Spun Privacy Policy
Updated 16 October 2026
The short version
Spun needs a photo of a car to tell you what it is. We keep what the game needs (your catches, their photos with number plates and faces blurred, a rough location) and nothing more. We never sell your data and there are no ads.
What we collect
Car photos. Sent once to our identification service to recognise the car and find number plates. The copy we store, and every share card, has number plates and people’s faces pixelated (faces are found by the same identification service; if it finds people, a second, larger model double-checks for faces). The characters on a plate are read only to check them against plates owners have registered for spot alerts (below): that check happens on our server, then the text is discarded. It is never stored, logged or shown to you.
Your garage, if you add cars you own: the model, and the nickname, colour and year if you give them. Only you see it, unless you share an owner card.
Number plates you register for spot alerts. We never store the plate itself: we keep a one-way code made with a secret key, so it can’t be read back, plus its last two characters so you can tell your cars apart. When a spotter’s photo shows a registered plate, we record only which car and which day. You see how many times it was snapped on each day, from the next day on, never who took the photo, where, or the time. Photos by your friends aren’t counted, and spotters are never told whose car it is. Registering a plate needs a backed-up account; only register a plate that’s yours. Remove a plate, or the car, at any time.
Location, rounded to about 500 m, and the suburb name, so your catch log and map work. Only if you allow location and keep Map my catches on. Turn it off (Profile → Settings) and catches keep only the photo and the car; you can also remove the place from past catches, all at once or one at a time.
Your handle, level and weekly XP, if you pick a handle. Friends and (if you opt in) your suburb board see these. Nothing else about you is public.
Your catches, shown to friends in their feed for 30 days: which car, when, the XP and its tags (new card, Build, caught at an event), and the photo (plates and faces pixelated). Never where it was taken. On by default; turn them off in Profile → Show my catches to friends, or Show my photos to friends.
Public posts, only for catches you switch “Post publicly” on for: the photo, the car and your handle appear on Explore, to people who follow you, and in the daily Catch of the Day vote. They appear 2 hours after the catch, never with a place. Before any photo is shown to anyone else, our identification service checks it is suitable (no nudity, violence, children as the subject, personal documents and the like); a photo it flags stays private. A photo you post publicly is checked again as stored, then copied to a place only we can change, and that copy is what others see. An owner who registered their plate can keep their car off public feeds: photos taken after they switch that on, where their plate is read, can’t be posted publicly. People can report a post: it disappears for them at once, and for everyone once several established accounts report it. A hidden photo can’t be posted publicly again. We keep reports to review them.
Follows and votes: who you follow (only you see the list) and your daily vote (counted, never shown with your name). The winner of each day’s vote earns XP.
Event check-ins, if you check in at a meet: which event, when, and the catches you made there, for the event’s leaderboard. Checking in may ask for your location to confirm you’re at the venue; that location is checked and not stored. Other attendees see your handle on the event board only if you turn that on (friends always see it); otherwise you appear as “Spotter”. Check-ins are deleted a year after the event.
Your email, only if you back up your collection. Used to sign you in with a code. No marketing.
Your email and handle, if you reserve a handle on our waitlist before launch. Used only to give you that handle when you back up or restore in the app with the same email, and to count who joined with your invite link. No marketing. To stop abuse we keep a one-way code of your internet address for up to two days, never the address itself. Email us to remove a reservation.
Usage events (for example "caught a rare car", "opened the leaderboard"), linked to your account but never containing photos, plates or locations, so we can see what works. Turn this off in Profile → Settings; deleting your data deletes them too.
Who processes it
DigitalOcean, which hosts our server in Sydney (database, file storage and sign-in, run with the open-source Supabase software).
Cloudflare, which runs our domain names and sends the codes for backup and restore to your email address.
OpenRouter and the AI model provider it routes to (currently Google Gemini), which receive each car photo to identify it, find its number plates and read their characters (for spot alerts). They may process it outside Australia and do not keep it for training under our settings.
Your choices
Export: Profile → Export my data.
Delete: Profile → Delete all my data removes every catch, photo, garage car, registered plate and your account from this phone and our servers.
Turn off location, Map my catches, notifications, usage stats, spot alerts, sharing your catches or photos with friends, or posting a catch publicly, at any time. Block anyone from their post.
Spun is for people aged 13 and over.
Contact
Questions or requests: privacy@tryspun.com. We handle personal information under the Australian Privacy Principles.