Privacy Policy

Account information. When you sign up, we collect an email address and password, or — if you sign in with Google or Microsoft — the name, email, and profile photo that provider shares with us. You can also set a username, display name, and avatar.

Location data. Checking in at a business or point of interest requires your device's GPS location at that moment, so we can confirm you're physically there. We don't track your location continuously or in the background — only at the moment you initiate a check-in.

Usage data. We use Google Analytics (GA4) on both our marketing site and the app to understand aggregate traffic and feature usage — pageviews and, in the app, key actions like check-ins, favorites, and coupon redemptions. This is separate from and doesn't include your precise check-in GPS coordinates.

Content you provide. Anything you add directly — profile details, business coupons/events (if you manage a claimed business), coupon claims and redemptions, connections with other users, and any bug report or feature request you submit through the app (tied to your account so we can follow up if needed).

Push notification subscriptions. If you enable notifications, your browser generates a push subscription (an endpoint URL and encryption keys) for your device, which we store so we can send you notifications. Disabling notifications or clearing your browsing data removes it.

Error diagnostics. If the app or website encounters an unexpected error, we log a technical description of it — the error message, a stack trace, and the page URL where it happened — so we can find and fix it. This diagnostic log isn't linked to your account.

• To operate core features: check-ins, favorites, event follows, badges, challenges, and leaderboards;
• To personalize your experience, like showing nearby businesses and neighborhoods;
• To verify business claims and check-in authenticity;
• To understand aggregate usage so we can improve the Service; and
• To communicate with you about your account or the Service.

We don't sell your personal information. We share data with service providers who help us run Spored, under obligations to protect it — including Supabase (authentication and database hosting), Google (sign-in, Analytics, and delivering push notifications to Chrome/Android devices via Firebase Cloud Messaging), Microsoft (sign-in), Apple (delivering push notifications to Safari/iOS devices), and Netlify (hosting). These push delivery services see the encrypted notification envelope and your device's push endpoint, not your account details. Other users can see information tied to your profile according to your visibility setting (public or private) — for example, a public profile's badges, check-in count, and neighbor count are visible to others; private profiles are not. New accounts default to public; you can switch to private at any time from Account settings.

If your profile is public and you're among the 3 most frequent recent visitors (within a rolling 60-day window) to a business, point of interest, or neighborhood, your username and visit count are shown to other users on that place's "Top Caps" badges. A business or point of interest page's Leaderboard tab shows this same ranking further down the list (up to 10 visitors). Private profiles are never named this way.

We use cookies/local storage to keep you signed in, remember preferences (like light/dark theme), and via Google Analytics, to distinguish visitors for aggregate usage reporting. You can control cookies through your browser settings, though some features may not work correctly without them.

We keep your account information for as long as your account is active. If you delete your account, we delete or anonymize your personal information, except where we need to retain it to comply with law or resolve disputes.

• Edit your profile information or change your visibility setting at any time from Account settings;
• Delete your account, which removes your personal information as described above;
• Disable push notifications at any time from Account settings, which removes your subscription; and
• Decline location permission, though this means you won't be able to check in.

Spored isn't directed at children under 13, and we don't knowingly collect personal information from them. If you believe a child has provided us with personal information, contact us and we'll remove it.

We use reasonable technical and organizational measures to protect your information. No method of transmission or storage is completely secure, so we can't guarantee absolute security.

We may update this Privacy Policy from time to time. If we make material changes, we'll update the date at the top of this page.

Questions about this policy? Reach us at hello@tryspored.com.