Privacy Policy

1. Introduction

This Privacy Policy explains how Sponty ("the app", "we", Crafted Life) handles information when you use the Sponty app on Android or iOS. Sponty suggests short experiences near you for the next few hours and lets you book them. To do that, we handle your location while you use the app, and, if you create an account or book, a small amount of account and booking data on our server, as described below.

You can reach us at the email at the bottom of this page.

2. Data we collect

• Location. When you allow it, the app reads your precise location while it is open and sends it with each request, so that we can find and sort experiences near you, show distances, and recognise the city you are in. Your location is used to answer that request and is not stored with your account. Results for an area may be cached briefly on our server, keyed by the area and not by who asked. Sponty does not use your location in the background. If you decline location access, you can still browse; suggestions are then based on a default location instead of where you are.
• Account details. If you create an account, we collect your email address and, if you give it, your name. Your password is stored only as a one-way hash. We send a one-time code to your email to verify it.
• User ID. When you first open the app, it creates a guest session with a random user ID, even if you never create an account. We use it to keep your preferences, saved list and bookings together and to keep you signed in.
• Preferences. The interests (categories) you choose, your maximum distance, the kind of traveller you are, your budget level and your display currency. We use them to personalise suggestions.
• Bookings. The experiences you book, the session, number of seats, price, promotion code used and booking and payment status. Payment is handled by a payment provider; we do not receive or store your full card details.
• In-app activity. Which experiences are shown to you, which you open, view, save or start booking, and where they appeared in the list (screen, position, distance, time available). We use this to improve your suggestions and to understand which suggestions work. You can turn this off with Personalization in your Profile.
• Search terms. What you type in search is sent to our server to find results and is not stored.
• Device identifiers. A random ID created by the app for your installation, the Firebase Cloud Messaging token used to send you notifications, and a Firebase installation ID created by the Firebase SDK. We use them for notifications and to manage your sessions.
• IP address. Our server uses your IP address briefly to limit abusive traffic. It is not stored in our database.

We do not collect your contacts, photos, files, messages, calendar, browsing history, health data, phone number or postal address. When you add a booking to your calendar, the app opens your calendar app's "new event" screen; it does not read your calendar.

3. How we use data

We use the data above to run the app: find and rank experiences near you, keep your account, saved list and bookings, process bookings and payments, send booking confirmations and reminders, verify your email, keep the service secure, and fix problems. In-app activity and preferences are used to personalise suggestions for you.

4. What we never do

We do not sell, rent or share your data with advertisers. Sponty has no ads and no advertising SDKs, and does not use the Android Advertising ID. Sponty contains no analytics or crash-reporting SDK. We do not track you across other companies' apps or websites.

5. Third-party services

These companies process data for us, and only to provide their service:

• Google Maps SDK (Google) -- shows the map. Google may collect data such as your device's location and how you use the map, as described in its disclosures. See Google's Privacy Policy at https://policies.google.com/privacy.
• Firebase Cloud Messaging and Firebase Remote Config (Google) -- deliver notifications to your device and let us change app settings remotely (for example a maintenance notice). Remote Config only reads settings; we do not send your personal data through it. See https://firebase.google.com/support/privacy.
• Email delivery provider (SMTP) -- sends verification codes and account emails to your email address.
• Payment provider -- processes payments for paid bookings when online payment is available in your city.
• Your phone's geocoding service (Android or iOS) -- turns coordinates into a place name on your device.

We may also disclose data if the law requires it.

6. Data retention

• Account details, preferences, saved experiences and in-app activity are kept while your account exists.
• Notifications in your in-app inbox are deleted 90 days after delivery. Records of which suggestions were shown to you are kept for 90 days.
• Location and search terms are not stored.
• Booking and payment records are kept for as long as accounting and tax law requires, even after your account is deleted.

7. Deleting your account and data

You can ask us to delete your account and the data linked to it at any time. See Delete your Sponty account for how. Deleting your account from inside the app is coming in an update. Uninstalling the app removes the data stored on your device, but does not delete your account.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your data, to withdraw consent (for example by turning off location access or Personalization), to object to or restrict some processing, and to complain to your local data protection authority. Contact us at the email below to use these rights.

9. Children's privacy

Sponty is intended for adults aged 18 and over. It is not directed at children and we do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.

10. Security

Data between the app and our server is sent over encrypted connections (HTTPS), passwords are stored hashed, and access to our servers is restricted. No system is perfectly secure.

11. Changes to this policy

We may update this policy as the app changes, for example when we add sign-in with Google or Apple or a new payment method. The date above reflects the latest revision; continued use of the app after an update means you accept the revised policy.