Effective date: 29 September 2026
Last updated: 21 October 2026
This Privacy Policy applies to the SpottyAndJoy mobile application (the "Application"), operated by Vincenzo Pio Tarricone (the "Service Provider", "we", "us", or "our"). For the processing described in this notice for which we determine the purposes and means, the Service Provider is the data controller. Contact: spottyandjoy@gmail.com.
SpottyAndJoy is a freemium mobile application designed to help users interact with their city through community-based and location-based features, including but not limited to reports, map content, groups, public discussions, and other social or local discovery features.
This Privacy Policy explains how we collect, use, store, share, and protect information when you use the Application.
By downloading, accessing, or using the Application, you acknowledge that you have read and understood this Privacy Policy.
This Privacy Policy applies to information collected through the Application, including when you:
create an account;
browse or use map, report, group, discussion, or community features;
submit content, messages, reports, or other materials;
interact with other users or public areas of the Application;
contact us for support or account deletion.
This Privacy Policy does not apply to third-party websites, services, venues, advertisers, or external platforms that may be linked from or referenced in the Application, except to the extent required by applicable law.
We may collect the following categories of information.
When you use the Application, you may provide information directly to us, including:
account information, such as email address, username, user ID, and other registration details;
profile information, if you choose to add it, such as a profile photo, biography, and optional gender selection;
content you create or submit, including reports, messages, posts, comments, group-related content, community discussion content, event-related or PR-related content, and other user-generated content;
support communications, such as emails or requests you send to us;
reporting and moderation information, if you submit a report about another user, content, or safety issue.
Depending on the feature, you may also voluntarily provide:
photos or media uploaded through the Application;
content associated with map reports, groups, or public discussions;
information you choose to include in your public or semi-public profile.
Professional PR profiles may also contain a professional name, venues, city, phone number, and social-media contact information that you choose to provide. Purchase-related information includes subscription status, product or entitlement identifiers, transaction or purchase identifiers, and information needed to verify or restore access. Payments are handled through the relevant app store and subscription services; you should not send payment-card details through chats or support messages.
An email address and the registration information requested by the app are necessary to create and maintain an account. Without them, account-based features cannot be provided. Profile photos, biographies, gender selection, and optional professional contact information are not required to create a basic account. Location, camera, photo-library, and notification permissions can be managed through your device settings; refusing a permission can limit the feature that needs it but does not itself require you to provide unrelated optional information. Content and messages are provided when you choose to use the corresponding features.
The app records in-app relationships and interactions, such as group or event participation, connections, blocks, reports, reactions, and recognitions, where those features are used. This does not mean that the app imports your phone address book. Place-search text is processed when you search for a location.
When you use the Application and its backend, network requests involve your Internet Protocol (IP) address and technical request information. Operational logs may contain request methods, paths, status codes, timestamps, and error information. Content and account-related actions may be stored with creation or update timestamps. Technical information you provide in a support request may also be used to investigate an issue.
Notification and platform services may process installation or device identifiers and technical information necessary for their operation. Where push notifications are enabled, the app processes a push notification token and the information required to deliver the notification. These service identifiers are not the same as an advertising identifier.
The app derives a student-status indicator and, where a recognised domain is found, a university association from the domain of your registration email. This is an inference from the email address, not an independent verification of your current enrolment. Contact us if this information is inaccurate.
We use these data to provide the requested features, maintain accounts and service integrity, respond to support requests, and investigate technical problems or abuse.
SpottyAndJoy includes map-based and city-based features. When you use a feature requiring your current location and grant foreground location permission, the Application can access approximate or precise location as allowed by your device. The app does not request background location access.
Location is used to show your position, provide nearby or city-relevant content, calculate routes you request, and associate a place with content you choose to submit. Coordinates used for route calculation, place searches, or place-name lookup may be sent to the providers described in Section 10. Coordinates submitted with reports or groups may be stored as part of that content.
If you create a group and choose your current location (the “Here” option) as the meeting point, those coordinates are published as the group's meeting point and are visible to other users through the relevant group or map features. They can therefore allow someone to reach the place where you were when you created the group. A meeting point is not a continuous live feed of your movements. A separately selected meeting place may differ from your actual location.
Likewise, the location attached to a public map report is visible with that report. Consider carefully which location you publish and do not publish another person's private location without authorisation.
Using your location privately to display a route or nearby content is distinct from publishing it in a group or report. Device permissions control access to the location capability; they do not, by themselves, establish the legal basis for every subsequent use of the data.
Depending on the feature you use, the Application may request access to your device camera, photo library, or media storage so that you can upload or create content, such as profile images, reports, or other user-generated content.
We only access such permissions to enable the features you choose to use.
SpottyAndJoy may allow users to create, submit, share, or interact with content such as:
reports and map-based submissions;
group-related content;
public or semi-public discussions;
messages or communication features;
comments, reactions, or community posts;
event-related, PR-related, or local venue-related content;
profile information or other content shared with the community.
All such content is referred to in this Privacy Policy as "User Content."
You are solely responsible for the User Content you create, upload, publish, or share through the Application.
Because SpottyAndJoy includes community and local interaction features, some User Content may be visible to other users depending on the design of the feature involved.
Users should not publish:
personal contact information of other people without permission;
exact addresses, identifying details, or other private information about third parties without authorization;
content intended to harass, shame, target, sexualize, expose, or endanger another person;
content involving minors;
unlawful, threatening, hateful, discriminatory, fraudulent, or sexually explicit content.
Public sharing of nudity is prohibited. Public sharing of realistic depictions of violence outside a news context is also prohibited. Any news-related content remains subject to applicable law and the other safety and content rules.
We reserve the right to review, moderate, restrict, remove, anonymize, or disable User Content where necessary for safety, legal compliance, abuse prevention, privacy protection, or platform integrity.
We may use the information we collect for the following purposes:
create and manage user accounts;
authenticate users and maintain sessions;
provide map, report, community, group, and location-based features;
display relevant local or personalized content;
process user requests and support inquiries;
maintain the normal operation of the Application.
Optional gender information is used to show the participant gender composition of PR events. Profile information may be visible to other users through the relevant profile and community features.
investigate operational errors and technical issues arising from service requests;
respond to user feedback and support reports;
use those findings to correct problems and improve feature functionality.
detect fraud, spam, abuse, manipulation, or suspicious behavior;
review safety-related reports and moderation issues;
investigate violations of our rules, policies, or legal obligations;
protect the safety of users, third parties, and the Service Provider;
preserve platform integrity and prevent misuse of rankings, reports, groups, or community systems.
send service-related communications;
notify you of important account, security, or policy updates;
respond to your support requests or deletion requests;
send notices required by law or reasonably necessary for operation of the Application.
Service notifications and communications are used for the corresponding account, chat, group, event, safety, or support feature. Optional device notifications can be managed through device settings.
For processing subject to the EU General Data Protection Regulation (GDPR), the legal basis depends on the purpose:
Performance of a contract (Article 6(1)(b)): creating and maintaining your account; authenticating you; providing the social, messaging, group, event, map, and route features you request; processing the content you choose to submit; and managing or verifying subscription access. This also covers support and service communications necessary to provide those features.
Legitimate interests (Article 6(1)(f)): maintaining service security and reliability, preventing fraud and abuse, investigating reports, moderating content, diagnosing operational errors, and establishing or defending legal claims. These interests must be balanced against your rights and freedoms; this basis is not an unrestricted permission to process data.
Legal obligations (Article 6(1)(c)): processing or preserving information when required by applicable law, including responding to valid legal requests and applicable child-safety reporting obligations.
Consent (Article 6(1)(a)), where required by applicable law for a particular optional processing activity: the purpose must be explained when consent is requested. Consent can be withdrawn without affecting the lawfulness of processing carried out before withdrawal.
Device permissions, acceptance of terms, and acknowledgement of this notice are not blanket consent to all processing. Refusing or withdrawing an optional permission may prevent the related device-dependent feature from working. Necessary account or legal-obligation processing does not automatically stop when an optional permission is withdrawn.
SpottyAndJoy includes reporting and moderation mechanisms intended to help maintain a safe and compliant community environment.
Users may report content, accounts, messages, reports, groups, PR-related content, or other activity that they believe:
violates this Privacy Policy, our Community Guidelines, or our Terms;
creates a safety risk;
is abusive, unlawful, misleading, or harmful;
involves minors or other serious concerns.
If we receive a report, we may review relevant information, including:
the reported content;
related account information;
associated technical or usage information reasonably necessary to investigate the issue;
prior moderation history where relevant.
We may take action including:
removing or restricting content;
limiting feature access;
temporarily suspending or permanently disabling accounts;
preserving certain information where reasonably necessary for abuse prevention, legal compliance, dispute resolution, or protection of users and third parties.
Where appropriate, we may cooperate with law enforcement or competent authorities in connection with child safety, threats of violence, illegal conduct, fraud, or other serious matters.
Some SpottyAndJoy features are intended to be interactive or community-facing. Depending on the feature, certain content may be visible to:
other users in the same city, region, or community area;
members of a group or discussion space;
users interacting with map reports or public content;
users viewing a profile, public discussion, event-related content, or other community section.
Users should carefully consider what they choose to share. Please do not post:
sensitive personal data;
information about other people without permission;
exact home addresses or personal contact information;
content that could create a safety risk.
We may limit, hide, remove, or anonymize content where necessary to protect privacy, safety, or platform compliance.
We do not sell your personal data.
We may share information in the following limited circumstances.
We use providers for authentication, application hosting and backend operation, database or media storage, subscriptions, notifications, maps, routing, and place lookup. Depending on the service, the information involved can include account or user identifiers, content needed for storage or delivery, purchase information, IP addresses and technical request information, push tokens, precise coordinates, map areas, or place-search text.
Providers receive the data needed for the relevant service. Some act as processors under the applicable service arrangements; others may also process request or account information for their own purposes under their privacy notices. Sending information to a provider does not mean that the information is made public to other app users. Public or participant-only visibility within SpottyAndJoy is described separately in Sections 3, 4, and 8.
We may disclose information if we reasonably believe disclosure is necessary to:
comply with law, regulation, subpoena, court order, or lawful governmental request;
enforce our rights, policies, or agreements;
investigate fraud, abuse, threats, or illegal conduct;
protect the safety, rights, or property of users, third parties, or the Service Provider.
We may retain or share limited information where reasonably necessary to prevent fraud, abuse, manipulation of community systems, or misuse of the platform.
The Application uses the following third-party services, which process data under their own privacy policies:
Firebase (Google) — used for user authentication, application data storage, and relevant notification infrastructure. This can involve account identifiers, email addresses, app content, installation identifiers, and notification-related information, depending on the service. See Google’s Privacy Policy: https://policies.google.com/privacy
RevenueCat — used to manage in-app subscriptions and purchase-related data (such as subscription status and purchase identifiers). See RevenueCat's Privacy Policy: https://www.revenuecat.com/privacy
OpenStreetMap / Nominatim — used to convert coordinates into place names and vice versa (geocoding) to power map-based and neighborhood features. See OpenStreetMap's Privacy Policy: https://osmfoundation.org/wiki/Privacy_Policy
Expo — used to deliver push notifications. Notification requests include the recipient's push notification token and the notification payload required for delivery.
OpenRouteService — used for walking-route calculation when configured. Route requests include coordinates relevant to the requested route.
OSRM — may be used as a fallback routing service. Route requests include the coordinate path and routing parameters.
CARTO — used to provide map tiles when configured. Map-tile requests identify the requested map area through tile coordinates. As with other direct network requests, the provider may receive network and technical request information, such as an IP address.
Google Play / Google Play Services — used for app distribution, purchases and subscriptions, and relevant Android platform services. Google handles the associated store-account, payment, and platform information under its own terms and privacy notice: https://policies.google.com/privacy
Apple / App Store — used for iOS app distribution, in-app purchases and subscriptions, and relevant Apple platform services. Apple processes the associated store-account, payment and platform information under its own terms and privacy notice: https://www.apple.com/legal/privacy/
SpottyAndJoy and RevenueCat process purchase or transaction identifiers, product identifiers and subscription status to verify PR access. SpottyAndJoy does not receive full payment-card details from Apple or Google Play.
Replit — used for hosting the application backend and related public web pages. Backend requests may involve IP addresses, technical request information, authentication tokens for verification, and data submitted to the relevant endpoint.
Map searches may send the entered place-search text to Nominatim; reverse-geocoding requests send coordinates to obtain place names.
Providers may act as processors or as independent controllers depending on the service and processing activity. Their own privacy terms do not replace our responsibilities for the processing for which we are responsible.
Where relevant, users should review the privacy policies of such third-party services.
Please note that third-party services may process certain data under their own privacy terms and legal obligations.
We retain personal data for as long as reasonably necessary to:
provide the Application and maintain user accounts;
operate location, report, group, and community features;
respond to support requests and maintain service functionality;
protect the platform and users from abuse, fraud, or misuse;
comply with legal obligations;
resolve disputes and enforce our policies.
Retention periods vary by data category and purpose. Account and profile data are kept to operate the account until deletion or until the information is no longer needed, subject to the limited exceptions below. User content is retained according to its feature, deletion requests, and the expiry rules below. Private conversation history may remain visible to the other participant as described in Section 12. For support correspondence, operational logs, moderation records, and purchase-verification records, the criteria include whether the relevant request, incident, entitlement, or dispute is still open, whether records are needed to prevent continuing abuse, and whether a legal retention obligation or claim applies. Backup retention also depends on the relevant provider’s storage and restoration arrangements. These criteria do not authorise unlimited retention or the use of retained information for unrelated purposes.
Content visibility and permanent deletion are separate stages:
Geographic safety reports on the Map and safety reports published within Spotted remain visible for 4 hours from creation. They become eligible for automatic deletion no earlier than 28 hours from creation.
Social Spotted posts remain visible for 24 hours from creation. They become eligible for automatic deletion no earlier than 48 hours from creation.
Map groups and their group chats close 24 hours after the group is created. The group and its associated chat messages become eligible for automatic deletion no earlier than 48 hours after the group is created.
Automated cleanup runs periodically, currently every 15 minutes. These periods are eligibility thresholds, not guaranteed deletion deadlines. Processing queues, technical issues, or the volume of associated messages may delay completion.
This automated cleanup applies to content covered by the current retention mechanism. It does not retroactively delete all historical content.
Private Spotted conversations, private PR conversations, and Agorà posts and comments are not included in this recurring cleanup. Their exclusion does not prevent deletion through applicable manual, account-deletion, or moderation procedures.
Expiry of a social Spotted post does not itself delete a private conversation created through that post.
In some cases, even after account deletion, we may retain limited information for a reasonable period where necessary for:
legal compliance;
fraud prevention or abuse investigations;
backup integrity and restoration cycles;
dispute resolution;
enforcement of our rights and protection of users.
Where possible and appropriate, we may delete, anonymize, or de-identify information rather than retain it in identifiable form.
You may delete your SpottyAndJoy account directly from the Application:
Open SpottyAndJoy.
Go to Profile > Settings > Delete my account.
Follow the confirmation and identity-verification steps shown in the Application.
You can also find instructions and a way to request account deletion without accessing the Application on our public account deletion request page:
https://spottyandjoy.it/delete-account
This page provides instructions and an email contact for submitting a deletion request; it does not automatically delete an account in the browser.
If you cannot access the Application, contact spottyandjoy@gmail.com to request account deletion. We may need to verify that you own the account before processing the request. We will process valid deletion requests within 7 business days.
When you delete your account, we will delete or anonymize your account information and associated user data within a reasonable period, except where retention is necessary for legal, security, fraud prevention, abuse investigation, dispute resolution, backup, or safety reasons as described in this Privacy Policy.
Closing your account does not necessarily remove the history of private conversations from the other participant's view. Private Spotted and PR conversations may remain available to the other participant in a closed, read-only state. If you wish to request deletion of personal information contained in a retained conversation, contact spottyandjoy@gmail.com. We will assess the request under applicable data protection law, including any applicable rights of other participants and lawful retention requirements.
Uninstalling the Application does not delete your account. Deleting your account does not automatically cancel a subscription purchased through Google Play or the App Store. You must manage or cancel its renewal through the store where you purchased it: Google Play for Google Play purchases, or Apple for App Store purchases.
We care about protecting the confidentiality, integrity, and availability of user information. We implement reasonable physical, electronic, technical, and organizational safeguards designed to protect information processed through the Application.
However, no method of transmission over the Internet or method of electronic storage is completely secure. Accordingly, while we strive to use commercially reasonable measures to protect your information, we cannot guarantee absolute security.
SpottyAndJoy is intended exclusively for people aged 18 or older. Minors are not permitted to create an account or use the Application.
This age restriction does not reduce our commitment to protecting children from abuse and exploitation. These standards apply to all users and all content and conduct associated with the Application, including profiles, images, posts, comments, private messages, group conversations, and event-related interactions.
We do not knowingly collect personal information from minors. If we become aware that an account belongs to a person under 18, we will take appropriate steps to restrict access and remove the account, handling associated data in accordance with applicable law and our Privacy Policy.
If you believe a minor has used the Application or submitted personal data through it, please contact us at spottyandjoy@gmail.com so that we can review the matter and take appropriate action.
SpottyAndJoy explicitly prohibits child sexual abuse and exploitation (CSAE) in any form.
Prohibited content and conduct include:
child sexual abuse material (CSAM), including its creation, upload, possession through the service, distribution, solicitation, or promotion;
sexual exploitation or sexualization of children;
grooming, including establishing contact with a child for the purpose of sexual abuse or exploitation;
sexual extortion, coercion, or threats involving a child;
trafficking of children for sexual purposes;
requesting, offering, or arranging sexual contact with a child;
sharing links, instructions, or other material that facilitates child sexual abuse or exploitation.
These prohibitions also apply to relevant computer-generated or manipulated imagery and to attempts to use SpottyAndJoy to facilitate prohibited conduct outside the Application.
Users can report suspected violations through the reporting tools available within the Application for content or accounts.
Child safety concerns can also be reported to:
Please use the subject line “SpottyAndJoy — Child Safety” and provide enough information to help us identify the relevant account, content, or incident, such as the username, the feature involved, and the approximate date and time.
Do not download, copy, forward, or attach suspected child sexual abuse material to a report or email. Describe the concern and identify where it was encountered without redistributing the material.
If a child appears to be in immediate danger, contact the appropriate emergency services or law-enforcement authority. Our reporting channels are not emergency services.
We review child safety reports and take appropriate action in accordance with applicable law and these standards.
When we become aware of child sexual abuse material on the Application, we act to remove it or disable access to it. Depending on the circumstances, we may also restrict or suspend access, disable accounts, and take measures to prevent further abuse.
Information associated with an incident may be preserved where necessary and lawful for reporting, investigations, or compliance with legal obligations. Access to such information is restricted to those who need it for these purposes.
We do not guarantee continuous monitoring of every interaction or immediate responses to every report. This does not limit our obligation to act when we become aware of prohibited material or conduct.
SpottyAndJoy complies with applicable child safety laws and maintains a process for reporting identified child sexual abuse material to the relevant regional or national authority, as required by applicable law.
We cooperate with competent authorities and respond to lawful requests concerning child sexual abuse and exploitation. Information is disclosed or preserved only where appropriate under applicable law.
The designated child safety contact for SpottyAndJoy can be reached at:
This contact handles child safety concerns and communications about the Application’s prevention, reporting, and enforcement procedures, including requests from Google Play, Apple and competent authorities.
These standards supplement the SpottyAndJoy Privacy Policy and Terms of Service. They do not permit any content or conduct prohibited elsewhere in those policies.
We may update these standards to reflect changes in the Application, our procedures, or applicable requirements.
The providers listed in Section 10 may process data in countries other than your own, including countries outside the European Economic Area (EEA). The countries and entities involved depend on the service, its configuration, and the provider's support and processing arrangements. This notice does not promise that all data remain in Italy or the EEA.
Where a transfer is subject to Chapter V of the GDPR, an applicable legal transfer mechanism is required. Depending on the recipient and service, this can be a European Commission adequacy decision or appropriate safeguards such as the Commission's Standard Contractual Clauses, with additional measures where required. A provider's name or a link to its privacy notice does not, by itself, establish which mechanism applies.
You may contact spottyandjoy@gmail.com to request information about the destinations and transfer mechanism applicable to your data, and how to obtain a copy of the relevant safeguards, subject to lawful confidentiality restrictions. Provider privacy and data-processing documentation also describes their international processing arrangements.
Where the GDPR applies, and subject to its conditions and exceptions, you have the right to:
obtain information about the processing of your personal data and request access to and a copy of those data;
request correction of inaccurate data and completion of incomplete data;
request erasure of personal data;
request restriction of processing;
object, on grounds relating to your particular situation, to processing based on legitimate interests; if personal data are processed for direct marketing, you may object to that processing at any time;
receive data you provided in a structured, commonly used, machine-readable format and request transmission to another controller, where the requirements for data portability are met;
withdraw consent at any time where processing relies on consent, without affecting the lawfulness of processing carried out before withdrawal;
lodge a complaint with a competent supervisory authority, including the Italian Data Protection Authority (Garante per la protezione dei dati personali): https://www.garanteprivacy.it. You may also contact the supervisory authority in the EEA country of your habitual residence, workplace, or the alleged infringement.
Send requests to spottyandjoy@gmail.com. We may request proportionate information needed to verify your identity before disclosing, changing, or deleting data; do not send passwords or unnecessary identity documents.
GDPR rights requests are normally answered without undue delay and within one month of receipt. Where the law allows an extension because of complexity or the number of requests, we must inform you within that initial month and explain the reasons. This does not replace the separate commitment in Section 12 to process valid email account-deletion requests within 7 business days.
These rights are not absolute; if a request cannot be fully granted because an applicable exception or another person's rights apply, the response should explain the relevant reasons and available remedies. Rights under other applicable laws remain unaffected.
We may update this Privacy Policy from time to time to reflect changes to the Application, legal requirements, platform requirements, or our data practices.
If we make changes, we will update the effective date at the top of this Privacy Policy and, where appropriate, provide additional notice within the Application or by other reasonable means.
An update to this notice is not, by itself, consent to new processing. Where a change requires additional information or consent under applicable law, that requirement must be met before the new processing takes place.
If you have questions about this Privacy Policy, data practices, moderation-related privacy concerns, or account deletion, you may contact:
Vincenzo Pio Tarricone
Email: spottyandjoy@gmail.com
Community content rules: see Section 4 of this Privacy Policy and the Terms of Service.
OpenStreetMap Foundation Privacy Policy