Legal
Privacy Policy
Last updated 3 September 2026
This policy explains what personal data we collect through 2spot and this website, why we collect it, who we share it with, and what you can do about it. It is written to be read — if anything here is unclear, email us and we will explain it.
1. Who we are
2spot and this website are operated by NexaSoft LLC (“we”, “us”, “NexaSoft”), an independent software developer based in Azerbaijan.
For the purposes of the EU/UK General Data Protection Regulation, we are the data controller for the personal data described in this policy. Our contact point for data protection matters is support@2spot.app.
2. What we collect
The table below is the complete list of personal data categories we collect. It matches the “App Privacy” information shown on our App Store product page.
| Category | Examples | Purpose | Linked to you | Retention |
|---|---|---|---|---|
| Contact Info | Email address | App Functionality | Yes | Until you delete your account |
| User Content | Photos, captions and comments; direct and voice messages; the cars in your garage (make, model, year, plate number); events you create; profile details (username, name, photo, bio) | App Functionality | Yes | Until you delete the content or your account |
| Location | Precise location while you use the app: your position on the map, the place a spot was photographed, events near you, and live position during a drive event you joined | App Functionality | Yes | Your latest map position is overwritten on each update; spot locations are kept with the post; drive positions only for the duration of the event |
| Identifiers | User ID and device push notification tokens | App Functionality | Yes | Until you delete your account; stale push tokens are removed automatically |
| Purchases | Purchase history and subscription status. Payment is processed by Apple or Google, and we never see your card details | App Functionality | Yes | While your account exists |
Data you give us directly
When you create an account or contact support, you give us information yourself — for example an email address, or the contents of a support message. We use it for the purpose you gave it to us for.
Data collected automatically
Like most services, our servers record basic technical information when the app or website connects to them, such as IP address, device type and operating system version. We use this to keep the service running, to diagnose faults and to detect abuse.
3. Why we collect it, and our legal basis
Where GDPR applies, we rely on the following legal bases:
- Performance of a contract — data that is necessary to provide the features you have asked for, such as your account.
- Legitimate interests — keeping the service secure, preventing abuse, and understanding aggregate usage so we can fix the parts that do not work. We balance this against your rights and do not use it as a catch-all.
- Consent — anything optional, such as marketing email or (where used) analytics that are not strictly necessary. You can withdraw consent at any time.
- Legal obligation — where we are required to keep or disclose records by law.
4. Tracking and advertising
We do not track you. 2spot does not link your data with data from other companies’ apps or websites for advertising or measurement purposes, and does not share your data with data brokers. Advertising in the app is limited to clearly labelled “Sponsored” posts from businesses on the platform. It uses no third-party ad networks, and nothing about you is shared with advertisers.
We do not sell your personal data, and we do not “share” it for cross-context behavioural advertising as those terms are defined under the California Consumer Privacy Act.
5. Who we share it with
We do not sell or rent personal data. We share it only in these situations:
- Service providers who process data on our behalf and under contract, listed below.
- Legal requirements — where we are compelled by a valid legal process, or where disclosure is necessary to protect our rights, your safety, or the safety of others.
- Business transfers — if the company is acquired or merged, data may transfer to the successor entity, which will remain bound by this policy or give you notice of any change.
Service providers
| Provider | What they do for us | Their privacy policy |
|---|---|---|
| Supabase | Database, authentication, file storage and server functions | View |
| Google Firebase | Push notification delivery (Firebase Cloud Messaging) | View |
| Mapbox | Map rendering, place search and driving directions | View |
| RevenueCat | In-app purchase and subscription management | View |
| Anthropic | Automated image checks and content moderation of posts (Claude API) | View |
| Kaleido (remove.bg) | Background removal for garage car photos | View |
| Resend | Transactional email: verification codes and support mail | View |
| Vercel | Hosting for 2spot.app share links and web pages | View |
6. How long we keep it
We keep personal data only as long as we need it for the purpose it was collected for. Account data is kept while your account is active and is deleted when you delete your account. Support correspondence is kept for up to two years so we have context if you write again. Server logs are kept for a short period for security and debugging, then rotated out.
Where we are required to keep records for longer by law — for example tax or accounting records — we keep only what the law requires, for only as long as it requires.
7. Your rights
Depending on where you live, you have some or all of the following rights over your personal data:
- Access — get a copy of what we hold about you.
- Rectification — correct anything inaccurate.
- Erasure — have your data deleted.
- Restriction and objection — limit or object to certain processing.
- Portability — receive your data in a machine-readable format.
- Withdraw consent — where processing is based on consent.
- Complain — to your local data protection authority.
To exercise any of these, email support@2spot.app. We will verify that the request comes from you and respond within 30 days. We do not charge for this, and we will never treat you differently for exercising a right.
8. Deleting your data
You can delete your 2spot account and all associated personal data from inside the app, without contacting us. Full instructions, including what is deleted and what we are required to retain, are on our account deletion page.
9. Children’s privacy
2spot is not directed at children, and we do not knowingly collect personal data from children under 13 (or the higher age of digital consent that applies in your country). If you believe a child has provided us with personal data, contact support@2spot.app and we will delete it.
10. Security
Data is encrypted in transit using TLS, and at rest by our hosting providers. Access to production systems is limited to the people who need it and protected by multi-factor authentication. No system is perfectly secure, but if a breach affects your personal data we will notify you and the relevant authority as required by law.
11. International transfers
Our service providers may process data outside your country, including outside the European Economic Area. Where that happens, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses, or transfers to countries covered by an adequacy decision.
12. Changes to this policy
If we change this policy in a way that materially affects you, we will update the date at the top and, where the change is significant, give notice in the app or by email before it takes effect. Continuing to use the service after a change takes effect means you accept the updated policy.
13. Contact us
Privacy questions and data requests: support@2spot.app
General support: support@2spot.app
Azerbaijan