Legal
Privacy Policy
Last updated: September 20, 2026 — SPOT2WATER app and website
1. Who are we?
SPOT2WATER is a collaborative mobile app and website for discovering, sharing and rating aquatic spots (lakes, rivers, waterfalls, beaches, etc.) in Europe.
Data controller:
MandySoft — info@spot2water.com
https://spot2water.com
2. Data collected
We collect only the data necessary for the app to function:
2.1 Account data
- ▸Email address — to create your account, authenticate you and send important notifications (verification, password reset).
- ▸Username — displayed publicly alongside your contributions and reviews.
- ▸Password — stored in hashed form (bcrypt), never in plain text.
2.2 Location data
- ▸GPS location — used only in real time to centre the map on your position. Your location is never recorded or transmitted to our servers.
- ▸Spot coordinates — spots you create contain a geographic position publicly visible.
2.3 User-generated content
- ▸Spot photos (stored on our servers).
- ▸Reviews, ratings and spot descriptions.
- ▸Spots added to the collaborative map.
2.4 Technical data
- ▸Server logs (IP address, device type, app version) — retained 30 days for security purposes.
- ▸Advertising identifiers (Android: GAID, iOS: IDFA) — used by Google AdMob to serve ads to non-premium users (see section 5).
3. Processing purposes
| Purpose | Legal basis (GDPR) |
|---|---|
| Account creation and management | Contract performance (Art. 6.1.b) |
| Authentication and security | Legitimate interest (Art. 6.1.f) |
| Map and spot display | Contract performance (Art. 6.1.b) |
| Sending transactional emails | Contract performance (Art. 6.1.b) |
| Serving ads (AdMob) | Consent (Art. 6.1.a) |
| Service improvement | Legitimate interest (Art. 6.1.f) |
| Legal compliance | Legal obligation (Art. 6.1.c) |
4. Data sharing
We never sell your data. We share only what is necessary with:
- ▸OVH (hosting) — servers hosted in Europe. GDPR-compliant processing.
- ▸Google Maps / Leaflet — mapping. Your location is not transmitted to Google during navigation.
- ▸Google AdMob — ads in the free version (see section 5).
- ▸Stripe — Premium subscription payment. No banking data passes through our servers.
5. Google AdMob ads
Users without a SPOT2WATER Premium subscription see ads served by Google AdMob. Google may use your advertising identifier to personalise ads based on your interests.
In compliance with Google Play and App Store requirements, we ask for your consent to ad tracking at the app's first launch.
- ▸You can withdraw this consent at any time in your device settings (Android: Settings → Google → Ads / iOS: Settings → Privacy → Tracking).
- ▸The Premium subscription (€9.90/year) completely removes ads.
- ▸Google's privacy policy: policies.google.com/privacy
6. Data retention
- ▸Active account — data retained for as long as the account exists.
- ▸Deleted account — all personal data deleted within 30 days of the request. Published spots and reviews are anonymised.
- ▸Server logs — retained 30 days.
- ▸Payment data — retained by Stripe in accordance with their legal obligations (10 years in France).
7. Your rights (GDPR)
Under the General Data Protection Regulation (GDPR — EU 2016/679), you have the following rights over your data:
- ▸Right of access — obtain a copy of all your data.
- ▸Right of rectification — correct inaccurate data.
- ▸Right to erasure — request deletion of your account and personal data.
- ▸Right to data portability — receive your data in a structured format (JSON).
- ▸Right to object — object to processing for advertising purposes.
- ▸Right to restriction — request temporary suspension of processing.
- ▸Withdrawal of consent — withdraw your consent to ad tracking at any time.
To exercise your rights:
Send an email to info@spot2water.com with the subject "GDPR Request" and your account email address. We will respond within 30 days.
You may also lodge a complaint with the relevant data protection authority. www.cnil.fr
8. Account deletion
To request complete deletion of your account and personal data:
Send an email to info@spot2water.com with the subject "Account deletion" from the email address associated with your account. We will process your request within 30 days.
Deletion is irreversible. Your spots and reviews are anonymised but remain visible on the map.
9. Security
- ▸Encrypted communications via HTTPS / TLS 1.3.
- ▸Passwords hashed with bcrypt.
- ▸Authentication via JSON Web Token (JWT).
- ▸Servers hosted in Europe (OVH).
- ▸Data access restricted to authorised personnel.
10. Children
SPOT2WATER is not intended for children under 13 (or 16 in the EU for consent-based processing). We do not knowingly collect data about children. If you believe a minor has created an account, contact us at info@spot2water.com.
11. Updates
We may update this policy. In the event of a significant change, you will be notified by email or via an in-app notification. The last updated date appears at the top of this page.
12. Contact
For any questions about this policy or your personal data:
MandySoft
info@spot2water.com
https://spot2water.com