Spotswalk Privacy Policy

Last updated: 2026-10-04 (2.0 working draft; legal review open)

Spotswalk uses account, age/country, foreground location and activity data for the location game. Everyone under 18 receives child protections. Children receive no ads or purchases and are not tracked in the background.

1. Who is responsible

EKG-expert Sverige AB operates Spotswalk and is the controller of personal data processed for the service. This policy covers the Spotswalk apps, website and related support functions. Questions can be sent to info@spotswalk.com.

2. Data we process

  • Account and profile: user ID, email, sign-in provider, display name, self-reported country, birth year and exact birth date where child classification requires it, language and settings.
  • Location and activity: precise GPS position, accuracy, time, distance, speed, visited and collected spots, points, badges, route progress and tracking-session summaries.
  • Content and relationships: spots, routes, names, descriptions, comments, photos, favorites, teams, friends, invitations, reports, feedback and links between a child and an adult.
  • Purchases and technical data: store product and transaction status, entitlements, device and operating-system information, app version, security and diagnostic logs. Apple or Google handles payment-card details; Spotswalk does not receive them.
  • Support: a contact message may include your user ID, email, app version and the text you send.

3. Why we use data

For the 2.0 core service, contract and legitimate interests are proposed per purpose; core child processing is not based on the child’s or parent’s GDPR consent. The proposal and child contractual-capacity question remain subject to Swedish and country-specific legal review. Consent may apply only to a genuinely optional, separate adult feature.

4. Location, background use and routes

For an unfinished offline collection, the original exact place is removed when the server confirms the collection and no later than 60 days after collection. No new or background location is collected. Adults may separately enable background functions.

4A. Offline recovery

This section applies to app versions that support offline recovery. In those versions, Spotswalk may let the signed-in app in the foreground try to synchronize the whole offline queue and saved tracking when the oldest queued action reaches 30 days, including in Force offline. No new or background location is collected. For an unresolved collection, the original exact location may be stored privately for at most 60 days from collection and is removed when the server confirms the collection. Allowlisted action content, sanitized images and support or attempt records are removed no later than 60 days after first receipt; a minimal key without content may remain until account deletion only to prevent duplicates. The data is not used for ads or movement history. This can apply to adults, a child using their own permitted features, and an adult collecting for a linked child. A restricted child's own collection location is not stored; their own support copy is limited to a contact message. Account deletion or revoked status or access removes applicable copies. For children, age-appropriate information is shown before delivery. Any separately required direct parent or guardian notice or approval remains a controller decision; a display receipt is not consent or proof of guardianship. Users can contact support to request access, correction, restriction or deletion.

5. Public and social features

Spots, routes, comments and photos submitted for publication can be seen by others and moderated. Depending on your settings, a public profile can show statistics, badges, spots you own, favorites, heat-map periods and distance graphs. Leaderboards, teams and friends can show a display name and activity. Team data can include membership, roles, invite codes, payer status and team credit. Recruitment links record referral relationships and successful activations. An adult linked to a child can see the child's display name, collections and activity. Review public settings and avoid publishing information that identifies a home, school or routine.

6. Children

All profiles under 18 are child profiles. Outside the USA, children from age 9 may use a normal child account; under 9 requires the adult-mediated restricted flow. In the USA, ordinary registration is blocked under 13 and the separate manual COPPA process is not production-approved. Children receive no ads or Shop, no background tracking and cannot create new UGC in 2.0. A linked adult is not proof of guardianship or GDPR consent.

7. Ads, purchases and service providers

Profiles not treated as child profiles and eligible for ads may receive banner or interstitial ads. Depending on your privacy choices, applicable law and the available signals, Google may serve personalized, non-personalized or limited ads. Where the app offers ad privacy choices, you can use them to change your decision. The Google Mobile Ads component may initialize when the app starts and may process device or advertising information under Google's rules; the app does not intentionally request or display ads for child profiles. In-app items are processed through Apple App Store or Google Play.

We use providers only where needed to operate a feature: Supabase for authentication, database, storage and server functions; Apple and Google for sign-in and purchases; Google for ads and optional translation; OpenStreetMap and map/tile infrastructure for maps; Microsoft Azure for optional text-to-speech; and email infrastructure operated through Postal/Oderland for account, invitation, contact and support messages. Providers may process technical data and IP addresses. Processing can occur outside your country with legally required safeguards. We may also disclose data when required by law or to protect users and the service. We do not sell personal data.

8. Retention and account deletion

Private support copies and their attempt logs are removed no later than 60 days after first receipt, including successful attempts. Original exact collection location is removed on server confirmation and no later than 60 days after collection. Rejected child photos are kept for 90 days. Account and activity data follows account deletion. Exact periods for other support, notification rows, closed reports, logs, adult photo metadata and COPPA evidence remain blocked before production. Technical periods are not legal approval.

9. Your choices and rights

You can edit profile and privacy settings, choose public profile fields, revoke location permissions, stop tracking, unlink accounts and request account deletion in the app. You may also ask us for access, correction, deletion, restriction, portability or objection, and you may withdraw consent. Rights can depend on the circumstances and applicable law. Contact info@spotswalk.com. You may complain to the Swedish Authority for Privacy Protection (IMY) or your local data-protection authority.

10. Security and changes

We use access controls, encrypted connections and moderation and logging measures intended to protect data, but no service can promise absolute security. We may update this policy as the service or law changes. Material changes will be presented in the app or on this page, and the date above will be updated.