Privacy policy
Who we are
The data controller is Nicolò Cardozo, sole proprietorship “CARDOZO NICOLO'”, VAT no. IT14708130969, via John Fitzgerald Kennedy 9, 20030 Senago (MI), Italy. For any question or request about your data, write to privacy@spilloapp.com.
What we collect
Account. Your e-mail, used only to sign in with a one-time code. No passwords, no social logins. To protect code delivery we keep a per-address counter of codes sent.
Profile, optional. First name, last name and a photo, if you choose to add them. They give a name to the maps you will share; the photo is reachable at a public address. You can change or remove them from your Profile at any time.
Your places. The places you save, with their status (to try/tried), optional note and rating, category, and (for places that arrived through a share) where they came from (for example Instagram) and the source link. The note is private: only you see it. The rating (thumbs up or down) instead joins the place's count: anyone opening the same place sees how many thumbs up and down it has received in total, without knowing from whom: we publish only the two numbers, and only once there are at least three votes, so a single vote cannot be traced back to anyone.
Shared map. If you turn it on, anyone with the link sees the places you saved and did not hide (name, address, city, category, status, rating, photos) updated with every save, together with your name and photo if you added them. Notes are never included. The link is neither indexed nor listed anywhere: whoever receives it sees it. If you choose a username, though, the map also opens from a link that contains it, and anyone who knows or guesses it can find the map; the username appears on the map next to your name. Usernames you have used stay yours and old links keep working; when you delete your account we keep only a fingerprint of them, so that nobody else takes them. We count views and followers without knowing who they are; if someone reports it we keep a fingerprint of their IP address, not the address. If you follow someone's map, we record that you follow it. Turning the map off from your Profile or the maps menu makes the link inactive at once.
Captures. When you share a link or a screenshot to Spillo, we process it to recognize the place. We keep the link and the extracted text (a transcript or the text read in the image), shown to you as the reason for the suggestion. A video's audio and images, screenshots included, are read and deleted right after processing: we do not keep them.
Place photos. Photos you upload to a place are a different matter from captures: they are kept and they are public: anyone looking at that place sees them, with no name shown next to them. They stay until you delete them or delete your account; in both cases the files are erased, not just hidden. Before becoming visible they pass an automated content filter, and anyone can report them: a reported photo is hidden and reviewed.
Location. If you allow it, we use it to sort places by distance, show how far they are and indicate where you are and which way you are facing. Coordinates are used for that calculation and are not stored.
Subscription. If you buy Premium, payment is handled by Apple or Google: we never see payment details. Through RevenueCat we receive the subscription status tied to your user identifier, to unlock what you paid for.
Service usage. We keep usage counters (captures this month, requests to external services) to enforce plan limits and prevent abuse. They are numbers, not a log of what you do.
What we do not collect. No analytics, no advertising, no tracking: neither in the app nor on this website, which uses no cookies.
Who helps us run the service
- Supabase: database, authentication and profile photo storage, on servers in the European Union.
- Cloudflare: hosting of this website and storage of the photos you upload to places.
- OpenAI: audio transcription, place recognition in captures and the automated photo filter. Content sent through the API is not used to train models.
- Google: place data (Google Places). We keep a cache of place data refreshed according to Google's terms.
- Resend: e-mail delivery: the sign-in code and the export of your places.
- RevenueCat: subscription management, together with Apple and Google, which process payments under their own policies.
- Expo: delivery of app updates; it receives technical device data (platform and app version).
Some of these providers process data in the United States. Transfers rely on the European Commission's standard contractual clauses or, where the provider is certified, on the EU-US Data Privacy Framework.
Legal basis
We process this data to provide the service you request (art. 6.1.b GDPR); location only with your consent (art. 6.1.a), revocable in system settings; anti-abuse counters under our legitimate interest in keeping the service safe (art. 6.1.f). The aggregate vote count is part of the service: removing your thumb removes it from the count too.
How long
Data is kept for as long as your account exists. When you delete it, from the app or by writing to us, account, places, captures, photos and counters are gone; database backups rotate within 30 days, after which nothing remains there either. Place information (name, address, coordinates) is not your data and stays in the shared cache.
Your rights
You can export your places (GeoJSON and CSV, by e-mail) and delete your account with all its data directly from the app, in Profile, including the photos you uploaded, which are removed from storage and not only from the database (how to). For access, rectification, restriction, objection or any other request: privacy@spilloapp.com. You also have the right to lodge a complaint with your supervisory authority.
Children
Spillo is not intended for anyone under 14 and we do not knowingly collect data from children. If you think it happened, write to us and we will delete everything.
Changes
If this policy changes materially we will say so in the app. The date at the top says when it was last updated.