SPOTTER PRIVACY POLICY

Last updated: October 24, 2026

1. Who we are and when this notice applies

Spotter (Android package com.spottrek.outdoor) is operated by WANG JUNFENG, Individual developer, China. Privacy, support and account-deletion contact: wjf326@gmail.com. Spotter is intended for adults aged 18 and over.

This notice covers the Spotter app and spotterway.com, including the account, identification and payment services when enabled in your version and region. Availability is shown in the app and website. An informational website does not enable sign-in or checkout merely by describing them. Isolated test builds identify their test environment and do not turn test purchases or temporary test access into production entitlements. Earlier installed builds may use an earlier Google AI connection or local test counters; the privacy and deletion contact above also accepts requests about those earlier records.

2. Photos and online identification

When you request online identification, Spotter sends a compressed copy of the photo you capture or select, together with your chosen category, language and relevant location context, to its authenticated server. The server forwards the request to the Gemini Developer API and returns an identification. We do not upload your entire photo library or operate a remote diary photo album. A selected photo therefore does not stay entirely on your phone. EXIF metadata is removed from the re-encoded image sent for identification; this does not alter your original gallery image or local photo copy. The separately selected location context described below may still be sent.

Landmark requests may include a city or country. Street-identification requests may include an available address and rounded coordinates. Rounded coordinates, inferred places and a photo itself can still reveal a precise location or personal information. Check what you choose to submit. Identification is optional; importing photos, drafting a diary or viewing a saved route does not itself submit a new photo for AI identification. AI diary polishing remains disabled.

Our recognition business database does not store input photos, original coordinate payloads or prompts. Its operation ledger stores identifiers, request hashes, status, timestamps and the allowance selected. A separate private text-result cache supports recovery of interrupted responses: access is limited to the current account for up to 24 hours after a successful result. Results may include an identified place or other information from the submitted content. Expiry stops retrieval; scheduled cleanup and database TTL do not guarantee immediate physical deletion. Infrastructure request/security logs and the AI provider's processing are separate from this business database.

Gemini processing, safety monitoring, any service-specific logging and retention follow the applicable Google terms and configuration. We do not promise zero provider retention, immediate physical erasure or that every service tier handles data identically. Service availability is subject to Google's applicable regions and terms. Do not submit content you are not entitled to use or unnecessary sensitive information.

3. Location, route recording and maps

With your permission, location-enabled features use device location, available location metadata in photos, or a place you select manually. Location can attach an address to a record, show your position on a map or support a route you explicitly choose to record. Location recording is not started merely by opening the app, a diary or an imported GPX route.

If you start a walk, the app uses location while recording, including while another app is open or the screen is off. Android displays an ongoing foreground-service notification with a Stop control. You can pause or stop in the app, or use the notification to return to the session. An interrupted recording does not automatically restart GPS. We do not request Android's separate background-location permission. Permission can be revoked in device settings, and recording can use additional battery.

Address lookups may send precise coordinates to the device's system geocoder, OpenStreetMap Nominatim and the protected Google Maps Geocoding proxy when available in the build. OpenStreetMap tile requests reveal the map area being viewed. Map and address providers receive relevant network/request metadata, such as an IP address. A blue dot on an imported route displays your position; it does not by itself save a new walk. Street detail and house numbers depend on available data.

Camera and location access are optional for the relevant features. You may select a photo instead of taking one, and deny location. Identification can work without location, with less detailed place information; other location-dependent features may be unavailable. Revoking permission prevents future permission-dependent access but does not undo processing already performed.

4. Local content, sharing, backups and upgrades

Diaries, app photo copies, trips, notes, editable drafts, fishing records and achievements, species aliases, footprints, GPX routes, saved creations and settings remain on this device. Google sign-in restores the service identity and verified entitlements; it does not upload or restore your diary files. There is no automatic cloud diary or footprint backup.

Photo import reads available capture time and location metadata locally. PDF booklets, catch cards, GPX files and local backup exports can contain photos, notes, dates and precise locations, depending on the content and options chosen. Review them before sharing. App backup files are not encrypted by the app. Copies exported, transferred or shared with another app remain under your control and that recipient's policies. Android app cloud backup is disabled in the current Android source.

Deleting a diary entry removes that local entry; an app photo copy is removed when no retained record references it. This does not delete the original gallery photo, every separate footprint or cache, or copies already exported or shared. Local identification results can be reused for up to six hours; that reuse expiry is not a guarantee of immediate file deletion. Settings > Clear cache removes the identification cache. Clearing Android app storage removes local content, so preserve a backup first.

When a supported local upgrade is needed, the app may keep private protection copies of the old local stores and construct a separate verified data generation before selecting it. These copies can contain the original records, historical identifiers and settings, including old test-state records. They remain local, are not activated as production purchase rights and currently have no automatic source-cleanup deadline. Existing incomplete or missing attachments are reported rather than promised recovered. Clearing app storage also removes these private copies; exports outside app storage are separate. A local upgrade, rollback or account-deletion request does not silently upload or remotely erase your local diary.

5. Account identity, security and service records

Firebase Authentication provides an anonymous service identity or a Spotter identity associated with Google. Google sign-in processes provider identifiers and the profile details supplied for authentication, such as display name and email. You can associate an anonymous identity with Google or, after confirmation, switch to an existing Spotter account. These actions do not delete your Google account or move local diary files to a cloud account.

Firebase App Check and Google Play Integrity, or the website's configured App Check provider, process app/device attestation, integrity proofs and network metadata to protect access. The server checks identity and integrity proofs. Account-linking operations retain the relevant source/target identity, operation status and timestamps to recover interrupted transitions and prevent duplicate transfers. We do not put authentication tokens into the business operation ledger.

The service keeps the account UID, account timezone, successful-use and reservation records, purchase ownership, grants, credit batches and verified subscription/refund states. These records provide shared App/website entitlements, successful-use accounting, reconciliation and misuse prevention. A conservative, environment-specific device free-use record may prevent signing out or changing service identities from repeatedly recreating the same day's free allowance. Local cached balances are not proof of a payment. Only a validated successful identification consumes a use; an uncertain operation is reconciled before being treated as failed or completed.

6. Website storage and payment providers

The website stores the chosen language locally under spotter.locale. Where sign-in is enabled, Firebase uses browser session persistence when available, with an in-memory fallback. Account/session and security data support the login and account features you request. An enabled checkout may keep a minimal pending-attempt reference in session storage to recover a response; this is separate for production and test environments. You can sign out and clear browser site data. An informational build does not initialize Google sign-in or checkout sessions. Website hosting and network infrastructure may keep request, IP address and security logs.

A permanent Google-associated Spotter account is required for purchasing. Google Play handles purchases made inside the Android app. Where website purchasing is enabled, Paddle handles that checkout as merchant of record. The payment provider may collect billing contact, address, tax, device and payment information under its own notice. Spotter does not receive your full payment-card details. Its server processes product/order/transaction/subscription references, purchase credentials, currency/amount, ownership and lifecycle state needed to verify delivery, renewals, refunds and prevention of duplicate grants. Reduced webhook-event records are retained for reliable processing and retries; they do not store the raw billing-address or card payload.

The same formal Spotter account can access verified service entitlements from supported App and website channels. Test accounts, Sandbox transactions and test-only grants are separate. A checkout success page alone never grants rights. Signing out, deleting the app or requesting account deletion does not automatically cancel a subscription or issue a refund. Use the provider you paid; contact support if you need help.

7. Support, advertising and other disclosures

When you email support, we receive the email address, message and attachments you choose to send. We use them to answer support, payment or privacy requests. Send only what is needed. Never send passwords, verification codes, API keys, authentication/App Check tokens, full purchase tokens or card details.

Spotter has no advertising SDK, advertising-targeting identifier, public user feed, Firebase Analytics or Crashlytics integration in the current app and website source. We do not sell personal information or send marketing emails. Operational usage records needed for quotas and security are different from advertising analytics. Providers and infrastructure may still keep operational, diagnostic or security records; we do not promise zero logs.

We provide data to Google/Firebase, relevant Google Maps/OpenStreetMap/device services, and the payment provider for the requested features and security/payment purposes described here. We may also disclose information where required by law or necessary for a specific misuse investigation or legal claim, subject to applicable law.

Provider notices: Google: https://policies.google.com/privacy Firebase: https://firebase.google.com/support/privacy Gemini: https://ai.google.dev/gemini-api/terms OpenStreetMap: https://osmfoundation.org/wiki/Privacy_Policy Paddle: https://www.paddle.com/legal/privacy

8. Retention and account/data deletion

Local content and private upgrade protection copies remain until removed as described above. Recognition text-result access is limited to the 24-hour recovery period; physical cleanup may be delayed. Authentication identities, quota/purchase ledgers and account-linking/security records have no scheduled inactivity-only deletion in the current service. Support correspondence is kept while handling the request and as needed for follow-up and applicable obligations. Provider retention and infrastructure log settings are separate; deleting a local diary does not automatically delete those records.

To request deletion of your Spotter account and associated server data, email wjf326@gmail.com with the subject "Spotter account deletion request". Use Settings > Spotter account > Request account deletion, or Settings > Privacy and data > Request account deletion, to prepare the request where available. Review it and send it yourself: preparing, copying or opening a share sheet is not sending, receipt or deletion. The public instructions are at https://spottrek-91644-privacy.web.app/delete-data.html and https://spotterway.com/delete-data/

You may submit a request without signing in, paying, keeping the app installed or creating a new account. Include a Service ID if available, and the linked Google email where applicable; otherwise contact us with a reachable email and non-sensitive details to locate the record. These details alone are not proof of ownership. We verify the requester and correct service environment before deletion and may seek proportionate clarification through a safe channel, without requesting passwords or security tokens.

The request covers the Spotter authentication identity/profile and Google sign-in association, associated non-essential service and identification-result records, usage/entitlement data and support correspondence we control. It does not delete your Google account. We review linked purchase, refund and security records individually; limited records may need retention for a legal obligation, fraud prevention, refund or a specific dispute. We confirm completion and explain any retained categories, purpose and applicable period or criteria. Where a processor handles data for us, we address its deletion obligations as part of fulfilling the verified request; independent provider obligations may remain. We do not promise immediate physical erasure from provider backups or erase payment-provider records we do not control.

Minimal service-identifier suppression records, including hashed identifiers and restricted account-indexed block records, may be retained during controlled handling of a verified deletion to prevent delayed payment, recognition or reconciliation events, or an old sign-in session, from recreating or accessing removed service data. These records remain personal data associated with a service account; hashing does not make an identifier anonymous. They are used to enforce the deletion and are not active entitlements. We explain the purpose and applicable retention period or criteria in the response.

An account-deletion request does not remotely erase local diaries, photos, trips, routes, saved creations, upgrade protection copies or external exports/backups. Preserve what you need, then remove local content or clear app storage separately. Clearing local storage, signing out or uninstalling does not itself delete server account data. Requests for access, correction or selected data without deleting the account use the same email. We respond under the rules applicable to the request and explain verification, exceptions and any additional time needed.

9. Purposes, choices and privacy rights

We process information to deliver requested identification, maps, account and purchase features; maintain entitlements; respond to support/privacy requests; and protect the service. Depending on the processing and applicable law, grounds include providing a requested service, consent where required for optional processing, security interests and legal obligations. An operating-system permission does not replace other legal requirements.

Depending on your location and applicable law, you may have rights to access, correct, delete or receive a copy of your information, restrict or object to processing, withdraw consent or complain to a relevant data-protection authority. Contact the address above. Declining data needed for a feature may prevent that feature from working; it does not remove your applicable rights.

10. International processing and security

The operator is in China. The formal recognition, entitlement and address services are configured for United States cloud infrastructure (us-central1); actual activation and provider configuration are controlled separately. Google, Paddle, OpenStreetMap and infrastructure providers may process information in other countries. We do not claim all processing remains in your country. The provider notices and applicable service/data-processing terms describe their handling of international data; contact us about transfers relevant to your request.

Configured online services use HTTPS, identity/access checks and integrity protections. No transmission or storage system guarantees absolute security. We assess processing safeguards and legal requirements before activating services for a region; this notice is not a claim that every proposed market or provider configuration has already been approved.

11. Adults only

Spotter is intended for people aged 18 and over and is not directed to anyone under 18. If you believe a person under 18 has supplied personal information through Spotter, contact us so we can investigate information we control.

12. Updates and contact

We update this notice and its date as practices change. Where required, material changes are communicated through the app or another appropriate channel before new processing begins. New cloud-content or other processing would need an appropriate notice and any required choices before activation.

Operator: WANG JUNFENG · Individual developer · China Privacy, support and account-deletion contact: wjf326@gmail.com