Spatia privacy policy

Draft for operator and legal review. This policy is not effective or ready to publish. Resolve every {{FIELD}} and the publication requirements in README.md against the release build and production services first.

Spatia helps people find WiFi networks and share network information with an audience they choose. This policy explains how Spatia LLC handles personal information through the Spatia app, its website and related services. “Spatia,” “we” and “us” mean Spatia LLC.

We are the controller of the personal information described here. Contact our privacy lead at contact@hotspothub.xyz or Operator postal address. Required regional privacy contacts

1. What to understand before sharing

Sharing a network with “Everyone” makes its location, network name and venue information available to other Spatia users. Its shared password is available subject to the credential-access rules below. Public listings are not restricted to people physically near the network. Information that is displayed can be copied or redistributed. Permission to use WiFi does not necessarily include permission to publish its password.

Some Premium credentials require an account entitlement or earned network unlock before they are displayed. That restriction does not turn a public listing into a private share or limit it to people physically nearby.

Friend and group sharing restricts access through Spatia. It is not end-to-end encrypted messaging or a password vault. We process the credentials to provide the service, and recipients can save or copy them. Group membership changes can give new members access to existing group networks. Removing access cannot recall copies already downloaded or saved elsewhere. If a password must stop working, the network operator must change it on the network.

Network names and locations can identify a home, a person or a sensitive place. Do not put someone else’s personal information into a listing or publish a private network without the operator’s authorization for the audience you select.

2. Information we handle

We do not request your Google password. Authentication tokens used in the Google sign-in flow are not retained as account credentials by this implementation. Your profile image loads from its image provider, which receives the associated connection request.

3. Location, routes and background features

Device permission controls access to location supplied by the operating system. You can deny or change permission in device settings. You can still browse the map manually or submit an area to explore, although features that need your actual location may be unavailable or less useful. An area you enter is not proof of your physical location.

Submitting a city, postal code or address during onboarding sends the query to Photon on submission, rather than on every keystroke. You can choose the provided default browsing area or move the map instead of submitting an address. Device-location permission does not control this user-entered query. The chosen coordinates can subsequently be used in map, nearby and route requests. Changing permissions does not erase a saved browsing area, cached records or information already received by our service or providers.

The map can request a walking route while a browse row is highlighted or a network is selected, before you explicitly start a walk. The route service receives the starting and destination coordinates and connection metadata. Moving a placement pin can also send its location to the platform’s reverse-geocoding service to find a venue or address.

Nearby alerts use operating-system geofences and local notifications with the necessary permissions. Background refresh runs independently of the nearby-alert setting when the operating system permits it. It can request a current location or fall back to the last location the device recorded. Turning off nearby alerts stops its geofences but does not unregister that refresh. Revoking “Always” location permission alone is not a reliable way to stop cached-location use. To prevent location access by Spatia, set its location permission to “Never” or the equivalent device setting. This does not remove location information already held by our service or recipients.

We do not maintain a dedicated server history of nearby-search coordinates. Contributions, confirmations and location-linked usage events are separate records that can reveal places associated with your activity. Infrastructure and external-provider handling is described in this policy; the absence of a location-history table does not mean no location information is retained.

Widgets, notifications and Live Activities may show nearby venue or network names, a walking destination, progress and trust information on home or lock screens. They do not include the WiFi password. People who can see those screens may see that information. Use device controls to hide previews, remove widgets or disable Live Activities.

4. Analytics and device storage

Usage analytics is currently enabled by default. You can turn off “Share usage analytics” in Settings. Turning it off stops new optional usage and performance events, clears the pending upload queue and attempts to stop an upload in progress. It does not recall events already received or delete existing server records. Authentication, synchronization, confirmations, measurements and security records needed for those features are separate from this preference.

Usage analytics does not include password text, search text, SSIDs or raw latitude and longitude fields. Some events contain a network identifier that can be linked to its location, and product events are associated with your device contributor. Some timing events, such as location and nearby-search timings, are also stored with that contributor. Performance samples omit the contributor field and use a separate session identifier, but request metadata and timestamps may still allow linkage. We do not describe these records as anonymous.

Device telemetry

Device telemetry is separate from usage analytics, and it is off unless you allow it. After you set up the app, it asks whether you want to share your precise location, the WiFi network you are connected to and your phone’s model and software with us, to help us see where coverage is missing. Choosing “Don’t allow” collects nothing, and finding and joining WiFi works the same either way. Allowing location for the app’s map is not agreement to telemetry. If we change what telemetry collects or how we describe it, we ask again anyone who had allowed it.

You can withdraw at any time in Settings by turning off “Share device telemetry”. Opting out stops collection immediately, attempts to stop an upload in progress, discards the session identifier and deletes samples waiting on your device. Your opt-out stays in force when the app or this policy is updated. It does not by itself delete samples our service has already received. To have those deleted, choose “Request telemetry deletion” in Settings: it turns telemetry off, deletes samples waiting on your device and sends us a deletion request for your device. The request does not delete anything automatically. A person reviews it and then deletes the samples our service holds for your device. Telemetry deletion request completion time If the request cannot be sent, or samples waiting on your device could not be deleted, the app says so and you can try again; samples that could not be deleted are never sent and are deleted the next time the app starts. You can also contact us as described in section 7; we locate samples by your device contributor and, where that is not available, may use the IP address and times you give us to narrow the search. We keep a record of the request itself, with your device contributor, the IP address it came from and the time, to show that it was handled. Opting out does not limit any other feature. Turning off “Share usage analytics” does not change this setting, and this setting does not change usage analytics.

To keep telemetry on without the WiFi network you are connected to, turn off “Include WiFi network” in Settings. To keep telemetry on without precise location, turn off “Include precise location” in Settings. Coordinates are then cut to one decimal place of latitude and longitude on your device before a sample is stored, an area roughly 11 km across, and waiting samples that carried your precise location are deleted. This is also how to limit the use of precise geolocation as sensitive personal information. If the operating system gives Spatia only approximate location, samples use the reduced form whatever you chose. Telemetry does not ask for the location permission; denying that permission means samples carry no location.

Waiting samples are held in the app’s local storage, which is not protected by separate application-level database encryption, until they are sent, are 30 days old or you opt out. Deleting the app deletes waiting samples and your choices; a reinstalled app asks again.

The app stores preferences, saved-network summaries, the last map area, a profile cache, downloaded networks, nearby-alert history and pending contributions locally. Network credentials in these caches and pending contributions are readable by the app and are not protected by separate application-level database encryption. The native service token uses the platform’s secure storage. The web app uses browser storage for its token and data. Protect access to your device and browser profile.

Saved-network summaries contain the network name, venue and precise coordinates, but not the password. They are stored for the device rather than scoped to a signed-in account. A private network’s summary can remain available in Saved after sign-out, an account change, access removal or network-cache expiry, until that summary is removed or local app data is cleared.

Copying a password puts it on the system clipboard, which may be available to other software or synchronized devices under your system settings. Displaying a WiFi QR code exposes the credentials to anyone who can scan or capture it. Joining through the app passes credentials to the operating system, which may save the network configuration. Deleting Spatia does not remove saved WiFi configurations or copies outside the app.

5. Who receives information

We disclose information as follows:

• Other Spatia users receive public listings and the information you share with them. Google sign-in initially sets your display name to your Google name, or the part of your email before “@” when no name is supplied. Your displayed name and weekly and lifetime contribution points can appear in public ranks, including points earned by the device before sign-in. You can change your display name in Settings. Sharing features show relevant names, group membership and senders. Anyone with your friend code can add you without a separate approval, see your display name and send you networks. Share your friend code only with people you trust.
• Service providers process information needed for hosting, databases, delivery, security and support under their applicable agreements. The production providers, functions and processing countries are Production providers and countries. Providers processing on our behalf must use information for our instructions and the contracted service.
• Google handles optional authentication and profile-image requests under its privacy policy. Native maps and reverse geocoding use platform services, including Apple on iOS and Google on Android, as applicable. The public Photon service operated by komoot receives the area-search query you submit during onboarding. On web, OpenFreeMap receives map requests that disclose viewed areas. FOSSGIS’s routing service receives route requests, including start and destination coordinates, and states that route requests are saved in server logs. External provider privacy links and retention
• We may disclose information when reasonably necessary to comply with a binding legal requirement, protect a person’s safety, investigate fraud or unauthorized access, or establish or defend legal claims. We assess requests and limit disclosure to what the circumstances and law require.
• If the business is acquired or reorganized, relevant records may transfer subject to applicable law and this policy’s protections. We will give any notice and obtain any consent required before materially different uses.

We do not sell personal information for money or other valuable consideration, share it for cross-context behavioral advertising, or use it for targeted advertising. We do not use personal information for automated decisions producing legal or similarly significant effects. Sorting networks and calculating contribution ranks are service functions.

Browser Do Not Track signals do not change app settings. We do not currently conduct the sale or targeted-advertising activities that applicable Global Privacy Control and similar opt-out signals address. These signals do not themselves disable the separate usage-analytics setting. We will honor applicable opt-out signals if covered processing is introduced, before that processing begins.

6. How long information remains

Retention exceptions restrictions and backup restore deletion controls Deletion completion times

7. Your choices and privacy requests

You can change your displayed name, remove saved networks, manage sharing relationships, disable usage analytics and nearby alerts, turn device telemetry off or remove precise location from it, and change location and notification permissions. Removing a saved network removes its saved-list entry, not the directory listing or every cached copy. Signing out unlinks that device from the account. It does not delete the account, device contributor, contributions, votes or server events.

To ask about your information or request access, a portable copy, correction, deletion or withdrawal of consent, email contact@hotspothub.xyz. In app deletion instructions You do not need a signed-in account to contact us about device-associated information. Where available, you may also restrict processing, object to processing based on legitimate interests, request recipient information or appeal a refusal. These rights have legal limits and exceptions.

We verify identity proportionately and may ask for information needed to locate the relevant account or device records. Never send us your service token or a password. If we cannot verify or locate particular records, we will explain the limitation. An authorized agent may submit a request where law permits; we may verify the agent’s authority and your identity. The request channel is available wherever you use Spatia; applicable law determines the rights, exceptions and deadlines for a particular request.

We respond within the deadline that applies to your request, normally one month under EEA or UK law and 45 days under many US state laws. If a lawful extension is needed, we explain why within the original deadline. Requests are normally free; any permitted fee or refusal will be explained. We do not penalize you for exercising privacy rights, although a feature cannot work without information necessary to provide it.

If we refuse a request, reply to contact@hotspothub.xyz with “Privacy appeal.” We review the decision and respond within the applicable deadline, with instructions for contacting the relevant regulator if the appeal is denied. You can contact a regulator about your rights. Some jurisdictions require you to raise a complaint with us before the regulator can investigate it.

You can also complain about any suspected mishandling of your personal information at contact@hotspothub.xyz, whether or not you made a rights request. “Privacy complaint” is a suggested subject line, not a condition for considering your complaint. For complaints covered by the UK rules, we acknowledge receipt within 30 days, investigate appropriately, keep you informed and communicate the outcome without undue delay. The appeal and complaint routes do not shorten other legal deadlines or remove a right to contact a regulator.

An owner or authorized operator can request removal or correction of an unauthorized network listing at contact@hotspothub.xyz. Include its listing identifier or a link and a description of the problem, without including its password. Network removal process and response time

Removing information from our service cannot retrieve copies independently made by recipients. That limitation does not excuse us from removing information we control or notifying processors and other recipients where law requires. Public contribution treatment after account deletion

8. Regional information

These provisions apply where the relevant law covers the processing. They do not limit rights available elsewhere.

California and other US states

The categories we collect, their sources, purposes, recipients and retention are set out above. Categories can include identifiers, internet and app activity, geolocation, user-provided content, relationship information and inferences such as contribution scores. Precise geolocation and some credentials can be sensitive information. We use them to provide requested features, subject to the consent or other conditions the applicable law requires. Device telemetry uses precise geolocation to improve the service only if you opt in; turning off “Include precise location” or “Share device telemetry” in Settings limits that use. Prior 12 months categories and disclosures

Where applicable, you may know, access, correct, delete or obtain a portable copy of personal information; obtain information about recipients; opt out of sale, targeted advertising or covered profiling; and limit specified uses of sensitive information. We do not perform those advertising, sale or significant-decision profiling activities. We do not knowingly sell or share the information of people under 16 for behavioral advertising. Use the request and appeal channels above. A state attorney general or other competent privacy regulator may also receive your complaint.

EEA, United Kingdom and Switzerland

Our purposes and legal grounds are:

You can withdraw consent without affecting earlier lawful processing. You can object to processing based on legitimate interests. Where information is required for a contract or by law, we explain that requirement and the effect of not providing it when collecting the information. Optional information and permissions are not required to use unrelated features.

Our processing and service providers are located in Processing countries. International transfer grounds safeguards and copy request channel We do not treat use of Spatia as consent to all international transfers. EEA UK swiss representatives and DPO if required

You may complain to your local data protection authority, the UK Information Commissioner’s Office or the Swiss Federal Data Protection and Information Commissioner. EEA authorities are listed by the European Data Protection Board.

Canada, including Quebec

Our privacy lead receives questions, access and correction requests and complaints at the contact above. We obtain consent as applicable and distinguish information needed to provide a requested service from optional uses. Service providers outside your province or country can be subject to their local laws and lawful access demands. The countries and safeguards are identified above. Quebec privacy officer title contact and localized notices

You may complain to the Office of the Privacy Commissioner of Canada or the relevant provincial authority, including the Commission d’acces a l’information du Quebec.

Brazil

Where the LGPD applies, you may request confirmation of processing, access, correction, information about sharing and consent, and anonymization, blocking or deletion of unnecessary, excessive or unlawfully processed information. Portability, consent withdrawal and deletion are subject to the applicable legal conditions. Contact our privacy lead above; you may also contact Brazil’s ANPD. Brazil local notice contact and transfer mechanism

Australia and New Zealand

Where applicable law covers the processing, you may request access and correction and complain about our handling of personal information. Our provider and country information above describes overseas processing; we remain responsible to the extent the applicable law requires. Raise a complaint with our privacy lead so we can investigate. You can then contact the Australian OAIC or New Zealand Privacy Commissioner, subject to their complaint procedures.

Other countries

You may use the same contact to exercise applicable local rights, including access, correction, consent withdrawal, objection, restriction, deletion or cessation of use where available. Local protections and any required local notice continue to apply.

Before a feature involving an overseas transfer or sensitive information needs additional local disclosure or consent, we provide the required information and choices. These may include the recipient’s identity and country, information categories, purpose, method, timing and retention, transfer safeguards, required contacts and how to refuse or withdraw consent. Other launch country notices contacts and transfer details

9. Age eligibility and sensitive places

Spatia is intended for people who meet the minimum age of 18 and any additional eligibility requirements in our terms. It is not directed to children under 13. If you believe we have collected information from a child who is not eligible, email contact@hotspothub.xyz so we can investigate and take the steps required by law. A parent or guardian can use the same channel.

Location and venue information can reveal sensitive matters, including an association with health services, religious places, schools and childcare, shelters or government and embassy sites. We do not use it to build health or other sensitive personal profiles or to target advertising. Sensitive location and consumer health data rules Where the relevant laws apply, our separate consumer health data privacy policy explains covered information and rights. Required notices, choices and safeguards must be in place before that processing begins.

10. Security and changes

We use safeguards appropriate to the information and its risks. No service can promise perfect security. Shared credentials must remain usable for the intended audience and are accessible to our service and recipient devices. Do not submit personal account passwords, payment credentials or router-administration credentials.

We post updated versions at hotspothub.xyz/privacy with their effective date. Before a material change takes effect, we give a prominent notice in the app or web app explaining it; where appropriate, we also email people who have provided an address. We obtain fresh consent where required before a new use begins. Posting an update or continuing to use the app is not consent to optional processing. A change does not retroactively authorize an undisclosed use or override the rights and choices that apply to previously collected information.