SpotStack

Privacy Policy

Last updated: May 2026

1. Overview

This privacy policy explains how SpotStack processes personal data inside the SpotStack app and on the website spotstack.app. Data controller within the meaning of the GDPR:

SpotStack.app — KRUDOP & Schön GmbH
Sonnenstr. 34, 97334 Sommerach, Germany
Managing Director: Wouter Krudop Hollenberg
E-mail: support@spotstack.app

2. Which data do we collect?

App – Saved spots: When you save a place, we store the following data on our servers: URL, title, description, image, category, address, latitude / longitude (geocoded position), and optionally phone, WhatsApp, e-mail, opening hours, notes, reminder radius and frequency, and a "visited" flag. SpotStack v1.0 has no user accounts; the data is not linked to your identity.

App – Location: To remind you when you are near a saved spot, we process your device location (latitude / longitude) in the background on your device. This real-time location is not sent to our servers and not stored. The geocoded position of a saved spot (e.g. "Café X is at 48.13, 11.58") is, however, stored on our servers.

App – Diagnostics / crash reports: If the app crashes, we send anonymous error reports (stack trace, device model, iOS version) to Sentry. Sentry does not receive any of your spots, addresses, or location data.

Waitlist: If you sign up for the Android waitlist on the website, we store your e-mail address to notify you once at launch. You can unsubscribe at any time by e-mailing support@spotstack.app or via the unsubscribe link in our e-mails.

Website: When visiting spotstack.app, our hosting provider Vercel processes technically necessary connection data to deliver and secure the website. We currently use no first-party web analytics and no marketing cookies.

3. Hosting & sub-processors

We use the following service providers (data processors per GDPR Art. 28):

  • Vercel Inc. (USA, EU region) — hosting of the landing page and web app, plus bot and spam protection through Vercel BotID. Transfers to the USA are governed by Vercel's contractual data protection safeguards.
  • Render Inc. (USA, EU region) — hosting of the backend API (api.spotstack.app). Servers in Frankfurt / Germany.
  • MongoDB Atlas (MongoDB Inc.) (USA, EU region) — database for your saved spots. Servers in Frankfurt / Germany.
  • Sentry (Functional Software, Inc.) (USA, EU region) — anonymous crash and error reports. Servers in Frankfurt / Germany.
  • Sendinblue / Brevo (Sendinblue SAS) (France, EU) — waitlist e-mail management and delivery of notifications.
  • Apple Push Notification Service (Apple Inc.) — delivery of push notifications to iOS devices.

Legal basis: GDPR Art. 6 (1) lit. b (performance of a contract) and lit. f (legitimate interest in providing & maintaining the service).

3a. Vercel BotID (bot and spam protection)

We use Vercel BotID to protect login, registration, and magic-link forms from automated attacks. The check runs in the background and rejects suspicious automated requests.

Technically necessary connection and browser characteristics may be processed, particularly the IP address, user-agent, and signals used to classify a request as human or automated. We do not use this data for advertising or cross-site tracking.

Legal basis: GDPR Art. 6 (1) lit. f (our legitimate interest in protecting the service from abuse). See the Vercel Privacy Policy for more information.

4. Location access in the app

SpotStack requests location permission to remind you when you are close to saved spots. You can revoke this permission at any time in iOS settings. The app continues to work without location access, just without proximity reminders.

5. URL preview

When you share a link to SpotStack, our server fetches the link once to extract title, image, address, phone, WhatsApp, e-mail, and opening hours (web scraping). We do not store any connection data of third-party sites.

6. Push notifications

For proximity reminders we use the Apple Push Notification Service (APNs). Push tokens are anonymous and never linked to your identity.

7. Retention

Spots are stored until you delete them. Waitlist e-mails are deleted once we have notified you at launch or when you unsubscribe – and in any case no later than 12 months after sign-up. Crash reports in Sentry are automatically deleted after 90 days.

8. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). Please contact us at support@spotstack.app. We delete all of your data within 30 days of your request.

Right to complain: You may lodge a complaint with the competent supervisory authority — in Bavaria this is the Bavarian Data Protection Authority (LDA), Promenade 18, 91522 Ansbach, Germany.

9. Changes

We reserve the right to update this privacy policy. The current version published at spotstack.app/en/privacy applies.