SpotRight Privacy Policy

1. Who We Are

SpotRight is operated by Storokiv S.à r.l.-S, a Luxembourg company with registered office at 120, Rue du Cimetiere, L-8018 Strassen, Luxembourg, registered with the Luxembourg trade and companies register under B307331.

You can contact us at contact@spotright.app.

For privacy questions or data rights requests, contact us at privacy@spotright.app.

2. What This Policy Covers

This Privacy Policy explains how we process personal data when you use the SpotRight Android app, related support channels, and related website resources that link to this policy.

SpotRight is designed as an offline-first app. Basic use of the app does not require an account. Some features, including cloud-backed subscription features and family sharing, require an account and use cloud services.

3. How the App Works

SpotRight can be used in two main ways:

• local-only use, where your data remains on your device; and
• account-based subscription use, where eligible content is synced to cloud services so it can be restored across

devices and, for family features, shared with authorized family members.

4. Data We Process

Depending on how you use the app, we process the following categories of data.

4.1 Account and authentication data

If you create an account, we process account and sign-in data such as:

• your account identifier;
• your email address;
• authentication provider information, such as email/password sign-in or Google sign-in; and
• subscription-related entitlement information reflected in account claims or related backend records.

4.2 App content you create or store

You can create or store content such as:

• item names;
• tags;
• ratings or scores;
• notes;
• barcode values;
• photo-related records; and
• photo or media files.

When you use the app without cloud-backed features, this content remains on your device unless another connected feature is used, such as support, optional analytics, crash reporting, or an external barcode lookup. We receive this content only if you use cloud-backed features or another connected feature that sends data off-device.

When you use eligible cloud-backed features, the relevant content is synced to cloud services.

4.3 Photos and media

If you add photos or other media to the app, the app processes:

• the media file itself;
• file-related metadata such as content type;
• optional filename-related metadata; and
• original creation time metadata where available.

When cloud sync is active, actual media files are uploaded in original quality to cloud storage. Photos imported from your device gallery are copied into app-controlled storage before sync.

Photos taken with the in-app camera are saved by the app as app-controlled image files. Photos imported from your device gallery may preserve metadata embedded in the original file, including EXIF metadata. Depending on the source photo, this may include device, time, or location-related information. SpotRight does not use GPS or EXIF location metadata as a product feature.

4.4 Barcode and product lookup data

If you use barcode scanning, the app processes:

• camera image stream data used for barcode recognition;
• scanned barcode values;
• product information retrieved from third-party lookup services if you request or trigger a lookup.

Barcode values are stored locally and, when cloud sync is active, synced to your cloud-backed app data. Product information fetched from third-party lookup services is cached locally on the device. We do not upload that fetched product information into the app's cloud storage.

If the same account is used on another device, the synced barcode value can be used on that device to request fresh product information from external lookup services.

4.5 Family sharing data

If you use Family features, we process data needed to create and operate a shared family space, such as:

• family identifiers;
• invitation tokens and invitation status;
• membership records;
• family ownership or role records;
• family-shared item content; and
• family-scope media and storage records.

4.6 Subscription and billing-related data

Subscription purchases are handled through Google Play. We do not process your full payment card details. We process subscription-related data such as:

• purchase tokens;
• subscription tier and entitlement state;
• billing status signals received from Google Play; and
• records needed to activate, maintain, limit, restore, or revoke access to subscription features.

4.7 Device, diagnostics, and analytics data

We may process technical and diagnostic data, such as:

• app version;
• operating system details;
• crash reports and related diagnostic information;
• app analytics events and usage information, if enabled under the applicable consent model; and
• app integrity or abuse-prevention signals.

We use crash reporting services to help detect, investigate, and fix app errors. Crash reporting and other strictly necessary diagnostics are separate from optional analytics.

Optional analytics are disabled by default on every device. We process optional analytics only after you explicitly opt in on that device. If you do not make a choice or decline analytics, analytics remain disabled. You can withdraw your consent in the app, which disables future analytics collection on that device.

4.8 Notification data

If notifications are enabled, we process push-related data such as device or app messaging tokens and topic-subscription information used for service notifications.

4.9 Support communications

If you contact us for support at support@spotright.app, we process your email address, the content of your request, and any files or screenshots you send us.

5. Where Data Comes From

We collect data:

• directly from you;
• from your device when you use app features;
• from Google Play in connection with subscription handling;
• from service providers used to provide authentication, storage, messaging, diagnostics, analytics, and related

infrastructure;

• from external product lookup services you trigger through barcode-based lookups; and
• from support communications you send to us.

6. Recipients and Service Providers

We share or make data available to the following categories of recipients when needed to provide the relevant feature:

7. Why We Process Personal Data

We process personal data to:

• provide the app's core local and cloud-backed functionality;
• authenticate users and secure access to cloud features;
• sync user content across devices;
• operate shared family spaces and invitations;
• attach and sync photos or other media;
• process barcode lookups and related product matching flows;
• activate, maintain, and verify subscription entitlements;
• send service notifications related to family sync or update events;
• maintain security, integrity, fraud prevention, and abuse prevention;
• detect, diagnose, and fix crashes or technical issues;
• understand app usage if analytics is enabled under the applicable consent model;
• respond to support requests; and
• comply with legal obligations and enforce our terms.

8. Legal Bases

Where GDPR applies, we generally rely on the following legal bases, depending on the processing activity:

• performance of a contract, to provide the app features, account features, family-sharing features, cloud sync, and

subscription-backed services you request;

• legitimate interests, for security, abuse prevention, diagnostics, service protection, and support handling where

appropriate;

• consent, for optional analytics and similar optional processing; and
• legal obligation, where we must keep or disclose certain records under applicable law.

9. Family Sharing and Visibility

If you use a Family plan, a dedicated shared family space is created for that family. Authorized family members can read shared family item content, including item names, tags, ratings or scores, barcode values, and photos.

Notes have a different model. In family space, notes attached to a family item are visible to family members. They are not private personal notes. Notes are per-user notes attached to the same family item. Each family member can read notes attached to that item, only the note owner can edit their own note, and a family member may remove a note from the shared family context.

Only the item owner may move an item from family scope to personal scope. When that happens, the item is reassigned and stops being available in the family space once device synchronization and reconciliation complete.

If a member leaves a family or is removed, cloud access to that family space ends immediately. However, data already cached on a device may remain locally available until the app next reconciles that device state.

10. Barcode Recognition and Third-Party Product Lookups

SpotRight uses barcode-related processing to help identify products. Barcode recognition is performed using device-side barcode recognition technology. If product information is not already found locally, the app queries external product information sources, including Open Food Facts and UPCitemdb.

Those lookups involve sending the scanned barcode to those services when a lookup is triggered. Their handling of that information is governed by their own terms and privacy practices.

11. Cloud Services and Service Providers

We use service providers, including Google service providers, for authentication, database storage, file storage, cloud processing, messaging, crash reporting, analytics, app integrity checks, and subscription-related processing.

Primary application data is hosted in an EU region where configured for app data. However, some service-provider processing, support operations, or related transfers may occur outside the EEA under the provider's contractual and legal safeguards.

12. Notifications

We use push notification services to send service notifications. Based on the current product design, these service notifications are used for family-related sync or update signaling. These are operational notifications, not marketing messages.

13. Analytics and Crash Reporting

We use crash reporting services and other strictly necessary diagnostics to help identify and fix app errors. These diagnostics are separate from optional analytics.

Optional analytics are disabled by default on every device and remain disabled unless you explicitly opt in on that device. A not-decided or declined choice keeps analytics disabled. You can withdraw your consent in the app at any time; withdrawal disables future analytics collection on that device. Your analytics choice does not prevent you from using the app's basic contracted features.

14. Retention

Retention depends on the type of data and the feature you use.

14.1 Local-only data

Local-only app data remains on your device until you remove it, uninstall the app, or otherwise clear app data, subject to any separate connected feature you use such as support, optional analytics, crash reporting, or external product lookup.

14.2 Active account and cloud-backed data

Account and cloud-backed content is retained while your account and the relevant feature remain active, unless a different retention rule applies.

14.3 Normal subscription expiry

After normal subscription expiry, cloud-backed data enters a 30-day read-only retention period. After that, we keep the data for up to an additional 60 days on a limited goodwill basis to support export or GDPR data access requests.

14.4 Refund or revocation

If access is revoked because of a refund or revocation rather than normal expiry, service access may end immediately. Data handling still remains subject to applicable legal rights, deletion workflows, and lawful retention duties.

14.5 Inactive free cloud accounts

If a free SpotRight account has no account activity for 3 years and is not linked to an active subscription or active family service, we may delete the account and associated cloud data after reasonable advance notice where we have a valid contact method.

Account activity includes signing in, syncing data, using account features, making a data export or deletion request, or having an active subscription or family entitlement. We do not treat a paid subscription or active family service as inactive while the relevant entitlement remains active.

Inactive-account deletion does not replace the shorter retention rules that apply after normal subscription expiry, refund, revocation, account deletion requests, family deletion, or other feature-specific retention periods.

Some limited records may be retained where required or appropriate for legal obligations, accounting, security, abuse prevention, moderation, dispute handling, or enforcement of our terms.

14.6 Account deletion requests

Account deletion requests are handled separately from ordinary subscription expiry. We delete or de-identify account-associated data unless a longer retention period is required by law, necessary to protect our legitimate interests, or necessary to preserve data that remains relevant to other family members or a valid retention period.

After confirmed account deletion, SpotRight removes your account access, signs you out, and clears SpotRight local app data from the device where deletion is confirmed. This does not delete files you separately exported, shared, backed up, screenshotted, or stored outside SpotRight.

14.7 Family-shared data

Family-shared data may require special handling because it may remain relevant to other family members, a retained family space, or a lawful retention period.

If a non-owner family member deletes their account, their family membership ends and their personal account and personal cloud data are erased. Family-shared content remains available to the family, but the deleted member's identifiers on remaining shared items, photos, and notes are replaced with a neutral deleted-member marker.

If the family owner deletes their account, the owner's account access is removed and account erasure starts immediately. The family space enters deletion-pending read-only status for 30 days so remaining family members can export or save shared family data. After that read-only period, family cloud data is purged, subject to any additional limited retention needed for data-rights requests or legal obligations.

14.8 Support communications

Support communications are retained for up to 24 months after the request is resolved, unless longer retention is needed for legal claims, abuse prevention, accounting, compliance, or another lawful reason.

15. Your Privacy Rights

Your rights depend on where you live and which privacy laws apply to your use of SpotRight.

15.1 EEA, UK, and Swiss privacy rights

Where EU GDPR, UK GDPR, Swiss data protection law, or similar privacy law applies, you may have the right to:

• access your personal data;
• correct inaccurate or incomplete data;
• request deletion of personal data;
• request restriction of processing;
• object to certain processing, including processing based on legitimate interests;
• receive portable copies of certain data;
• withdraw consent where processing depends on consent; and
• complain to a supervisory authority.

Because SpotRight is operated by a Luxembourg company, you may contact or complain to the Luxembourg data protection authority. Depending on where you live, you may also have the right to contact your local supervisory authority.

15.2 Additional information for California residents

If and to the extent the California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies to SpotRight, this section provides additional information for California residents.

We collect the categories of personal information described in this Privacy Policy, including identifiers, account and authentication data, app content you create or store, photos and media, barcode values, subscription and billing-related records, device and diagnostics data, analytics data where enabled, notification data, support communications, and information used for security, fraud prevention, abuse prevention, and moderation.

We collect and use this information for the purposes described in this Privacy Policy, including to provide the app, sync and restore content, operate family sharing and public sharing features, process subscriptions, provide support, secure the service, diagnose issues, comply with law, enforce terms, and prevent abuse.

We disclose personal information to the categories of recipients described in Section 6, including service providers that help us provide authentication, hosting, storage, messaging, diagnostics, analytics, subscription processing, support handling, and product lookup features. We do not sell personal information. For the app processing described in this Privacy Policy, we do not share personal information for cross-context behavioral advertising.

Some information may be considered sensitive personal information depending on what you choose to store in SpotRight, such as photos, notes, account login information, or metadata embedded in files you import. We do not use or disclose sensitive personal information for purposes that require a separate right to limit under California privacy law.

Subject to applicable law, California residents may have the right to request access to personal information, request correction, request deletion, receive information about categories of personal information collected and disclosed, opt out of sale or sharing where applicable, limit certain uses of sensitive personal information where applicable, and not be discriminated against for exercising privacy rights.

We do not knowingly sell or share personal information of users under 16 years old.

15.3 How to exercise your rights

To exercise privacy rights, contact privacy@spotright.app.

If you have a SpotRight account, you can also use in-app privacy and data-rights features, including account deletion and data export where available. We may need to verify your identity before completing a rights request. Some rights are subject to legal limits, including where retention is required for security, abuse prevention, legal obligations, accounting, dispute handling, or data that remains relevant to other family members or public-share moderation records.

16. Account Deletion and Data Export

You can request account deletion in the app at Settings -> Account & Security -> Privacy & Data Rights -> Delete My Data.

If you cannot access the app, you can request deletion through the public deletion page for your language at https://spotright.app/legal/android/data-deletion.html or by contacting privacy@spotright.app.

The in-app deletion flow requires you to confirm that the action is irreversible and type DELETE before submitting the request. Account erasure is processed asynchronously and may take time to complete, especially where the account contains many items or media files or where service retries are needed.

Before deleting your account, use the in-app data export / data retrieval flow if you want to keep a copy of your data. SpotRight data export provides a downloadable ZIP with structured export data and a simple file index for associated files. Large media files may be listed separately instead of being bundled into one archive, because a single export may contain gigabytes of data. Files listed in an export remain downloadable only while the underlying data still exists on SpotRight servers. If you confirm account deletion or data erasure, previously generated export links may stop working and erased files cannot be recovered through those links.

If you have an active Google Play subscription, the deletion flow requests cancellation of future Google Play renewal where supported. This stops future renewal. It does not create an automatic refund for the current billing period. If renewal cancellation cannot be completed, you may still need to cancel manually through Google Play.

Login account removal is part of the erasure process. After successful erasure, you can no longer sign in to that account. We send an erasure report email after successful completion.

After confirmed deletion, SpotRight removes your account access, signs you out, and clears SpotRight local app data from the device where deletion is confirmed. This does not delete files you separately exported, shared, backed up, screenshotted, or stored outside SpotRight.

Deletion and export handling may depend on whether data is personal-only, shared with a family, in active retention, or already scheduled for purge.

For family-shared data, deleting one account may not immediately erase all shared records if those records are still needed for other family members or for a lawful retention period. If a non-owner family member deletes their account, family-shared content remains available to the family, but the deleted member's identifiers on remaining shared content are replaced with a neutral deleted-member marker. If the family owner deletes their account, the family space enters deletion-pending read-only status for 30 days before purge so remaining members can export or save shared data.

17. Children

SpotRight is not intended to be directed to children as a primary audience. Users should avoid storing unnecessary sensitive personal information in the app, including in notes or photos.

18. Security

We use technical and organizational measures intended to protect account data, cloud-stored content, and related systems. No method of storage or transmission is completely secure, but we work to limit unauthorized access through authentication controls, scoped permissions, and related security measures.

19. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we may provide additional notice in the app, by email, or through other appropriate means.

20. Contact

Operator: Storokiv S.à r.l.-S

Address: 120, Rue du Cimetiere, L-8018 Strassen, Luxembourg

Email: contact@spotright.app

Privacy contact: privacy@spotright.app