Spotter Back to site

Privacy Policy

Last reviewed: 2026-09-16

How Spotter handles your data. Short version: we collect the bare minimum, we don't sell anything, and you can delete it all at any time.

Controller

Gonçalo Matos, Rua Futebol Clube S. Francisco N523 M24, 2890-486 Alcochete, Setúbal, Portugal. Contact for data-protection enquiries: goncalomatos97@gmail.com.

Data Protection Officer

We are not required to appoint a Data Protection Officer under GDPR Art. 37. We are not a public authority; our core activities do not consist of large-scale systematic monitoring of data subjects; and we do not process Article 9 special-category data at scale. The data-protection contact above acts as our point of contact for data subjects and the supervisory authority.

What we collect

Your email (so you can sign in) and the workout data you log inside the app. If you use the wellness features, we also store what you actively log or set there: your water intake (each drink you record, with its time), the wellness goal targets you choose to aim for (a weekly-volume, sessions-in-30-days, estimated-one-rep-max, or daily-calorie target), and which daily suggested workout you mark as done.

The wellness features are all optional and none of them is needed to run the app, so contract necessity (GDPR Art. 6(1)(b)) is not the basis for anything you log or set there. Your water intake and your daily-workout completions are not on that basis, and we do not claim they are: the app works without you ever logging a drink or marking a suggested workout as done, so contract necessity is the wrong test for them. We store them because you chose to log them, and that choice is your consent (GDPR Art. 6(1)(a)). Undoing a drink you logged, or un-marking a workout you marked as done, deletes it, and you can do either at any time.

The three training targets (weekly volume, sessions in 30 days, and estimated one-rep max) are stored so the app can show them back to you, and they are on that same consent (GDPR Art. 6(1)(a)) for that same reason: the whole app works without you ever setting a goal, so contract necessity is the wrong test for them too. Removing a target at Profile then Goals deletes it, and you can do that at any time.

A daily-calorie target is different again: it describes your diet rather than your training, so it is health information, and we hold one only if you have expressly agreed to it (GDPR Art. 6(1)(a), with your explicit consent under Art. 9(2)(a)). A bodyweight or a resting-heart-rate target would be health information too, and neither is available: the app does not offer them and our server refuses to store them, so we hold neither.

The calorie calculator works a little differently: the weight, height, age, and sex you enter into it are used on your device to suggest a number, stored locally on your device (encrypted), and never sent anywhere. Those four are health information too, and we keep them only because you agreed to that on a screen that said so in those words. Saving the calculated calorie target to your account is a second question we ask separately, because that number is the one thing here that does leave your phone. You can see what you agreed to, when you agreed, and the exact words you agreed to, at Profile then Health data, and you can take it back there at any time. If you do, we delete the weight, height, age, and sex from your phone straight away, and we delete our copy of the calorie target the next time your phone is online. The calculator keeps working; it stops remembering anything.

Separately, and only if you opt in, we process usage analytics and crash reports. Both are off until you turn them on. The analytics are about your training, so they are your personal data and we treat them as your personal data. We hold them on your consent and nothing else (GDPR Art. 6(1)(a)), and you can withdraw it at any time at Profile then Privacy.

What we send is which screens and features you use, plus rough training figures: for each set you log, a weight band instead of the exact weight, the set type, and whether it looked like a personal record; for each personal record, which kind of record it was and how big the jump was as a percentage, never the weight itself; for each finished session, a total volume band, roughly how long it ran, how many sets were in it, and, when the session produced records, roughly how many and which kinds they were; and the training goal and experience level you picked during setup, which kind of goal target you set or removed, and whether the estimated one-rep-max control was on if you made your profile public. Editing a set, deleting sets, taking an exercise out of a session you are in the middle of, and putting one back send the same kinds of thing: weight bands, the set types involved, which part of a set you changed, how many sets or exercises were involved, and, for a removal, which confirmation you had to give.

The same kinds of figure ride some other things you do, and the list above names none of them. The plate calculator sends the weight band you started from and the one you moved to, whether or not you go on to log the set. Opening the screens that show your training back to you sends how much is there and how recent it is: roughly how many sessions your history holds, how many exercises and sets are in a session you open and roughly how long ago it was, whether that session set a record, whether an exercise you open has any records yet and whether a chart has anything to draw, roughly how many weeks of the recent stretch have anything in them, and roughly how many records you have in all. Exporting, importing and undoing an import send which app or file format was involved and roughly how many workouts, sets or rows there were, and an import also sends roughly how many exercise names it needed you to match by hand. Sharing a session sends whether it set a record and which screen you shared it from. Deleting your account sends roughly how long it had been open and whether it held any workouts or any templates. Plans and templates send their size and never their contents: how many exercises are in one you make, change or delete, how many are in a plan you start, whether the name on a new one is short, medium or long, and which parts you changed when you change one. Building a plan from a template you already have sends only that name length, and saving a finished session as a template sends only the exercise count. Changing your weekly target sends the number of days you moved from and to, and changing your default rest time sends which preset rest length you moved from and to.

Inside those events there are two short codes, and neither of them is in the list above, so we should name both. An exercise is carried as a short code instead of its name, worked out fresh each time the app starts, so the same exercise does not keep the same code from one run to the next. A session is carried as a code your phone makes at random and keeps on your phone, and that code goes on everything you do inside the session: starting it, each set you log, change or delete, each record it produces, each exercise you take out of it or put back, and finishing it. It is what groups those events into one session. We never send it to our own server, so nothing we hold has it written next to the session it names: your own phone can match it back to a workout and we cannot. It is the same code the crash reports use to refer to a workout, described again in the sub-processor list below.

We do not send the exact numbers you type, the names of exercises you create, your bodyweight, or anything you write in a note. We never send your account ID to PostHog and we do not ask them who you are. What they hold is keyed to a random code their software generates on your phone. That is why, when you delete your account, we can reach the analytics held for the phone you delete from and not for another phone you used, which the erasure section below explains. It is not a reason to call the data anonymous. It is a record of one person's training, it is linked to you, and it gets the protections that come with that.

One more thing we should be straight about. Like any request your phone makes over the internet, the connection to our analytics provider carries your device IP address, and they can use it to work out a rough country-level location.

Why we collect it

Your email and your workout data are required to run the app you signed in for (GDPR Art. 6(1)(b), contract necessity). The three training targets you can set (weekly volume, sessions in 30 days, and estimated one-rep max) are not, and we do not claim they are: the whole app works without you ever setting a goal, which rules contract necessity out for a goal target whether or not that target is health information. We keep them on your consent (GDPR Art. 6(1)(a)), which you give by setting a target and take back by removing it at Profile then Goals. Your water intake and your daily-workout completions are not required either, and we do not claim they are: the same test rules contract necessity out for these two, because the whole app works without you ever logging a drink or marking a suggested workout as done. We keep them on your consent (GDPR Art. 6(1)(a)), which you give by logging them and take back by deleting them in the app. The daily-calorie target and the weight, height, age, and sex in the calorie calculator are health information, so contract necessity is not the right basis for them either and we do not claim it: the whole app works without you ever setting a goal. We rely on your consent (GDPR Art. 6(1)(a)) together with your explicit consent for health data (GDPR Art. 9(2)(a)). Nothing there is pre-selected, the button you press is itself the statement of what you are agreeing to, and you can withdraw at any time from Profile then Health data, which deletes what we hold under it. Analytics and crash reports are processed only with your explicit consent (GDPR Art. 6(1)(a)) and can be revoked at any time from the in-app privacy settings.

Public profile

Your profile is private by default. If you choose to make it public, other Spotter users who view your profile can see a slim public version of it: your handle, your display name, your profile initials (a photo avatar is not available yet), the month you joined, and your aggregate training totals (number of workouts, current streak, tonnage lifted this year, and count of personal records). Your bodyweight, body measurements, per-set data, workout dates, notes, and full workout history are never part of this public version. We rely on your consent for this public disclosure (GDPR Art. 6(1)(a)). Separately, and only if you turn on the optional Big 3 control, your public profile also shows your estimated one-rep max for bench, squat, and deadlift, estimated from your logged sets. Because that is a performance metric derived from your training, we treat your choice to publish it as explicit consent (GDPR Art. 9(2)(a)); it is off by default and never pre-selected. You can make your profile private again at any time from Profile → Public profile → Make private, and you can turn the Big 3 control off at any time from the same screen, which removes the estimated one-rep max from what others can see. Your public profile is shown only to signed-in Spotter users and is never shared with advertisers.

Sharing a plan

You can create a share link for one of your workout plans. When you do, we store the share: a link token, a note that the share belongs to you, and an expiry date 30 days out. Anyone who has the link can open a read-only copy of that plan, which shows the plan's name and its exercises with their sets, reps, and rest. It does not show your name, your notes, or any of your workout history. The link stops working on its own after 30 days, and you can turn it off sooner from the app. We do this to provide the plan-sharing feature you asked for (GDPR Art. 6(1)(b), contract necessity).

Reporting, blocking, and moderation

Spotter gives you tools to help keep the community safe. When another person has made their profile public, you can report it, for example for an offensive name or handle, an inappropriate photo, or spam or a scam. You can also block a person. Blocking works both ways: once you block someone, neither of you can see the other's profile. When you send us a report we keep a record of it, and we keep a short moderation log of any action we take, such as hiding a reported photo or putting a profile under review while we look into it. We do this to keep Spotter safe and respectful and to meet the user-generated-content rules that the App Store and Google Play require of apps like ours. The legal basis for this is our legitimate interest in a safe community (GDPR Art. 6(1)(f)). Reports are private: the person you report is never told who reported them. If someone reports you, we handle a report that contains information about you, which we received from the person who made the report (GDPR Art. 14). We use it only to review what was flagged, and we never tell you who filed it. We keep reports and any related moderation records for up to 12 months after a report is resolved, and records of the actions we take on an account for up to 24 months, and then we delete them. If you ever need to reach us about a report, a block, or anything objectionable in the app, email us at goncalomatos97@gmail.com, and we aim to review reports within 24 hours and act on them, which can include hiding content, putting a profile under review, or removing an account.

Who we share it with (sub-processors)

We rely on the following sub-processors. We do not sell your data and we do not share it with advertisers.

Where your data is

Your account and your workout data are stored in the European Economic Area, on our own server in Germany or Finland. The sub-processors that hold or receive your data (Hetzner, Resend, Cloudflare R2, PostHog, and Sentry) are used in their EU regions, so what we send them is processed in the EEA too. Apple and Google are on the list above for a store listing and for a sign-in option that is not enabled in this release; neither holds your workout data, and Sign in with Apple has no EU region to choose.

Five of them are companies with a United States parent: PostHog Inc., Functional Software, Inc. (Sentry), Cloudflare, Apple Inc., and Google LLC. Using an EU region does not by itself rule out access from outside the EEA, for example by a support team at the parent company. Where that happens, we rely on the standard contractual clauses the European Commission has approved, where the provider's data-processing agreement includes them, or on the EU-US Data Privacy Framework where the company is certified under it (GDPR Art. 45 and Art. 46). Each of these providers publishes its data-processing agreement on its own website, which is where those clauses are set out. We are still confirming, provider by provider, which of the two applies to each of them, and we will name them individually here before release. In the meantime, if you want to know where any one of them stands, write to goncalomatos97@gmail.com and we will tell you what we have.

Your rights

Under GDPR you may exercise the following rights at any time:

You can correct the numbers on a set you already logged at any time from History → open the workout → Fix a set, and the set itself is corrected straight away. Your training totals and your personal records are worked out from your sets, and correcting a set does not update them yet, so if a total or a record is still wrong after you correct a set, email us at the address above and we will put it right.

You can delete your account at any time from Profile → Delete account. To exercise restriction, objection, or any other right, email us at goncalomatos97@gmail.com.

If we cannot do what you asked

If we do not act on a request you make about your data, we will tell you why, and we will do that without undue delay and in any event within one month of receiving the request (GDPR Art. 12(3) and Art. 12(4)). We will tell you at the same time about the two routes below, and you can use either of them, or both, whether or not you come to us first.

You do not have to contact us first, but it is usually the fastest way to fix something: write to goncalomatos97@gmail.com.

Account deletion

You can request full erasure of your account from our delete-account page or from inside the app (Profile → Delete account). That removes your account and every record attached to it on our servers, and the app deletes everything it can reach on your phone.

There is one thing on your phone it cannot reach. If you imported a workout file into an older version of Spotter, a fingerprint of that file can stay in your phone's secure storage where the app cannot reach it to delete it. It holds no workout data, only that an import happened, when, and how many workouts were in it. Email us at goncalomatos97@gmail.com if you want to know more about it.

If you had analytics turned on, we also ask PostHog to delete the analytics profile held for the phone you delete from, using their Delete Persons API. That profile is your personal data, and deleting from inside the app is what lets us name it: your phone reads the random code PostHog's software generated on it and sends that code along with the deletion, so the request names your profile by that code. We never send your account ID to PostHog, on this request or on any other. If you used Spotter on more than one phone, the profile held for a phone you did not delete from is still your data and we cannot find it, because the only copy of the code that names it is on that phone and we never had it. Open Spotter on the other phone and delete your account there as well, and that phone sends its own code. If you no longer have that phone, the code is gone with it and neither we nor PostHog can pick your profile out of the others. It carries no name, no email and no account ID, and it stops growing the moment you stop using Spotter on that phone. Email us at goncalomatos97@gmail.com if you want us to look at your case (GDPR Art. 11(2)).

Crash-report data on Sentry is not deleted when you delete your account; it is purged on Sentry standard retention. There is one identifier in it we should name. Sentry's own software puts a random code on what it sends, made on your phone the first time Sentry runs there, and it does not change from one launch to the next. It is not your name, your email or your account ID, and we never send Sentry any of those. What it does mean is that Sentry can tell that several crash reports came from the same phone. Separately from that code, we turn off the network logging Sentry lets us turn off, and where a record of a request your phone made still reaches a crash report we keep only the address of the endpoint and drop the part of it that picks out one row. Where the crash trail needs to refer to a workout, it uses a random code your phone made and kept, so your own phone can match it back to that workout. Where it needs to refer to a set, it uses a scrambled code worked out from a key that exists only while the app is running, so once the app closes not even your own phone can match it back.

Data retention

We retain your workout data until you delete your account or ask us to erase it. Erasure requests are completed within 30 days. We keep nightly off-site backups, client-side encrypted before they leave our server and stored in the EU, for 30 days; a deleted account rolls off those backups within that window, after which the data is gone. Crash reports and analytics events are retained according to the standard retention windows of the respective processors.

Cookies

This site uses none. The Spotter marketing site ships zero JavaScript, zero analytics, zero cookies, and zero tracking. There is nothing to consent to here. Analytics inside the app are a separate, off-by-default, explicit-consent surface.

Contact

For any data-protection enquiry, write to goncalomatos97@gmail.com.

Updates

If this policy changes materially we'll notify you in-app on next launch and ask you to review the new version. So that we show you that notice once rather than every time you open the app, we keep a note on your device of the policy version you were last shown. That note stays on your device, is never sent to us, and is removed when you sign out or delete your account. You can read this policy at any time from Profile → Privacy Policy.