Privacy Policy

How Spotka collects, uses, and protects your personal data.

Revision published: October 29, 2026  ·  Existing accounts: not before November 12, 2026

29 October 2026 revision. This notice applies to accounts created on or after 29 October 2026. It explains processing; it is not a request for consent to unrelated processing. For existing accounts, it takes effect no earlier than 12 November 2026 and only after the required 14-day notice period has been provided. The previous version continues to apply to those accounts until that notice period ends. Required notice, consent and mandatory legal rights are preserved; the revision does not retroactively extend retention of data collected under an earlier notice.

1. Who we are (data controller)

Spotka is operated by Sponic Gardens sp. z o.o., a company registered in Poland. Registered office: al. „Solidarności" 68/121, 00-240 Warsaw, KRS 0001248017, NIP 5253094235, REGON 545044515. We are the data controller for the personal data described in this policy.

Questions about this policy, or to exercise your rights: [email protected].

2. Data we collect

Information you provide directly

• Account data: name, email address, profile photo, and the answers and preferences you provide during onboarding or in your profile.
• Profile data: the interests, availability, and preferences you set or edit, and any info you choose to add later.
• Content you create: messages to other members, gathering invitations and ideas you post, photos you attach, inputs you submit to AI features, and any feedback or bug reports you send us.

Data collected through your use of the app

• Gathering and activity data: the gatherings you create, join, or attend; guest lists; and your responses to invitations.
• AI interaction data: information processed by background AI features, including relevant profile information, preferences and app activity. Where you use a voice or text AI feature, this also includes the audio, transcripts, text and feedback you submit. This data is used to provide AI features and evaluate service quality.
• Location: only if you turn on location sharing in your settings, used to suggest nearby gatherings and members. You can turn it off at any time.
• Device and log data: IP address, device type, operating system, app version, and timestamps when you use the app.
• Push notification tokens: so we can notify you about messages and gatherings; you can disable notifications in your device or in-app settings.

Data from third parties

• If you sign in via Google or Apple, we receive your name, email, and profile photo from that provider.
• Our payment processor provides transaction confirmation and limited billing details when a gathering involves a ticket, deposit, or paid offer.
• If another member chooses to find friends using their phone's contacts, and your email address is in their contact list, we receive a one-way scrambled (hashed) version of your email, never the address itself, to check whether it matches an existing Spotka account. See "Finding friends via your contacts" below.

Finding friends via your contacts

Spotka members can optionally use their phone's contacts to find friends who are already members, or invite the ones who aren't. This is always something the member chooses to do. We never read anyone's contacts automatically.

• What we receive: for contact matching, your device sends SHA-256 hashes of contact email addresses instead of contact names, raw addresses or phone numbers. Hashing allows matching; it does not make the data anonymous.
• What we do with it: compare the submitted hashes with discoverable member accounts to return matches. The matching feature does not save the submitted contact list or a history of matched pairs; security and rate-limit records are separate.
• What you control: a "let people who have your email find you" setting in your profile lets you opt out of being matchable this way, independent of whether you use the feature yourself.

3. How we use your data

Personal data is processed for the purposes and on the legal bases described above. Using an AI feature involves sending relevant inputs to service providers; it does not itself constitute consent to unrelated processing.

4. AI and automated decision-making

AI features use information you provide and relevant activity to generate responses and personalised suggestions. Recommendations may be inaccurate. Where the GDPR gives you rights concerning a solely automated decision with legal or similarly significant effects, you can exercise those rights, including requesting human intervention, through the contact address in this policy.

Ask Fern on spotka.co

Ask Fern on spotka.co. When you send a question, we send its text and the conversation context to OpenRouter and one of Together AI, Fireworks AI, DeepInfra or Baseten running the GLM model made by Z.ai, so it can write an answer. If that service cannot answer, we send the request to Google, which runs Gemini. The GLM route is restricted to providers offering zero data retention and refusing data collection. We keep the question and answer to help our team improve the answers, without linking them to a Spotka account. They expire after 90 days and are deleted by the next daily cleanup. These services may process the request outside the European Economic Area, including in the United States. Please do not share personal details in this chat.

5. How we share your data

We share personal data only in the following circumstances:

• Hosting, database and email: Supabase (database services), Cloudflare (hosting and network services) and Resend (email delivery).
• Analytics and error reporting: PostHog and Sentry, for the processing described in section 8.
• Advertising and payments: Meta receives advertising-measurement data where you consent; Przelewy24 (PayPro S.A.) processes online payments where a paid service is offered. These providers may act as independent controllers for their own processing.
• Provider roles: providers processing data on our behalf are subject to the data-processing terms required by law. Providers acting as independent controllers are responsible for their own processing under applicable law.
• AI and voice: providers process prompts, transcripts and audio for AI features, including Google (Gemini), OpenRouter and LiveKit. The recipient depends on the feature and model used.
• Visitor-chat AI providers: OpenRouter and the GLM hosting providers Together AI, Fireworks AI, DeepInfra and Baseten; Google provides Gemini as a fallback. Requests may be processed outside the European Economic Area, including in the United States.
• Other members: your name and profile are visible to other members as part of the app's community experience.
• Business transfers: data may be disclosed in connection with a merger, acquisition or transfer of the business, subject to applicable data protection requirements.
• Legal requirements: when required by law, court order, or to protect the safety of members or the public.
• With your consent: for any other purpose, with your prior consent.

6. Data retention

We retain personal data only for as long as necessary for its purpose, taking account of the service you use, legal obligations and relevant claims. The following criteria determine the period:

• Ask Fern website visitor questions and answers: expire after 90 days and are deleted by the next daily cleanup, without linking them to a Spotka account.
• Account, profile and service content: kept to provide your account and the features you use. On account closure or a valid erasure request, data no longer needed for those purposes is deleted or anonymised; limited records may remain where needed for legal obligations or the establishment, exercise or defence of legal claims.
• AI interactions and preferences: retained while needed to provide personalised features, maintain conversation history, investigate errors or address safety reports. The period depends on those purposes and whether the account or relevant feature remains in use.
• Billing and transaction records: retained for the accounting and tax periods applicable to the record and responsible entity, and where necessary for legal claims. These requirements may continue after account deletion.
• Contact matching: submitted contact hashes are used for the matching request rather than saved as a contact list.

You may request erasure or further information using the contact address in this policy. Erasure is subject to the exceptions in applicable data protection law; it does not necessarily remove legally required records or information held by independent controllers.

7. Your rights

Depending on your location, you may have the right to: access the data we hold about you, correct it, request deletion (subject to our retention obligations), receive it in a portable format, object to processing based on legitimate interests, restrict processing, withdraw consent at any time, and exercise applicable rights concerning solely automated decisions with legal or similarly significant effects.

To exercise any of these rights, email [email protected]. We respond without undue delay and within one month of receiving a request, as required by the GDPR. For complex or numerous requests, the GDPR permits an extension of up to two further months; we will explain any extension within the first month. We may ask for information needed to verify your identity. You may also complain to a competent supervisory authority, in particular in the EU/EEA member state of your habitual residence, workplace or the alleged infringement. In Poland, this is the President of the Personal Data Protection Office (UODO), uodo.gov.pl.

8. Cookies, analytics and tracking

The Spotka web app uses cookies for essential session management and authentication. These cannot be disabled without breaking sign-in.

For optional browser and app analytics and session recordings we ask for consent. Cookie-free counts and server-side events are described separately below. On spotka.co, in the web app and in the Android and iOS apps you can choose Accept or Decline. We use PostHog (hosted in the EU) for analytics and Sentry for error reports.

Before you answer

• Web pages and the web app: we do not set analytics cookies or store an analytics identifier on your device before consent. We count page views without cookies: PostHog makes a code from your internet address and browser on its own servers, and the key for that code is deleted every day. We use these counts only as totals.
• Ad landing pages (spotka.co/land…): we also count page loads with our own small counter. It stores no identifier and cannot tell two visits by the same person apart.
• Android and iOS apps: the app asks on first launch and sends no analytics at all until you accept.

If you accept

• We store an identifier so we can see how Spotka is used over time, linked to your account when you are signed in.
• In the web app we also make session recordings (PostHog and Sentry): a replay of how pages were used, with all text and typing hidden. Public spotka.co pages and the phone apps record no sessions.
• On spotka.co marketing pages, Accept also allows advertising measurement with Meta (below).

If you decline, or your browser sends Do Not Track or Global Privacy Control

Your browser sends us no analytics at all: no PostHog, no page-load counter, no session recordings and no Meta. The only exception is a single anonymous note, without cookies, that you pressed Decline on a spotka.co page. We treat Do Not Track and Global Privacy Control as a Decline.

Events recorded by our servers

When you use your account, our servers record some of your actions as events tied to your account ID, for example creating an account, finishing onboarding, joining a gathering or sending a message. We use them to run the service, to check that it works and to improve it (legitimate interest). They are not read from your device, so declining analytics in your browser or app does not stop them. You can object to them at [email protected].

Emails

We do not track whether you open our update and marketing emails, and we do not track clicks on their links. We keep delivery records (sent, delivered, bounced) so we stop mailing addresses that fail.

Advertising measurement and Meta

If, and only if, you accept advertising cookies on our marketing pages, we measure Meta ad performance via the Meta Pixel (page views, sign-ups) and the Meta Conversions API (a SHA-256 hash of your email sent server-side on sign-up so Meta can match the event; the hash remains personal data). Declining does not stop you signing up. Meta acts as an independent controller for data it receives.

Changing your mind

Withdrawing consent is as easy as giving it: clear this site's cookies and choose Decline (in the apps, reinstall the app and choose Decline), or email [email protected].

9. Data security

We apply technical and organisational measures appropriate to the risks of processing, as required by data protection law. No system can guarantee absolute security. Contact us if you suspect a security incident. We notify supervisory authorities and affected individuals where required by law.

10. International transfers

Sponic Gardens sp. z o.o. is established in Poland (EU). Some service providers process data outside the EEA, in particular in the United States. Where this happens we rely on appropriate safeguards: the EU Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.

11. Children's privacy

Spotka is not directed to children under 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a child, contact us so we can assess the situation and take the action required by law.

12. Changes to this policy

We may update this policy. The last-updated date identifies the latest revision. Where required by applicable law, we will inform you of changes and obtain consent before processing data for a new purpose.

13. Contact and complaints

Sponic Gardens sp. z o.o.
al. „Solidarności" 68/121, 00-240 Warsaw, Poland
[email protected]  ·  spotka.co

If you are not satisfied with our response, you have the right to complain to a competent supervisory authority, in particular in the EU/EEA member state of your habitual residence, workplace or the alleged infringement. In Poland, this is the President of the Personal Data Protection Office (UODO), uodo.gov.pl.