Legal

Privacy Policy

Effective: September 30, 2026 · Last updated: September 30, 2026

SpotTrove (“we”, “us”) builds tools that help drivers find and understand street parking. This Privacy Policy describes what information we collect when you use the SpotTrove app for iPhone and Android and spottrove.com (the “Service”), how we use it, and the choices you have.

1. What we collect

Using the map without an account

You can browse the map, read block rules, search, and set a reminder without signing in. We don’t ask guests for a name or email. To draw the map and answer searches, the app sends our server the area of the map on your screen, the time you’re checking, and what you type in search. If you allow location access, the map opens centered on where you are, so that area reflects roughly where you are. We use these requests to answer them and don’t save them to a profile or our database.

Anonymous usage events

Everyone’s app, signed in or not, sends our server a few simple events so we can see whether people use features: the app was opened, a sign-in prompt was shown, tapped, or dismissed, sign-in finished from a prompt, or a reminder was set. Each event contains only the event name, which feature it relates to, a random ID the app creates when it’s installed, and the time our server received it. The random ID is not your device’s hardware or advertising ID, and events carry no email, account ID, or location, so we don’t link them to your account. Reinstalling the app creates a new ID. We keep these events for up to one year.

Account

  • Email address. Used to sign you in (we email you a one-time code) and to contact you about the Service. On Android, email is the only way to sign in.
  • Sign in with Apple (iPhone). We receive your email address, or Apple’s private relay address if you choose to hide it. We don’t save the name Apple offers.
  • Sign in with Google (iPhone). Google shares your name, email address, and a link to your Google profile photo. Our sign-in provider stores these with your account. We don’t show them in the app.
  • Profile. An account ID, a display name taken from the part of your email address before the “@”, and counts of the sign reports you’ve submitted.

Location

SpotTrove uses location only while the app is open. It never tracks you in the background. Your position is used to show you on the map, to center the map when you open the app or tap “recenter on me”, and, after a sign scan says you can’t park, to find a garage near you. The app doesn’t send your exact coordinates to our server on their own. It sends the map area on screen or, for the garage suggestion, a small area centered on you, and we don’t save that to your account or our database. The app turns off Mapbox’s telemetry, so the map software doesn’t send your location to Mapbox for its own use (see section 3).

Parking activity (signed in)

  • Parked spot. The block you mark as “I’m parked here.” It’s deleted when you end parking, or automatically about 6 hours after you parked.
  • Saved spots. The blocks you save and the labels you give them, stored so you can see them across devices.
  • Vehicle size. If you set one (for example, sedan or SUV).

Notifications

If you’re a Premium subscriber and allow notifications, we store an Expo push token with your parking session so we can warn you before your spot turns illegal. The token is deleted along with the parking session. Reminders and alarms you set in the app are scheduled on your phone and are not sent to our server (apart from the anonymous “reminder set” event above).

Sign-scanner photos

When you scan a parking sign, the photo goes to our server, which shrinks it (dropping photo metadata such as GPS tags) and sends it to Anthropic’s Claude AI to read the sign. We don’t store scanner photos. Anthropic processes them for us under its commercial terms, which don’t allow it to train its models on them, and deletes them within 30 days unless they’re flagged for misuse or the law requires otherwise.

Sign reports

If you report a wrong or changed sign, we store the block, the kind of report, your comment, and the photo if you attach one (in private storage), linked to your account. We may read the text in the photo with software on our own server to check the report. In the app, other people see only how many reports a block has, never your comment, photo, or who you are. A confirmed report can change how that block is shown to everyone.

Subscription & payment

RevenueCat manages subscription status for us. Apple (on iPhone) or Google Play (on Android) handles billing. We never see your card number. We store your plan (free or Premium), whether it’s active, its renewal or end date, and your RevenueCat customer ID. RevenueCat receives your account ID and purchase history, not your email.

Server logs, error reports, and abuse protection

  • Request logs. Like most online services, our servers and hosting providers keep standard request logs (for example, the web address requested, the time, and an IP address) for a limited time to run and secure the Service.
  • Rate limits. To stop abuse, our server keeps short-lived counters in memory, keyed by IP address (for usage events) or account ID (for sign scans). They are never written to our database and reset at least once a day. If a limit is hit, that IP address or account ID may appear in our server logs.
  • Error reports. When something breaks on our server, an error report goes to Sentry. It can include your account ID and details of the request that failed (for example, the map area being loaded), but not your IP address. The app itself has no crash-reporting tool. If you’ve opted in on your phone, Apple or Google may share anonymous crash reports with us.

2. How we use it

  • To run, support, and improve the Service.
  • To read the parking signs you scan.
  • To send the parking notifications you opt in to as a Premium subscriber.
  • To understand, in aggregate, how people use the app (the anonymous usage events above).
  • To respond to your support requests and enforce our Terms.
  • To detect, prevent, and respond to security issues and abuse.

We do not sell your personal information, run third-party advertising in the app, or share your data for unrelated marketing. We don’t use advertising IDs and don’t track you across other companies’ apps or websites.

3. Third-party services

These companies provide parts of the Service and receive the data described here.

  • Supabase — hosts our database and private file storage, and runs account sign-in. Supabase also emails you your sign-in codes, so it receives your email address for that purpose.
  • Railway — hosts our API server.
  • Mapbox — draws the map and handles address search (it receives what you type and the area of the map you are searching). Like any map provider, Mapbox also receives the map tile requests needed to show the map, which include request details such as your IP address. The app turns off Mapbox telemetry, so the Mapbox map software does not send Mapbox your location or usage data for its own purposes. See Mapbox’s privacy policy at mapbox.com/legal/privacy.
  • Anthropic — its Claude AI reads the sign photos you scan.
  • RevenueCat — manages subscription status.
  • Apple — App Store billing, Sign in with Apple, and push delivery on iPhone. Subject to Apple’s privacy policy.
  • Google — Google Play billing and push delivery (Firebase Cloud Messaging) on Android, and Sign in with Google on iPhone. Subject to Google’s privacy policy.
  • Expo — relays push notifications to your phone and delivers app updates (it receives technical details such as the app version, the platform, and a random installation ID).
  • Sentry — receives error reports from our server.
  • Vercel — hosts spottrove.com. The website doesn’t use cookies or analytics.

If you tap Directions, the destination is handed to the maps app you pick (for example, Apple Maps or Google Maps).

Public-data sources we read from (not to): NYC Open Data, NYC DOT, Yelp Fusion. We do not send your personal information to these sources.

4. Data retention

  • Account, saved spots, vehicle, and reports — until you delete your account.
  • Parked spot and push token — until you end parking, or about 6 hours after you parked.
  • Anonymous usage events — up to one year.
  • Sign-scanner photos — not stored by us; deleted by Anthropic within 30 days, as described above.
  • Rate-limit counters — in memory only, reset at least daily.
  • Error reports — up to 90 days. Request logs — a limited period set by our hosting providers.

Deleted data can remain in our database provider’s routine backups for a short time until those backups expire. See Delete your account for exactly what account deletion removes.

5. Your choices

  • Use it without an account. The map works without signing in. You only need an account to park, save spots, scan signs, report signs, set a vehicle size, or subscribe.
  • Location. On iPhone: Settings → SpotTrove → Location. On Android: Settings → Apps → SpotTrove → Permissions → Location (names vary a little by phone). With location off, the app still works; you just lose “recenter on me” and the nearby-garage suggestion.
  • Notifications. On iPhone: Settings → Notifications → SpotTrove. On Android: Settings → Apps → SpotTrove → Notifications. You can turn off Premium alerts without canceling the subscription.
  • Camera and photos. Only used when you scan or report a sign. Turn off in the same SpotTrove settings screens.
  • Mapbox telemetry. The app keeps it turned off; there is nothing to opt out of.
  • Account deletion. In the app: Profile → Delete account. Deletion happens right away. You can also email hello@spottrove.com and we’ll erase your account and associated data within 30 days. Details: spottrove.com/delete-account.
  • Subscriptions. Deleting your account does not cancel a subscription. Cancel it in the App Store (iPhone) or Google Play (Android) subscription settings.

6. Children

SpotTrove is not directed to children under 13, and we do not knowingly collect their information. If you believe a child has provided us with information, please contact us and we’ll delete it.

7. California / EU rights

If you reside in California or the European Economic Area, you have rights under CCPA / GDPR to request access, correction, or deletion of your personal information, and to object to certain processing. Email hello@spottrove.com and we’ll honor valid requests within 30 days.

8. Security

We use TLS in transit and encryption at rest with our cloud providers. No system is perfectly secure; if we ever discover a material breach affecting your data, we’ll notify you and the relevant authorities as required by law.

9. Changes

We’ll post material updates here with a new effective date. Continued use of the Service after an update constitutes acceptance of the revised Policy.

10. Contact

Questions or requests: hello@spottrove.com.