a photograph of a car usually has its number plate in it. We are not going to pretend otherwise, and we are not going to ask you to edit every picture you take. If you share a photo, the plate in it is shared too.
What actually protects people is that a plate on its own does not tell anyone much. To follow a particular car you need to know where it was and when. Spotto publishes a region and a calendar date — never coordinates, never a place name, never a time of day, and there are no database columns for any of those. So a shared photo says roughly "this car was somewhere in Canterbury on this date", which is about what a stranger learns by standing on a footpath. That is the trade we have made deliberately: keep the location coarse, and let the car be a car.
Two things follow from it, and they are rules in the Terms of Service rather than suggestions:
- Do not use Spotto to follow, track or build a record of a particular vehicle or person, and do not post a plate alongside anything naming its owner, their address or their movements. That is what turns a picture of a car into surveillance of a person.
- Do not post recognisable photographs of people, or anyone's home, driveway or address.
If a photograph of your vehicle is on Spotto and you want it gone, email us and we will remove it. You do not have to have an account, and you do not have to explain why.
4. What we do not do
- We do not sell or rent your information to anyone, for any purpose.
- We do not use it for advertising, profiling or ad targeting, and there is no advertising SDK in the app.
- There is no analytics SDK. We do not track how you use the Android app at all. In a web browser we count totals only (section 2), never what any one person did.
- We do not disclose your information to anyone except the service providers in section 6, or where the law requires it.
5. Cloud backup — opt in, and be clear about what it holds
Backup is off unless you switch it on. If you do switch it on, the backup is a complete copy of your collection, and that includes the exact coordinates of every sighting — because a backup that leaves fields out is not a backup.
The file is stored on our servers and only your account can read it. We hold the keys, so this is not end-to-end encrypted and we will never describe it as such. If that is not a trade you want to make, leave the switch off; everything else in the app works exactly the same.
6. Where your information is held, and who else touches it
- Supabase hosts the database, sign-in and file storage.
Your data is stored in the Sydney region (
ap-southeast-2). Supabase Inc. is a United States company, so your information is held outside New Zealand and is handled under a contract that requires comparable safeguards, as Information Privacy Principle 12 requires. - Google delivers notifications through Firebase Cloud Messaging, and provides Google Sign-In if you choose it. A notification tells your phone that a message arrived and who from — never the contents of the message. In the Android app a notification can also tell you that someone liked a spot you shared, or that a friend shared a spot graded Rare or better. It carries their spotter name and nothing about the spot: not the car, the grade, the place or the photo. Each of those two has its own switch on your Account screen.
- Resend delivers the email that tells the moderator a report has been filed. That email contains no user content. It also delivers the feedback you send from the app to us, and that email does contain what you wrote, with your spotter name if you are signed in.
- Cloudflare hosts this website and Spotto in a web
browser (
app.spotto.kiwi). Like any website host, it sees the internet address a request comes from; it is sent nothing else about you. On this website's home, press and “Built here” pages (never this policy or the terms), and on Spotto in a web browser, Cloudflare Web Analytics counts visits: which page, the site that linked to it, and the browser and country. It uses no cookies, does not identify you or follow you to other sites, and is not in the Android app. - Google Fonts, in a web browser only: if a comment or message contains a character Spotto's own font does not have — an emoji, say — your browser fetches that character's font from Google. The request carries nothing about you beyond what any web request does.
These are the only third parties involved. There are no others.
If you add a GIF to a message from your phone's keyboard, the GIF comes from your keyboard app (for example Gboard or Samsung Keyboard) under that app's own privacy policy. Spotto does not use a GIF search service and sends nothing to one.
7. How long we keep it, and deleting your account
You can delete your account from the Account screen in the app. Doing so removes your profile, your published spots, your messages (including any photos and GIFs you sent), your leaderboard row and your backup.
You don't need the app to do it. Email privacy@spotto.kiwi from the email address on your account (the one you sign in with, or your Google account's address) and ask for your account to be deleted. We delete the same things as the Account screen does, within 20 working days, and reply to tell you it is done. We only act on a request from the account's own address, so that nobody else can delete your account.
Some things deletion cannot reach, and we would rather say so than imply otherwise:
- Messages already delivered to another person's phone are on that phone. We cannot reach into it.
- Feedback you sent from the app while signed in is deleted from our records with your account. The email it reached us as stays in our inbox, like any email you send us.
- Copies cached on other people's devices are cleared on a timer rather than instantly, so this becomes true with time.
- Where you appeared in a conversation, you are shown as "Deleted account" rather than vanishing, so the conversation still makes sense to the other person.
- Reports made about you are kept, including which account they concerned. A safety record that a user can erase by deleting and remaking an account is not a safety record. We keep these for two years.
Everything held only on your phone is deleted when you uninstall the app or clear its data.
8. Moderation, reporting and safety
You can report a spot, a comment, a message or a person from inside the app, and you can block someone. A report reaches a human by email, and we aim to act within 24 hours. Content reported by several different people is hidden automatically while it is reviewed.
We may suspend an account that breaks the Terms of Service. A suspended account can still read but cannot post, like, comment or message, and what it has posted is hidden from other people while the suspension stands. Nothing is deleted by a suspension, and we will tell you why unless telling you would put someone at risk. Spotter names that impersonate the app or an authority, or that contain abusive terms, are refused when chosen.
Under the Harmful Digital Communications Act 2015 we pass a complaint to the author of the content within 48 hours and, if there is no response, remove the content within a further 48 hours.
9. Your rights under the Privacy Act 2020
- Access. You may ask for a copy of the personal information we hold about you. We will respond within 20 working days.
- Correction. You may ask us to correct anything that is wrong, and you can change your spotter name, profile picture and region yourself in the app.
- Deletion. Use the Account screen, or email us from your account's address (section 7).
- Complaints. Contact us first. If you are not satisfied, you may complain to the Office of the Privacy Commissioner — privacy.org.nz, 0800 803 909.
If there is ever a privacy breach likely to cause serious harm, we will notify the Privacy Commissioner and the people affected as soon as practicable, as the Act requires.
10. Children and young people
Interest in cars starts young, and we assume some people using Spotto are under eighteen. An account is not required to use the app, and we encourage younger users to spot without one. If you are under sixteen, please get a parent's or guardian's agreement before making an account. If you believe a child's information has been collected and should not have been, email us and we will delete it.
11. Security
Every table is protected by row-level security, which means the database itself refuses to return another person's rows rather than relying on the app to hide them. Traffic is encrypted in transit. No system is perfect, and we will tell you plainly if something goes wrong.
12. Changes to this policy
If we change what we collect or who we share it with, we will update this page, change the date at the top, and tell you in the app before the change takes effect. Previous versions are in the app's public source history.