Privacy Policy

Effective Date: October 5, 2026

Blue Dot Labs, LLC ("Spotlist," "we," "our," or "us") operates the Spotlist mobile application and website at spotlist.io (collectively, the "Service"). This Privacy Policy explains what information we collect, how we use it, and your choices.

We designed Spotlist to be a curation tool, not a data collection platform. We collect only what we need to make the Service work and never sell your personal information.

1. Information We Collect

1.1 Information You Provide

• Account information: Name, email address, username, and optionally a profile photo and bio when you create an account
• Profile details: Home city, cuisine preferences, and other taste profile information you choose to share
• User content: Restaurant lists, spot notes, dish recommendations, and photos you upload
• Check-in data: When you check in at a spot, including any notes, photos, and the privacy setting you select
• Social interactions: Who you follow, which lists you follow, and kudos you send or receive
• Import data: Text, screenshots, links, and Google Takeout files you provide when importing existing restaurant lists
• Phone number (optional): If you add a phone number, we verify it with a text message and use it so people who have your number in their contacts can find you
• Contacts (optional): If you use Find Friends and allow contacts access, the phone numbers in your address book are sent to our servers to find people you know who already use Spotlist. We use them only for that match and do not store them
• Plans, trips, and polls: Plans, trips, and polls you create, including the places, dates, and people involved. If you join a shared plan on the web without an account, we collect the name you enter, your email address if you give it, and any photos or videos you add
• Music (optional): If you connect Spotify or Apple Music for Shows, we receive the artists you follow or have in your library, and keep a Spotify authorization token so we can refresh that list
• Communications: Messages you send to us for support or feedback

1.2 Information Collected Automatically

• Device information: Device model, operating system version, unique device identifiers, app version, time zone, and a push notification token
• Usage data: Features you use, screens you visit, actions you take, and timestamps of activity. This is recorded as individual events linked to your account (see Analytics in Section 4)
• Location data: With your permission, we collect precise location data (GPS) to power nearby recommendations, check-ins, and distance-based sorting. We access your location only while you are actively using the app ("when in use"), not in the background. You can revoke location access at any time through your device settings.
• Log data: IP address, browser type and user agent (including for signed-in web sessions), and error/crash reports

1.3 Information from Third Parties

• Social login: If you sign in with Apple or Google, we receive your name and email address (and only what you authorize)
• Google Places: Restaurant details (name, address, coordinates, cuisine type) retrieved when you search for or add spots
• Spotify and Apple Music: The artists you follow or have saved, if you connect either service

2. How We Use Your Information

We use the information we collect to:

• Provide and operate the Service, including list creation, discovery, and social features
• Generate taste match recommendations based on your preferences and list overlap with other users
• Display nearby spots and power map-based discovery
• Process your list imports (text and screenshot parsing)
• Screen text and photos shared with other users for harmful content, and fill in details such as dish names and cuisines (see Section 3)
• Send push notifications you have opted into (such as new followers, kudos, and recommendations)
• Respond to your support requests and communications
• Analyze how the Service is used so we can improve it
• Enforce our Terms of Service and protect against fraud or abuse
• Comply with legal obligations

3. AI and Machine Learning

Taste matching. Spotlist uses algorithms to calculate taste similarity between users based on shared spots, cuisine preferences, and related signals. These algorithms run on our own systems using data you have provided to the Service.

AI service providers. Some features send content you create to two third-party AI providers, OpenAI and Anthropic. They process it only to perform the task below and return the result to us:

• Content safety (OpenAI). Text that other people can see (list names and descriptions, spot notes, dish recommendations, public check-in notes, comments, kudos messages, and photo captions) and uploaded photos are checked by OpenAI's moderation service to block harmful content. Notes, dish recommendations and photo captions on private check-ins are not sent for this check unless you later add them to a list.
• List import (Anthropic). Text and screenshots you import are sent to Anthropic's Claude to find and match the restaurants in them.
• Filling in details (Anthropic). Your spot and check-in notes, including private ones, may be sent to Claude to pick out a dish you recommended ("Try the ...") or to work out a restaurant's cuisine, and your notes on a list may be used to suggest a list description. Only the extracted result is shown in the app. The cuisine label is shared with everyone, but your note text is never shown to anyone who couldn't already see it.
• Trip planning (Anthropic). When you plan a trip, the destination and the spots being considered are sent to Claude to arrange, name and describe the itinerary.

We send only the content needed for each task. We never send your email address, phone number, or contacts. Under their standard API terms, these providers do not use this content to train their models. They may keep it for a limited period to monitor for abuse before deleting it.

AI-powered recommendations. The Find tab may use algorithmic recommendations to surface lists and users that match your taste. We aim to be transparent about why content is recommended to you.

4. How We Share Your Information

We do not sell your personal information. We share information only in these circumstances:

With other users. Your public profile, public lists, and public check-ins are visible to other Spotlist users. You control the visibility of your content through privacy settings on each list and check-in.

Service providers. We work with these third-party companies to operate the Service. Each receives only what it needs for its task:

• Railway (hosting our servers, database, and job queue in the United States — stores all account data and content)
• Cloudflare (photo and video storage and delivery, and network security for spotlist.io — stores uploaded media and handles requests, including IP addresses)
• Google (Google Places for restaurant search and details, which receives your search terms and, for nearby results, your location; and Google Sign-In if you use it — see https://policies.google.com/privacy)
• Apple (Sign in with Apple, push notification delivery, and Apple Maps in the app)
• OpenAI and Anthropic (content safety checks, list import parsing, filling in details, and trip planning, as described in Section 3)
• Algolia (search — receives public profile details such as name, username, city, and photo, and the content of public lists, including spot notes and public check-in notes; private lists and private check-ins are not sent)
• Amplitude (product analytics — receives usage events from the app and website linked to your account ID, with device information, and an approximate location it derives from your IP address; on spotlist.io it uses a cookie. You can turn this off in the app under Settings → Privacy Settings → Share usage analytics, which stops it for your account everywhere. On spotlist.io we don't load it at all if your browser sends a Global Privacy Control or Do Not Track signal)
• Sentry (error and crash reporting — receives technical details about the failure, which can include your account ID, IP address, and the screen or request involved)
• Twilio (phone verification — receives your phone number to send a verification code)
• Resend (sending sign-in links and notification emails — receives your email address, name, and the email content)
• Loops (sending account and product emails — receives your email address, name, city, username, signup date, whether you have the app installed, and counts such as how many lists and followers you have; your contact is removed when you delete your account)
• Spotify (if you connect it for Shows — we read the artists you follow)
• Ticketmaster, SeatGeek, and Impact (concert listings for Shows — we look up events by artist name only; ticket links you open go through Impact, an affiliate network, which may record that click)
• CARTO and OpenStreetMap (map images on spotlist.io spot pages — your browser loads map tiles from CARTO, which receives your IP address and the map area shown)

Legal and safety. We may disclose information if required by law, legal process, or government request, or if we believe in good faith that disclosure is necessary to protect the rights, safety, or property of Spotlist, our users, or the public.

Business transfers. If Spotlist is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

5. Photos

You may optionally attach photos when creating notes on spots or checking in. Photos are stored on secure cloud servers with encryption in transit and at rest. Photos and videos are shared in connection with a place, so anyone who can see them can see where they were taken. When you upload them, we remove the location data your camera embeds in the file itself. Photos you attach to public lists or public check-ins are visible to other users. You may delete your photos at any time through the app.

6. Location Data

Location data is central to Spotlist's nearby discovery and check-in features, but we handle it carefully:

• We request location permission through the standard iOS system prompt
• We access location only while the app is in active use ("when in use"), never in the background
• Location is used for: nearby spot recommendations, check-in verification, and distance-based list sorting
• To notice when you arrive in a new city and suggest places there, the app sends an approximate location (rounded to about 1 km) when you open it. We keep only the most recent approximate location, delete it after 30 days without use, and delete it when you delete your account
• Your location is sent to Google Places to find nearby results. In-app maps use Apple Maps; web maps load tiles from CARTO for the area shown, not your location
• You can disable location access at any time in your device's Settings > Privacy > Location Services

7. Push Notifications

With your permission, we send push notifications for new followers, kudos received, list updates from people you follow, taste match suggestions, and nearby spot alerts. You can manage or disable notifications at any time through your device settings or in-app notification preferences.

8. Data Retention and Deletion

Account deletion. You can delete your account at any time through the in-app settings. When you delete your account:

• Your profile, lists, notes, photos, and check-ins are removed within 30 days
• Backup copies are purged within 90 days
• Aggregated, anonymized data (such as spot popularity counts) may be retained indefinitely
• Kudos you sent to others will no longer display your name

Content deletion. You can delete individual lists, notes, and photos at any time. Deletions are processed within the same timeframes as account deletion.

Data retention. We retain your personal information for as long as your account is active or as needed to provide the Service. We may retain certain information as required by law or for legitimate business purposes (such as resolving disputes or enforcing our Terms).

Shorter limits. Some data is kept for less time:

• The text, screenshots and files you import are deleted 30 days after the import. The lists and spots it created stay.
• Web sign-in sessions, with their IP address and browser details, are deleted when they expire or you sign out.
• Guests who join a plan from a shared link: their name and email are deleted after 90 days without activity on that plan. If a guest unsubscribed, we keep only their email, so they stay unsubscribed.

9. Data Security

We implement industry-standard security measures to protect your information, including encryption in transit (TLS) and at rest, secure authentication, and access controls. However, no method of transmission or storage is 100% secure. If you become aware of a security vulnerability, please contact us at [email protected].

10. Children's Privacy

Spotlist is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us at [email protected] and we will promptly delete it.

11. Your Rights and Choices

11.1 All Users

Regardless of where you live, you can:

• Access, update, or correct your profile information at any time through the app
• Delete your account and all associated data
• Control the privacy of your lists and check-ins
• Opt out of push notifications
• Disable location access
• Request a copy of your data by emailing [email protected]

11.2 California Residents (CCPA/CPRA)

If you are a California resident, you have the right to: know what personal information we collect and how we use it; request deletion of your personal information; opt out of the sale of personal information (we do not sell your data); and not be discriminated against for exercising your rights. To exercise these rights, email [email protected].

11.3 European Users (GDPR)

If you are located in the European Economic Area, United Kingdom, or Switzerland, our legal basis for processing your information is: your consent (for location data and push notifications), contract performance (to provide the Service), and legitimate interests (to improve the Service and ensure security). You have the right to access, rectify, delete, restrict processing, data portability, and object to processing. To exercise these rights, email [email protected].

12. International Data Transfers

Spotlist is based in the United States, and our servers and database are hosted in the United States. If you use the Service from outside the US, your information will be transferred to and processed in the United States, and some service providers listed in Section 4 may process it in other countries. By using the Service, you consent to this transfer. We implement appropriate safeguards for international data transfers.

13. Third-Party Links

The Service may contain links to third-party websites or services (such as Google Maps for directions). We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.

14. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the app or by email at least 14 days before the changes take effect. Your continued use of the Service after changes become effective constitutes acceptance of the updated policy.

15. Contact Us

If you have questions about this Privacy Policy or want to exercise your privacy rights, contact us at:

Blue Dot Labs, LLC
Email: [email protected]
Website: https://spotlist.io