Privacy Policy
Last updated 7 September 2026. Applies to Spotto for Android
(nz.co.spottoapp).
The short version. Spotto works entirely on your phone unless you choose to make an account. There is no analytics SDK, no advertising SDK and no third-party tracker in the app. Nothing about you is sold, rented or shared for advertising, ever.
Where you spotted a car never leaves your phone. When you share a spot with friends, the exact location, the place name and the time of day are not sent — only the calendar date and, if you have set one, your region. The one exception is a cloud backup, which is off unless you turn it on, and is described in full below.
Number plates are in the photographs, and that is fine. You do not have to blur anything. Coarse location is what protects people here, not editing your pictures — section 3 explains the reasoning.
1. Who is responsible for your information
Spotto is operated by the developer of the app, in New Zealand. For any privacy question, request or complaint, contact:
- privacy@spotto.kiwi
We are an agency under the Privacy Act 2020 and this policy is written against the Information Privacy Principles in that Act.
2. Using Spotto without an account
You can install Spotto and use most of it without giving us anything at all. The vehicle catalogue, your sightings, your photos, your collection progress, the Assembly Line and every rarity figure are held in a database on your own device. In that mode we hold no personal information about you whatsoever, because none of it is ever sent anywhere.
3. What we collect if you make an account
An account exists to let you share spots with friends, send messages and appear on the leaderboard. This is the complete list of what is held on our servers.
| Information | Why we hold it |
|---|---|
| Your email address | Signing in, and keeping one account to one person |
| Your handle (it does not have to be your real name) | Shown to friends and on the leaderboard |
| Your region, if you set one — one of sixteen New Zealand regions | Shown on the leaderboard and used for regional rarity |
| Your friend code | So someone can add you at a meet |
| Your spotter badges | Shown on your profile |
| Your friends, friend requests and blocks | Deciding who can see what |
| Spots you choose to publish: the vehicle, its rarity grade, your region, the calendar date, and your note | The friends feed |
| Direct messages you send | Delivering them |
| Photos you choose to attach to a shared spot | The friends feed |
| Your leaderboard figures | The leaderboard |
| Reports you make, and reports made about you | Moderation and safety. See section 8 |
| A notification token for your device, if you allow notifications | Telling your phone a message has arrived |
| A cloud backup, only if you turn one on | Restoring your collection on a new phone. See section 5 |
What we never collect
These are not omissions of good manners. There are no database columns for them, and the code that prepares a spot for publishing lists every field it is allowed to send:
- Coordinates and place names. Where you saw a vehicle is recorded on your phone and stays there.
- Times of day. A published spot carries a date, never a timestamp — so it cannot be used to work out your movements.
- Number plates as data. There is no plate field anywhere in Spotto. A plate is never typed in, never stored, never searchable, never part of an export and never sent to us. See the next section for what this does and does not mean about photographs.
- Your contacts, your calendar, your other apps, your advertising ID. Spotto does not ask for any of these.
Photographs and number plates
Spotto is an app for photographing cars, and a photograph of a car usually has its number plate in it. We are not going to pretend otherwise, and we are not going to ask you to edit every picture you take. If you share a photo, the plate in it is shared too.
What actually protects people is that a plate on its own does not tell anyone much. To follow a particular car you need to know where it was and when. Spotto publishes a region and a calendar date — never coordinates, never a place name, never a time of day, and there are no database columns for any of those. So a shared photo says roughly "this car was somewhere in Canterbury on this date", which is about what a stranger learns by standing on a footpath. That is the trade we have made deliberately: keep the location coarse, and let the car be a car.
Two things follow from it, and they are rules in the Terms of Service rather than suggestions:
- Do not use Spotto to follow, track or build a record of a particular vehicle or person, and do not post a plate alongside anything naming its owner, their address or their movements. That is what turns a picture of a car into surveillance of a person.
- Do not post recognisable photographs of people, or anyone's home, driveway or address.
If a photograph of your vehicle is on Spotto and you want it gone, email us and we will remove it. You do not have to have an account, and you do not have to explain why.
4. What we do not do
- We do not sell or rent your information to anyone, for any purpose.
- We do not use it for advertising, profiling or ad targeting, and there is no advertising SDK in the app.
- There is no analytics SDK. We do not track how you use the app.
- We do not disclose your information to anyone except the service providers in section 6, or where the law requires it.
5. Cloud backup — opt in, and be clear about what it holds
Backup is off unless you switch it on. If you do switch it on, the backup is a complete copy of your collection, and that includes the exact coordinates of every sighting — because a backup that leaves fields out is not a backup.
The file is stored on our servers and only your account can read it. We hold the keys, so this is not end-to-end encrypted and we will never describe it as such. If that is not a trade you want to make, leave the switch off; everything else in the app works exactly the same.
6. Where your information is held, and who else touches it
- Supabase hosts the database, sign-in and file storage.
Your data is stored in the Sydney region (
ap-southeast-2). Supabase Inc. is a United States company, so your information is held outside New Zealand and is handled under a contract that requires comparable safeguards, as Information Privacy Principle 12 requires. - Google delivers notifications through Firebase Cloud Messaging, and provides Google Sign-In if you choose it. A notification tells your phone that a message arrived and who from — never the contents of the message.
- Resend delivers the email that tells the moderator a report has been filed. That email contains no user content.
These are the only third parties involved. There are no others.
7. How long we keep it, and deleting your account
You can delete your account from the Account screen in the app. Doing so removes your profile, your published spots, your messages, your leaderboard row and your backup.
Some things deletion cannot reach, and we would rather say so than imply otherwise:
- Messages already delivered to another person's phone are on that phone. We cannot reach into it.
- Copies cached on other people's devices are cleared on a timer rather than instantly, so this becomes true with time.
- Where you appeared in a conversation, you are shown as "Deleted account" rather than vanishing, so the conversation still makes sense to the other person.
- Reports made about you are kept, including which account they concerned. A safety record that a user can erase by deleting and remaking an account is not a safety record. We keep these for two years.
Everything held only on your phone is deleted when you uninstall the app or clear its data.
8. Moderation, reporting and safety
You can report a post, a message or a person from inside the app, and you can block someone. A report reaches a human by email, and we aim to act within 24 hours.
Under the Harmful Digital Communications Act 2015 we pass a complaint to the author of the content within 48 hours and, if there is no response, remove the content within a further 48 hours.
9. Your rights under the Privacy Act 2020
- Access. You may ask for a copy of the personal information we hold about you. We will respond within 20 working days.
- Correction. You may ask us to correct anything that is wrong, and you can change your handle and region yourself in the app.
- Deletion. Use the Account screen, or email us.
- Complaints. Contact us first. If you are not satisfied, you may complain to the Office of the Privacy Commissioner — privacy.org.nz, 0800 803 909.
If there is ever a privacy breach likely to cause serious harm, we will notify the Privacy Commissioner and the people affected as soon as practicable, as the Act requires.
10. Children and young people
Interest in cars starts young, and we assume some people using Spotto are under eighteen. An account is not required to use the app, and we encourage younger users to spot without one. If you are under sixteen, please get a parent's or guardian's agreement before making an account. If you believe a child's information has been collected and should not have been, email us and we will delete it.
11. Security
Every table is protected by row-level security, which means the database itself refuses to return another person's rows rather than relying on the app to hide them. Traffic is encrypted in transit. No system is perfect, and we will tell you plainly if something goes wrong.
12. Changes to this policy
If we change what we collect or who we share it with, we will update this page, change the date at the top, and tell you in the app before the change takes effect. Previous versions are in the app's public source history.