Skip to content
Spotmemos

Trust

Privacy Policy

Last updated: July 26, 2026

Spotmemos is owned and operated by Castling Holdings LLC. This Privacy Policy explains how Castling Holdings LLC (“we,” “us”) handles information when you use Spotmemos and related progressive web apps or sites (the “Service”).

The Service is available worldwide. If you use it from outside the United States, your information may be processed in the United States and other countries where we or our subprocessors operate, which may have different data-protection rules than your home country.

Information we collect

Depending on how you use the Service, we may handle:

  • Account information: email address, authentication credentials or OAuth identifiers, and display name when you create an account.
  • Content you create: notes (titles and body text), places (names, descriptions, coordinates, radii, locality), tags, note links, optional image attachments, reminder and expiry settings, and related metadata.
  • Profile and preferences: plan tier, default radius, alert and quiet-hours settings, and similar product preferences.
  • Location (while open): with browser permission, precise location used while the Service is open to match nearby places. Matching generally runs on your device. A recent location may be stored locally to center the map. We do not provide true background geofencing in the browser PWA.
  • Proximity activity: when an in-app nearby alert fires, we may log an enter/exit-style event tied to a place ID (not a continuous GPS trail).
  • Push subscription data: if you enable Web Push, browser push endpoint and related keys, plus limited device context such as user agent and time zone used for quiet hours. Push is used for due reminders and household share updates—not continuous location tracking.
  • Sharing and household data: public share-link tokens you create, household membership and invite details (including optional invited email), and display names visible to household members.
  • Billing and payment information: when paid plans ship, Stripe will collect and process payment method details at Checkout. We may store subscription status, tier, billing period, and Stripe customer / subscription identifiers. We do not store your full card number on our servers. Billing is not live yet.
  • Usage and device data: hosting and infrastructure providers may log technical information such as IP address, browser type, and request metadata for security, reliability, and abuse prevention.
  • Local browser storage: preferences (for example theme), a recent map location, post-auth redirects, dismissed nearby prompts, and offline caches of your data in localStorage, sessionStorage, or IndexedDB.
  • Place search: search text and optional coordinates or map bounds sent through our geocode proxies to return place and address results.

How we use information

We use this information to operate, authenticate, sync, secure, and improve the Service; to power nearby resurfacing while the app is open, reminders, quiet hours, and optional Web Push; to enable features you choose such as public share links and household sharing; to process subscriptions when billing is enabled; to communicate about the Service (including security and support); and to comply with law and protect users and Castling Holdings LLC. We do not sell your personal information.

Legal bases

If you are in the European Economic Area, United Kingdom, or a similar jurisdiction that requires a legal basis, we process personal data where necessary to perform our contract with you, where we have a legitimate interest that is not overridden by your rights (for example securing the Service), where we need to comply with a legal obligation, or where you have given consent (for example browser location or push permission). You may withdraw consent in your browser or device settings, though some features may stop working.

International transfers

We and our subprocessors may process personal information in the United States and other jurisdictions. Where required by applicable law (for example the EU/UK GDPR), we rely on appropriate transfer mechanisms offered by our providers (such as Standard Contractual Clauses) or other lawful bases. By using the Service, you understand that your information may be transferred to and processed in countries other than your own.

Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, or export personal information we hold about you, or to object to or restrict certain processing. Spotmemos includes an in-app export of profile, places, and notes (attachments are not included in that export today). Account deletion is not yet available as a self-serve button; email [email protected] to request deletion or other privacy actions. We may need to verify your identity before responding. You can also clear local browser storage yourself and revoke browser location or notification permissions at any time.

If you are in the EEA/UK (or similar), you may also lodge a complaint with your local supervisory authority. Residents of certain U.S. states may have additional rights under state privacy laws; we will honor verifiable consumer requests as required.

Data retention

We keep personal information only as long as needed for the purposes described in this policy, including to provide the Service, meet legal obligations, resolve disputes, and enforce our agreements. Offline caches on your devices may persist until cleared by you or by the browser/OS. Aggregated or de-identified analytics, if any, may be kept longer.

Subprocessors

We rely on subprocessors to deliver the Service. They process data on our behalf as needed to provide their services:

  • Supabase: authentication, database, file storage, and related backend services;
  • Vercel: hosting and related delivery infrastructure;
  • OpenFreeMap and OpenStreetMap-related geocoding services (including Photon, Overpass, and Nominatim) used through our proxies for maps and place search;
  • Browser push services that deliver notifications you enable;
  • Google, if you choose Google sign-in when that option is enabled (Google Privacy Policy);
  • Stripe: payment processing when paid subscriptions ship.

These providers have their own privacy practices. We do not currently use third-party advertising or analytics cookies.

Cookies and similar technologies

We use cookies and similar technologies needed for authentication and session management (including auth cookies managed by our auth provider). We also use local browser storage so the Service can function offline and remember preferences, as described above.

Children's privacy

The Service is not directed to children under 13 (or under 16 where a higher age of digital consent applies), and we do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will take appropriate steps to delete it.

Changes to this policy

We may update this Privacy Policy from time to time. Changes are effective when posted, and the “Last updated” date above will reflect the latest revision. If changes are material, we may provide additional notice.

Contact

Questions about this Privacy Policy can be sent to [email protected].

See also our Terms of Service and Support.